Re:Pixelfed leaks private posts from other Fediverse instances
by Doxin on Monday March 31, 2025 @02:47AM
(#43531929)
@[email protected] follows @[email protected]. pixelfed.social now receives all posts Alice makes which Bob can see. It has to, because it has to show these posts to Bob.
@[email protected] does not follow Alice. pixelfed.social has a bug where it's not correctly filtering out Alice's posts when Mallory visits her profile.
The root cause is pixelfed.social thinks Mallory is following Alice but mastodon.social thinks Mallory does not follow Alice. This is due to pixelfed.social accepting follow requests slightly too early in the handshake between pixelfed.social and mastodon.social.
@[email protected] does not follow Alice. pixelfed.social has a bug where it's not correctly filtering out Alice's posts when Mallory visits her profile.
The root cause is pixelfed.social thinks Mallory is following Alice but mastodon.social thinks Mallory does not follow Alice. This is due to pixelfed.social accepting follow requests slightly too early in the handshake between pixelfed.social and mastodon.social.