Seems abusable though

If one instance doesn’t trust another, they shouldn’t federate in the first place.

Seems abusable though

Exactly

Add metadata with a checksum of the og one with signature and let each client check that up.

GNUnet provides privacy-by design

Money doesn’t want us to have privacy.

Tl;dr: Lemmy and Mbin attach an image, Piefed seems not to. Though some Lemmy instances seem to only proxy the image, not host anything themselves.

I just took this random post from my frontpage: https://sh.itjust.works/post/68605733
and made a manual request for the federated JSON-LD.

{
"@context": [
"https://join-lemmy.org/context.json",
"https://www.w3.org/ns/activitystreams"
],
"type": "Page",
"id": "https://sh.itjust.works/post/68605733",
"attributedTo": "https://sh.itjust.works/u/derrickoswald",
"to": [
"https://lemmy.world/c/technology",
"https://www.w3.org/ns/activitystreams#Public"
],
"name": "Stratospheric airship flew from US to Japan and back",
"cc": [],
"content": "<p>It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.</p>\n",
"mediaType": "text/html",
"source": {
"content": "It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.",
"mediaType": "text/markdown"
},
"attachment": [
{
"href": "https://arstechnica.com/gadgets/2026/10/trans-pacific-journey-tested-stratospheric-cell-tower-concept-in-japan/",
"mediaType": "text/html; charset=utf-8",
"type": "Link"
}
],
"image": {
"type": "Image",
"url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
},
"sensitive": false,
"published": "2026-10-19T20:16:37.383385Z",
"language": {
"identifier": "en",
"name": "English"
},
"audience": "https://lemmy.world/c/technology",
"tag": [
{
"href": "https://sh.itjust.works/post/68605733",
"name": "#technology",
"type": "Hashtag"
}
]
}

Notice the

"image": {
"type": "Image",
"url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
}

Yes the image itself isn't sent over (iirc they never are?), but it's stored on sh.itjust.works. Other instances grab it from there, not the website the post links to.

I did notice just now though that some Lemmy instances seem to just proxy the image through their servers, which I assume is to avoid CORS. But that's an instance choice, not a general fediverse issue.

Mbin does the same as Lemmy, but it also includes the image in the attachment property. Probably for compatibility with some other platform.

One thing I didn't notice before was that you're using Piefed. That's the one software I didn't check before writing my previous comment. It does seem like Piefed is the outlier here. I tried a post from piefed.ca and the image is nowhere to be seen. The image property is not present, it's not in the attachment array, and I can't see any other property that contains it.

Are you sure? In your post you’re talking about fetching an image for a link preview, not an image post.

Usually, when I see an image post, the source is actually the pictrs of the source instance, so in that case I think it is federated.

the image should be federated

I liked writing efficient code but every place I worked didn’t care at all about it. All they wanted was a finished feature and a kanban note moved to finished.

https://en.wikipedia.org/wiki/Slashdot_effect but people were going in, looking at the link, sometimes overwhelming the server

You’re talking about 2 different kinds of blocking here. NPR can’t block a URL, that concept doesn’t really exist at this level. They could block ip addresses, or user agents as you mentioned.

A workplace can’t block by user agent (at least not on any website using TLS), as this header is not readable by any intermediary devices.

If they’re all delayed the same it would have the same effect. In order to prevent that it would require some form of coordination amongst them.

A delay randomized within a certain range could accomplish this without needing coordination.

Random numbers exist.

Random back off is an ancient and very well understood algorithm. This is not exactly rocket science.

The great thing about this if you run a server, as soon as a user posts a link to some kiddy porn, you not only download it automatically, you distribute it as well. Go-go-gadget-jailtime.

(Actually already a problem with Mastodon federation of image posts, and why I would strongly encourage against anyone in a strict liability jurisdiction from running their own Mastodon server tbh.)

Seems like a no-brainer! They could even leave the old behavior as an option for instance admins to re-enable, but if they default it to not DDoSing, that would make a huge difference.

It was my first thought too but there are downsides to it. Trust is a small one given the nature of the system but compute and bandwidth costs could be an issue also, especially for larger instances.

The first solution is more fragile but could be CDN’d and those are cheap.

how would you know the results havent been tampered with?

They can’t afford a $5 CDN?

the people have spoken