Can someone that's familiar with the details of FEP-044f (the one underlying Mastodon's quote posts) tell me if there's something I missed and there *IS* a way to ensure that malicious instances (or clients) aren't able to disregard the whole thing and just allow and present quoted posts without their original user's consent?
11
Replies
1
Boost
This was about me doing some back of the napkin reasoning for this post:
https:// marius.federated.id/posts/2026/september/1
Link broken because mastodon returns 500 when trying to load the ActivityPub object behind it... I'm sure they have a grudge against me. 
https://marius.federated.id/posts/2026/september/1 had no issues in my mastodon instance, but mastodon appreciates me so
@tom I see you're running a fork based on the alpha 4.7.0 version. Maybe it has some improvements that the upstream doesn't have. 😞 I've contacted my admin, perhaps it can offer me some clue about what's wrong.
Hopefully it's a problem on my side and I can fix it.
@mariusor forgive me if I'm dumb (or don't), but isn't that true of a lot of AP? Like, the method for ensuring that servers don't disregard my DELETEs is defederating malicious servers that would do that.
My biggest complaint with the current design is it doesn't default to being a URL when a QP hasn't been approved.
@tom yes indeed. This is a limitation of the ActivityPub protocol itself.
What I was trying to elucidate is if Mastodon created some custom API that's cleverer than it's immediately visible. :)
@mariusor@metalhead.club @tom@tomkahe.com
Isn't this always the case, communicating with an other system, that you don't control yourself?
As long as your plan isn't to forbid hyperlinks on the web, the idea of regulating "quote posts" is in itself nonsense. "Quote posts" are a UI feature. Technically, it is like copy&pasting the link to another post.
@nik *I* don't plan anything, I'm trying to make sure I'm not going to post slander about quote posts. *I* fully agree with your position.
I guess it's actually clarified in the Mastodon quote posts documentation that they can't enforce it for other implementations:
All of this makes me wonder why such an unwieldy mechanism has been concocted in the first place if it's just as much of a security theater as not having in the first place. 
@mariusor (without knowing the details in this case, but with a background in creating systems). As with many cases of "read-control" aka DRM (digital rights management) you end up in creating a trust anchor; here: That the implemenation deals with the input in the defined way.
@mariusor I mean it works if you have implementations respecting it, and you can always defederate if you disagree with server policies.
I agree that the mechanism is unwieldy though and takes a lot of code to implement
