The first release of Harmony has been a lot of work, and we’ve come a long way. We’ve made a lot of improvements on the codebase in the few short months we’ve had to work on this. We’re going to expand on what made this update happen and the process that went into that.

Want just the new updates? Feel free to skip to the change log.

The Road to 0.1.0

The road to Harmony’s initial release has been a bit of a ride. We intended to publish it three months ago, but various contributions, improvements, and security patches forced us to reconsider our release timeline. Nevertheless, we are proud to present a more stable and secure service that future releases will be built upon.

Roughly 261k lines of dead code and assets has been removed from the codebase, bringing the project’s size down to 51k lines. A decent chunk of this reduction resulted from deleting the C# Admin API, which was built in a way that, in our opinion, didn’t scale well. It was near enough a raw view of the database and nothing more. We also refactored the CDN routes and the Gateway’s type checking, and removed a seemingly random text file that consisted of about 120k lines.

Major changes have also taken place regarding the dependancies Harmony relies on. Some have been completely removed to help us better understand the codebase and avoid AI tainted code from upstream. This initative will continue into next update with the removal of more dependancies and the abstraction of some into modules.

The more we work to improve Harmony, the harder it becomes to avoid projects contaminated with AI slop. Many simple concepts, for which there are many projects to choose from, lack any free of AI. Therefore, the Harmony team must build these tools from scratch, or fork an existing project from a point in time prior to any usage of AI. In the case of Harmony’s status page, Mathium took it upon themself to write it from scratch. They plan to continue creating such tools for use in Harmony, and to provide more projects to the FOSS scene free of slopcode. In addition, we published a .env file reader/extractor dependancy for use within Harmony. We support and encourage other projects to make use of our AI free tools.

It should be noted that, while we have not set up WebRTC on the main instance yet, we have made it much easier to do so. Various updates and fixes have been applied to the WebRTC packages, and the SFU is now bundled for Linux based operating systems to use. Additionally we purged settings that are unnecessary. Like the IP address setting for the SFU that was unneeded.

For the next update: we plan to continue removing dependancies, fix some existing connections that are broken, add new connection, and improve the codebase’s quality overall.

New Features

Status Page

While it’s not a part of Harmony itself we now have a status page so you can check on Harmonies uptime! Check up on it here

Steam Connection

You can now link your Steam profile on your Harmony profile! Show everyone your cool username and verify that your Steam account is actually yours!

Codeberg Connection

You can now link your codeberg account on Harmony! Huzzah!

New GIF Providors

In addition to Tenor, Harmony now supports Giphy and Klipy. The codebase is equipped to add more GIF providers with ease for the future!

Polls

You can now send polls in chats!

Domain Connections

You can now verify that you own your domains in your profiles via DNS record verification. You don’t even need to set it up as an instance owner, it should just work automatically.

New Style Uploads

Harmony now properly supports new style uploads. We’ve fixed many bugs, and added more configuration settings. Fermi now uses the new style uploads instead of the old, which should be much more reliable, and a bit more performant.

Misc Updates

  • The search feature now has an option to filter out nsfw channels
  • Webhooks can now edit their own messages
  • Webhooks can now delete their own messages
  • Switched to a custom erlpack implementation
  • Supressing embeds is now supported
  • New translation system
  • The API hands the client icons for the client to display for connections

Changes

Shorter Invite URLs

Invite links will use shorthand for the instance URL, when possible, making the invites easier to send to your friends!

Misc Changes

  • Removed sections of the codebase written in C#. This makes the codebase much more maintainable. We’re noting it’s effect on Spacebar and don’t wish to follow suite. It’s breaking changes, and does not actually fix any of the core issues.
  • Internal names now read “Harmony” instead of “Spacebar”
  • Miscellaneous repo changes
  • Majorly reduce the number of DB calls by batching using IN
  • The start of internal testing within the Harmony repo
  • Better S3 bucket support
  • Move away from depricated types and don’t run eslint on dead code
  • Remove require in favor of import in many places, to modernize the codebase
  • Uploading files now checks for permissions using route
  • Marking a message as read now checks for permissions using route
  • Upgraded to typeormv1
  • Embed handles are done in a much more sain way now
  • Removed Twitter
  • Rid of some assets
  • Report the max length of the pronoun field
  • Deleted IDE config files
  • Remove murmur in favor of just doing a sha256 hash instead
  • Change guild defaults
  • Replace the .env reader
  • Massivly simplify CDN
  • Update welcome page to be Harmony instead of Spacebar
  • Tweaks in attempt to speed up the instance
  • Fix the gateway type checker

Bug Fixes

Discord Connection

The Discord connection now works within the codebase!

Webhooks

The API now outputs the webhooks URL more consistently, meaning that they’re easier to use and harder to get the incorrect URL from. Also fixed a bug where a webhooks “token” could start with ‘-‘ and make the server not reconize the webhook at all for some reason. Setting the webhook avatar no longer breaks it.

Notification Settings

We went ahead and fixed notification settings in Harmony. You should now be able to set persistently what you want to be notified for.

Better Permission Checking

Permission checking is now fixed to be more well aligned and to not rely on hidden information that the general user did not have access to.

