Can someone that's familiar with the details of FEP-044f (the one underlying Mastodon's quote posts) tell me if there's something I missed and there *IS* a way to ensure that malicious instances (or clients) aren't able to disregard the whole thing and just allow and present quoted posts without their original user's consent?
4
Replies
1
Boost
@mariusor forgive me if I'm dumb (or don't), but isn't that true of a lot of AP? Like, the method for ensuring that servers don't disregard my DELETEs is defederating malicious servers that would do that.
My biggest complaint with the current design is it doesn't default to being a URL when a QP hasn't been approved.
I guess it's actually clarified in the Mastodon quote posts documentation that they can't enforce it for other implementations:
All of this makes me wonder why such an unwieldy mechanism has been concocted in the first place if it's just as much of a security theater as not having in the first place. 
@mariusor (without knowing the details in this case, but with a background in creating systems). As with many cases of "read-control" aka DRM (digital rights management) you end up in creating a trust anchor; here: That the implemenation deals with the input in the defined way.
@mariusor I mean it works if you have implementations respecting it, and you can always defederate if you disagree with server policies.
I agree that the mechanism is unwieldy though and takes a lot of code to implement
