Can someone that's familiar with the details of FEP-044f (the one underlying Mastodon's quote posts) tell me if there's something I missed and there *IS* a way to ensure that malicious instances (or clients) aren't able to disregard the whole thing and just allow and present quoted posts without their original user's consent?
3
Replies
1
Boost
I guess it's actually clarified in the Mastodon quote posts documentation that they can't enforce it for other implementations:
All of this makes me wonder why such an unwieldy mechanism has been concocted in the first place if it's just as much of a security theater as not having in the first place. 
@mariusor (without knowing the details in this case, but with a background in creating systems). As with many cases of "read-control" aka DRM (digital rights management) you end up in creating a trust anchor; here: That the implemenation deals with the input in the defined way.
@mariusor I mean it works if you have implementations respecting it, and you can always defederate if you disagree with server policies.
I agree that the mechanism is unwieldy though and takes a lot of code to implement
