so I've started seeing Mastodon apps fetch posts in threads from other servers directly, bypassing server blocks.
This is ... this is deeply concerning to me.
so I've started seeing Mastodon apps fetch posts in threads from other servers directly, bypassing server blocks.
This is ... this is deeply concerning to me.
@aurynn given how much Mastodon thread context fetch fails at actually providing context, i'm not surprised that client devs are doing this. hell, i've considered implementing it too. but this should be the server's job: so posts only have to be fetched once and so the client doesn't have to talk to foreign servers directly ☹️
another reason to turn on AUTHORIZED_FETCH and DISALLOW_UNAUTHENTICATED_API_ACCESS
…and then field ninety questions a day from users who don't understand why they can't see posts in their browser. if the Mastodon web GUIs were smarter about running clicked links through the search/resolve API, this would be a lot less of an issue.