Seems abusable though

If one instance doesn’t trust another, they shouldn’t federate in the first place.

Seems abusable though

Exactly

Add metadata with a checksum of the og one with signature and let each client check that up.

GNUnet provides privacy-by design

Money doesn’t want us to have privacy.

I liked writing efficient code but every place I worked didn’t care at all about it. All they wanted was a finished feature and a kanban note moved to finished.

The great thing about this if you run a server, as soon as a user posts a link to some kiddy porn, you not only download it automatically, you distribute it as well. Go-go-gadget-jailtime.

(Actually already a problem with Mastodon federation of image posts, and why I would strongly encourage against anyone in a strict liability jurisdiction from running their own Mastodon server tbh.)

Seems like a no-brainer! They could even leave the old behavior as an option for instance admins to re-enable, but if they default it to not DDoSing, that would make a huge difference.

It was my first thought too but there are downsides to it. Trust is a small one given the nature of the system but compute and bandwidth costs could be an issue also, especially for larger instances.

The first solution is more fragile but could be CDN’d and those are cheap.

how would you know the results havent been tampered with?

Tl;dr: Lemmy and Mbin attach an image, Piefed seems not to. Though some Lemmy instances seem to only proxy the image, not host anything themselves.

I just took this random post from my frontpage: https://sh.itjust.works/post/68605733 and made a manual request for the federated JSON-LD.

{
  "@context": [
    "https://join-lemmy.org/context.json",
    "https://www.w3.org/ns/activitystreams"
  ],
  "type": "Page",
  "id": "https://sh.itjust.works/post/68605733",
  "attributedTo": "https://sh.itjust.works/u/derrickoswald",
  "to": [
    "https://lemmy.world/c/technology",
    "https://www.w3.org/ns/activitystreams#Public"
  ],
  "name": "Stratospheric airship flew from US to Japan and back",
  "cc": [],
  "content": "<p>It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.</p>\n",
  "mediaType": "text/html",
  "source": {
    "content": "It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.",
    "mediaType": "text/markdown"
  },
  "attachment": [
    {
      "href": "https://arstechnica.com/gadgets/2026/10/trans-pacific-journey-tested-stratospheric-cell-tower-concept-in-japan/",
      "mediaType": "text/html; charset=utf-8",
      "type": "Link"
    }
  ],
  "image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  },
  "sensitive": false,
  "published": "2026-10-19T20:16:37.383385Z",
  "language": {
    "identifier": "en",
    "name": "English"
  },
  "audience": "https://lemmy.world/c/technology",
  "tag": [
    {
      "href": "https://sh.itjust.works/post/68605733",
      "name": "#technology",
      "type": "Hashtag"
    }
  ]
}

Notice the

"image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  }

Yes the image itself isn’t sent over (iirc they never are?), but it’s stored on sh.itjust.works. Other instances grab it from there, not the website the post links to.

I did notice just now though that some Lemmy instances seem to just proxy the image through their servers, which I assume is to avoid CORS. But that’s an instance choice, not a general fediverse issue.

Mbin does the same as Lemmy, but it also includes the image in the attachment property. Probably for compatibility with some other platform.

One thing I didn’t notice before was that you’re using Piefed. That’s the one software I didn’t check before writing my previous comment. It does seem like Piefed is the outlier here. I tried a post from piefed.ca and the image is nowhere to be seen. The image property is not present, it’s not in the attachment array, and I can’t see any other property that contains it.

Are you sure? In your post you’re talking about fetching an image for a link preview, not an image post.

Usually, when I see an image post, the source is actually the pictrs of the source instance, so in that case I think it is federated.

the image should be federated

It’s an access control method, called “authorized fetch”. Rather than broadcasting the data you just announce the source of it, and then any client that wants to show it needs to negotiate with the originating server to request the data (And then blocklists and such come into play)

Say you’ve got 3 users, A, B, and C. A has blocked C, B follows A, and C follows B. Now A makes a post, B sees it in their feed and reboosts it, what does C see?

If B’s server sends the full response along, then C can see the contents of A’s post even though they’ve been blocked by A. But if all it sends is the URL of the post, C’s server needs to make a request for it (providing authentication), and then A’s server can reject it, so C sees nothing.

https://en.wikipedia.org/wiki/Slashdot_effect but people were going in, looking at the link, sometimes overwhelming the server

They can’t afford a $5 CDN?

the people have spoken

Random back off is an ancient and very well understood algorithm. This is not exactly rocket science.

If they’re all delayed the same it would have the same effect. In order to prevent that it would require some form of coordination amongst them.

A delay randomized within a certain range could accomplish this without needing coordination.

Random numbers exist.