more people will know and exploit the vulnerability
It’s not even a vulnerability, it’s how AP works by design, is the issue at hand here. Mastodon decided they wanted to implement something not supported by AP, and everybody else had to take the heat for not ‘doing it right’.
To keep it secure from the servers themself would require users to handle the encryption. See PGP for an idea of how much uptake that’s likely to get. If you mean for the servers to handle the encryption, that’s already the case, and the issue right now is that servers are privy to what users do, and by nature are a 3rd party in the convo.
Defaulting to not federating is what the major email providers currently do, and is why email has now become a centralised service that you cannot practically self host.
Does modding work across PF - Lemmy?
We’re taking a free ride on the Finns. [email protected]
I’m not sure you can make that conclusion. This isn’t a real vulnerability, and this isn’t a surprise to anybody who knows how the AP protocol works. Dansup didn’t reveal anything that was previously unknown, the blog author just has an axe to grind. It’s unfair to assume that an actual 0 day vulnerability would have been treated the same way.