hrefna, 3 months ago

It's worthwhile to expand on a point to @devnull that I made: "preventing the sending server from seeing the IP" is a mostly* BS justification for local caching of media.

Broadly speaking:

1. Inconsistency around security policies is a recipe for dramatic, consequential failures.

2. Users are not notified if this is a feature, and clients and servers can both override it.

3. You probably* don't want it anyways.

• I'll get into the caveats on these at the end.

1/

#security #fediverse #s3