@thenexusofprivacy it's additional work to implement an allow-list for federation, although not much more than instituting a deny-list. What's easier is accepting content from everywhere, but I can definitely see how indiscriminately accepting content from just anywhere is a recipe for potential abuse.
I'd like NodeBB to support both, although it might not be available during alpha phase.
