Julian Fietkau@julian@fietkau.social: @silverpill What is the rationale for “Clients MUST NOT embed non-anonymous collections in objects”?<br><br>I see the potential for cache poisoning etc. if we inline collections owned by someone else, but what's the harm in inlining my own collections?

Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

silverpill@silverpill@socialhub.activitypub.rocks (2026-04-04 06:35:33)
This is a discussion thread for  FEP-9f9f: Collections.

The proposal describes the current best practices for implementing and using ActivityPub collections.
---Reply---
Julian Fietkau@julian@fietkau.social (2026-04-04 07:14:30)
@silverpill What is the rationale for “Clients MUST NOT embed non-anonymous collections in objects”?

I see the potential for cache poisoning etc. if we inline collections owned by someone else, but what's the harm in inlining my own collections?


---Replies---

silverpill@silverpill@mitra.social (2026-04-04 19:01:56)
@julian This seems to be in conflict with property-based collection creation. It is not clear how a server should process an inlined collection (create an empty collection? create a collection with specified items? remove the property?). If I remember correctly, this is not supported in GoActivityPub

cc @mariusor