Comment

Comment on Authorized Fetch Circumvented by Alt-Right Developers

Kierunkowy74@kbin.social ⁨10⁩ ⁨months⁩ ago

Authorised Fetch existed long before Instagram Threads. When it is turned on, an instance will require any other server to sign their request to fetch any post. This prevents "leaking" of posts via ActivityPub to blocked instances.

This setting is turned off by default, because some software are incompatible with it (like /kbin, Pixelfed before June 2023, maybe Lemmy too), because it makes server load higher, and it may make some replies missing (at least on microblogging side).

source

Sort:hotnew top

solrize@lemmy.world ⁨10⁩ ⁨months⁩ ago

When it is turned on, an instance will require any other server to sign their request to fetch any post. This prevents “leaking” of posts via ActivityPub to blocked instances.

Oh I see. Yeah that sounds pretty hopeless. Does it use the fetching site’s domain validated TLS certificate? Is the idea to permit fetching unless the fetching domain is on a blacklist? If yes, someone didn’t have their thinking cap on. The whole concept is dumb though, there is no way to prevent posts from leaking. The saying is that once 3 people know a secret, it is no longer secret.

source