3 ms·
Yeah this is probably a needed feature. There are some good philosophical objections to post imports, but they’re overwhelmed by practical arguments for it. it’
by pbronez 4y ago
Yeah this is probably a needed feature. There are some good philosophical objections to post imports, but they’re overwhelmed by practical arguments for it. it’s a solvable problem.
- vidarh 4y agoAbsolutely agree. I think solutions will come, but they may well come as an extension or fork first until it's pointless for the core developers to resist. It's particularly idiotic because the Activities in the export are all signed, so an importing server just need to do a webfinger and profile lookup, and can then validate all of the posts. Of course you can still fake them, but if you show a "moved from <origin instance>" on them, that's really all you need to do - moves from, say, mastodon.social would be trustworthy, moves from some small instance would not. But even that can be fixed with tamper proof timestamps and signing the whole archive, and in any case you can validate this against the public API because it remains accessible on the origin server (at least for some time after the initial move, I don't know how long).