Misc Fixes

  • DOB no longer contains a typo
  • Invites to autoregister guilds no longer error on the API
  • Application page properly handles banners
  • Application names are now run through the name checker
  • Application commands are checked more throughly and consistently
  • Application commands are saved with guild_id being correctly set
  • Enforce more limits
  • Don’t error on non-removal from guild
  • Marked many endpoints as stubs
  • Strip nulls from allowed_mentions in the send messages endpoint
  • PRESENCE_UPDATE no longer sends for your own user
  • Message timestamps are now more accurate
  • sticker_items no longer send an empty array for no stickers
  • The discovery total is now more accurate
  • Webhooks now have functional URL embeds
  • Community settings are now functional
  • Erlpack can no longer segfault the gateway
  • File size limits are now respected on more endpoints
  • Messages can only have one thread
  • Simplified message logic to convert to a users messages objects to be more reliably correct
  • Searched messages now include the messages they reply to
  • You can no longer set channel permissions on threads
  • You can not add people who you’re not friends with to a group
  • More consistently converting objects to their API versions
  • Remove translation files that aren’t English but contained only English text
  • Deleted some of the NPM patches
  • ipData.asn is no longer an assumed property, which should prevent some sign up issues
  • Member creation time is now in the correct time format
  • Setting per user channel settings now works again as expected
  • Sending a message no longer returns private user information
  • No longer gets all badges in the database, instead only fetches the badges the member has
  • Schema files are no longer a part of the git tree
  • File identification happens more consistently
  • Usernames are now checked on register
  • Double register bug is now fixed
  • Pins are now not malformed
  • Forked all of the Spacebar deps to allow us to maintain them instead and swapped the codebase over to them
  • Attchment uploading works better now
    • Cloud uploads with duplicate names no longer break
    • Size limits are more correctly
  • Pronouns field has a character limit now, defaulting to 50
  • Various WebRTC fixes
  • The Pion WebRTC npm package now bundles the SFU for Linux systems
  • The password reset system is much less buggy
  • Message search returns the correct infromation now
  • Connections now use PKs to edit causing some APIs to not 500
  • Mentioning someone you pinged no longer errors

Security Updates

Many security issues were fixed in this version, enough to warrent their own section

  • Users can no longer generate “bot” tokens for any user without any permission checks
  • Applications are only able to update their own commands
  • 2FA code is no longer backwards, requiring your 2FA method on required endpoints
  • Webauth now verifies that the passkey belongs to the user
  • You can’t greet to messages in other channels
  • You can’t set a channel’s parent to be one from another guild
  • You can no longer delete other people’s messages without the proper permissions
  • Reactions now fetch the correct member
  • Threads in DMs now don’t fetch the incorrect member
  • Reactions now check permisions properly
  • You can’t pin messages from across channels
  • Channel search now uses the correct channel for checking permissions
  • You can’t use tags from other channels
  • preload-messages now checks that you have permisions to read the channels
  • You can’t modify automod rules from other guilds
  • You can’t delete automod rules from other guilds
  • Reordering channels now checks that the channels belong to the guild
  • Interactions now check for author id, meaning:
    • you can no longer edit other people’s messages
    • you can no longer send messages in channels you don’t have permision to do so
  • Fetching the current application now sends the correct application instead of the first application
  • Webhooks now check tokens for authorization
  • Attachments now have to be checked correctly
  • You can’t set a guilds system channel to a channel from another guild
  • You can’t bulk delete messages from outside the channel you’re bulk deleting from
  • You can no longer add people to group DMs you’re not a part of
  • Webhooks can’t be assigned to channels not part of the guild they’re in
  • Proxies make fetching external reasources more secure
  • Webhook tokens are no longer leaked on messages
    • this means bad actors can’t take over your webhooks
  • People not in a guild can no longer fetch the channels from the guild
  • 2FA creation now works correctly
  • Private member information is no longer leaked on several endpoints
  • Voice state no longer looks up a random member
  • WS was updated for security fixes
  • get guild widget settings now checks if you are able to manage it before returning the object
  • You can no longer get the welcome screen for guilds you are not in
  • Users can no longer see guild templates of a guild if they don’t have the correct permissions
  • Users can no longer see the voice regions for guilds they are not in
  • GET prune now requires KICK_MEMBERS and MANAGE_GUILD, and the post endpoint now also requires MANAGE_GUILD as required by the spec - This prevents people who are not even in the guild from knowing how many people would be pruned from a guild if a prune were ran, and preventing people with just KICK_MEMBERS from pruning members
  • Discovery requirements is now correctly permission checked
  • The audit log stub now checks if you are in the guild and have permission to view it
  • You can no longer view the application command index without being in the guild
  • You can’t search for threads in channels you’re not a part of
  • You can’t delete your message read states from channels you can’t view
  • You can now only manage reactions if you have ADD_REACTIONS
  • You can now only delete messages you have permission to view
  • Members can’t be fetched without being in the guild
  • You can’t get messgaes for channels you’re not a part of anymore
  • The gateway now calculates permissions correctly
  • The voice server no longer requires unneeded IPC and Database permissions, making it more secure
  • The mentions endpoint no longer leaks information from private channels
  • Password reset tokens are no longer the same thing as an API token

Harmony

Discord

Codeberg

Donate