Or the Digg Effect

It is, but that’s what defederation is for: If there are instances that are being sketchy, they are supposed to get cut off from the rest of the Fediverse.

Seems abusable though

If one instance doesn’t trust another, they shouldn’t federate in the first place.

Seems abusable though

Exactly

Add metadata with a checksum of the og one with signature and let each client check that up.

GNUnet provides privacy-by design

Money doesn’t want us to have privacy.

I liked writing efficient code but every place I worked didn’t care at all about it. All they wanted was a finished feature and a kanban note moved to finished.

Is that really why they’re blocking it I wonder…

It was my first thought too but there are downsides to it. Trust is a small one given the nature of the system but compute and bandwidth costs could be an issue also, especially for larger instances.

The first solution is more fragile but could be CDN’d and those are cheap.

how would you know the results havent been tampered with?

Seems like a no-brainer! They could even leave the old behavior as an option for instance admins to re-enable, but if they default it to not DDoSing, that would make a huge difference.

The great thing about this if you run a server, as soon as a user posts a link to some kiddy porn, you not only download it automatically, you distribute it as well. Go-go-gadget-jailtime.

(Actually already a problem with Mastodon federation of image posts, and why I would strongly encourage against anyone in a strict liability jurisdiction from running their own Mastodon server tbh.)

I’ve just had a look at the code to refresh my memory - it does use it :)

is this a bad thing though. like if im the poster I don’t necessarily want the content to change compared to what I saw and was excited about so came to tell people about.

I’m not sure but my guess it’s an attempt to deal with the problem where sometimes federation activities arrive in the wrong order (especially after an instance has been offline for a while) - by making a GET to the origin server you can be sure you’ve got the latest version of the content. There are probably better ways to achieve that, though.

PieFed prioritises efficiency over correctness so it just accepts whatever is sent to it. In 3 years no one has complained about seeing stale content although I’m sure it happens occasionally.

It’s an access control method, called “authorized fetch”. Rather than broadcasting the data you just announce the source of it, and then any client that wants to show it needs to negotiate with the originating server to request the data (And then blocklists and such come into play)

Say you’ve got 3 users, A, B, and C. A has blocked C, B follows A, and C follows B. Now A makes a post, B sees it in their feed and reboosts it, what does C see?

If B’s server sends the full response along, then C can see the contents of A’s post even though they’ve been blocked by A. But if all it sends is the URL of the post, C’s server needs to make a request for it (providing authentication), and then A’s server can reject it, so C sees nothing.

I just took this random post from my frontpage: https://sh.itjust.works/post/68605733 and made a manual request for the federated JSON-LD.

{
  "@context": [
    "https://join-lemmy.org/context.json",
    "https://www.w3.org/ns/activitystreams"
  ],
  "type": "Page",
  "id": "https://sh.itjust.works/post/68605733",
  "attributedTo": "https://sh.itjust.works/u/derrickoswald",
  "to": [
    "https://lemmy.world/c/technology",
    "https://www.w3.org/ns/activitystreams#Public"
  ],
  "name": "Stratospheric airship flew from US to Japan and back",
  "cc": [],
  "content": "<p>It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.</p>\n",
  "mediaType": "text/html",
  "source": {
    "content": "It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.",
    "mediaType": "text/markdown"
  },
  "attachment": [
    {
      "href": "https://arstechnica.com/gadgets/2026/10/trans-pacific-journey-tested-stratospheric-cell-tower-concept-in-japan/",
      "mediaType": "text/html; charset=utf-8",
      "type": "Link"
    }
  ],
  "image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  },
  "sensitive": false,
  "published": "2026-10-19T20:16:37.383385Z",
  "language": {
    "identifier": "en",
    "name": "English"
  },
  "audience": "https://lemmy.world/c/technology",
  "tag": [
    {
      "href": "https://sh.itjust.works/post/68605733",
      "name": "#technology",
      "type": "Hashtag"
    }
  ]
}

Notice the

"image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  }

Yes the image itself isn’t sent over (iirc they never are?), but it’s stored on sh.itjust.works. Other instances grab it from there, not the website the post links to.

I did notice just now though that some Lemmy instances seem to just proxy the image through their servers, which I assume is to avoid CORS. But that’s an instance choice, not a general fediverse issue.

Mbin does the same as Lemmy, but it also includes the image in the attachment property. Probably for compatibility with some other platform.

One thing I didn’t notice before was that you’re using Piefed. That’s the one software I didn’t check before writing my previous comment. It does seem like Piefed is the outlier here. I tried a post from piefed.ca and the image is nowhere to be seen. The image property is not present, it’s not in the attachment array, and I can’t see any other property that contains it.

Edit: A piefed.social post I just tried did have an image, so I assume I’m just blind.

Are you sure? In your post you’re talking about fetching an image for a link preview, not an image post.

Usually, when I see an image post, the source is actually the pictrs of the source instance, so in that case I think it is federated.

the image should be federated

They can’t afford a $5 CDN?

the people have spoken