Get the latest tech news
Pixelfed leaks private posts from other Fediverse instances
When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts.
Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. With commit messages like “Update ActivityPub helpers, improve private account handling” it is a dead giveaway when one knows what they’re looking for. A similar situation unfolded a few months ago, when a bug left hundreds of instances vulnerable which apparently resulted in stolen S3 API keys.
Or read this on Hacker News
