@lamp @Nepiant

> The only files I'd upload to a social network are almost always media for other people to look at,

Every file on any website exists for other people to look at.

I have uploaded scripts, binaries, a really old build of TempleOS from when it was called LoseThos, PDFs, a shitload of PDFs, text files. I don't want the server to fuck with it, so I have stopped my server from fucking with it.

> it doesn't matter if the bytes are changed

If that is what you want to do, fine. Doesn't affect me if you don't want to do the things I want to do.

> what matters is not getting ur exact GPS location exposed.

This is illusory. You are giving the server that shit and the server can do what it wants: remove it before uploading it. Look at fucking Parler. Don't upload it if you don't want it to become public because a server with training wheels is not going to save you from your own bad decisions.

> That's much worse than rare glitch

"Rare glitch" has gotten people arrested. If you are paying me for my time, that's one thing, but I run FSE and I'm the one that has to deal with it if FSE gets owned and I'm going to run it this way.

> that lets ppl mess with the server full of useless public data,

There is data on any server that is not public: that is why a compromise is a problem. Look at what happened to chudbuds.lol and then imagine what would have happened if, instead of dumping Claire's dox, they just decided to leave something that captured credentials passively. Poast/Baest got hit by an auth token hijack and all the chat messages leaked.

People on other servers have whined about Pleroma sometimes not caring about email addresses: Gleason actually filed a bug to try to get Pleroma to remove the option. But if FSE actually required a real email address, then that would be more personal data that FSE has, making FSE a more valuable target.

> No I did not see I don't look at 4chan.

I haven't looked at 4chan itself in a very long time, but the exploit was PDF thumbnail generation. If you treat uploads as opaque blobs, this entire class of bug is impossible. So all the admins' email addresses, the code (including the hacks, the special-cased IP addresses, etc.) became public.