This is a core issue with ActivityPub, one that I noticed myself when I started working with it. Unless a server is setup to keep a user’s private marked posts completely off the ActivityPub feed, they’re accessible within it to any script that ignores the opt-out request.
My personal example was setting up wordpress to interact with a Mastodon instance, and suddenly finding private conversations published from Mastodon to my wordpress site that weren’t visible to me at all on Mastodon.
Needless to say, that gave me pause about building anything with the protocol until I really understand the access control behind publishing, because even instance owners don’t seem to fully grasp it themselves.
inconel@lemmy.ca 5 days ago
I mean given the demographic of fedi, ignoring robots.txt or GDPR removal requests warrant negative reaction and many in the list fall in that classification.
Microw@lemm.ee 4 days ago
And others dont fall into that classification, additionally it has been shown that the list’s author does not bother to actually check what is true about “scraping” accusations and just includes whatever accusation gets raised