Pixelfed leaks private posts from other Fediverse instances - fiona fokus
fokus.cool
  • KickMeElmo@sopuli.xyz
    0·
    5 months ago

    This one seems weird to me. If the posts are private, why are they federated? If they’re intended to be federated, why indicate any expectation of privacy?

    • Zagorath@aussie.zone
      1·
      5 months ago

      It’s sent to all servers where there is at least one user who should be able to see it. And then that server is trusted to only actually show it to the users who are supposed to see it.

      In this case, Pixelfed is messing up by showing it to all users who tried to follow a hidden profile, as long as at least one Pixelfed user has been approved to view the profile.