@skye@void.rehab oh, hi, Nicole, i'm `user`

[skye@void.rehab]

@havu look. i cba to host my own instance and figure out how to make a patch that can serve every user their own handle just for the bit

[oli@mastodon.hermitcollective.net]

@skye @havu i don't think that's possible

[oli@mastodon.hermitcollective.net]

@skye @havu auth fetch doesn't provide information about the user that fetched it

[skye@void.rehab]

@oli @havu how do followers only posts even exist then /genq

[oli@mastodon.hermitcollective.net]

@skye @havu because it's fetched on the instance level?

[skye@void.rehab]

@oli @havu im not a super mega knowledgeable coder at nasa or whatever, please dont assume i know everything or have this questioning tone

also please elaborate

[oli@mastodon.hermitcollective.net]

@skye @havu the receiving user follows the remote user, the local instance fetches the remote user's post, and shows it to the local users that follow the remote user

[skye@void.rehab]

@oli @havu does this mean everybody is able to fetch other people's followers only posts without following if they wanted to but its just that the way each instance functions doesnt let you do it using UI

[oli@mastodon.hermitcollective.net]

@skye @havu if a user on the local instance is following a certain remote user, their posts will be fetched automatically. if the instance software implements post visibility properly then only that specific authenticated user can view the post

[skye@void.rehab]

@oli @havu ok so the remote instance does the check for it? that made sense to me but your last message made it sound exactly the opposite way idk im just stupid ty

[oli@mastodon.hermitcollective.net]

@skye @havu nono, the local instance does the check, and it happens when a user requests from the api

[skye@void.rehab]

@oli @havu i am confused

[oli@mastodon.hermitcollective.net]

@skye @havu elaborate

[havu@nbh.ax]

@oli @skye

> if the instance software implements post visibility properly then only that specific authenticated user can view the post

could you explain this part more thoroughly if you can? and is the recent pixelfed security issue related at all?

[also, sorry for turning unlisted posts into public before, i couldn't tell what the original visibility was and husky doesn't handle that properly]

[oli@mastodon.hermitcollective.net]

@havu @skye
when a user tries to view a post by someone they don't follow, the local instance should send a 403 Forbidden to their client

the pixelfed bug is because it doesn't/didn't handle outgoing follow requests properly

[skye@void.rehab]

@oli @havu so the remote instance does the check?

[oli@mastodon.hermitcollective.net]

@skye @havu edited

[skye@void.rehab]

@oli @havu oh so which instance is "local" in this case maybe i just swapped the two around in my head

[oli@mastodon.hermitcollective.net]

@skye @havu local (for you) is void.rehab