• @arotrios
    link
    English
    33 days ago

    This is a core issue with ActivityPub, one that I noticed myself when I started working with it. Unless a server is setup to keep a user’s private marked posts completely off the ActivityPub feed, they’re accessible within it to any script that ignores the opt-out request.

    My personal example was setting up wordpress to interact with a Mastodon instance, and suddenly finding private conversations published from Mastodon to my wordpress site that weren’t visible to me at all on Mastodon.

    Needless to say, that gave me pause about building anything with the protocol until I really understand the access control behind publishing, because even instance owners don’t seem to fully grasp it themselves.