Embed Notice

@silverpill do you mean that the "malicious" attachment is not a facsimile of an actual note produced by that actor, but a forgery?

In these cases, I'll agree with
@grishka that some validation based on the ID should be necessary.

For embedded object attachments on the other hand (like mastodon produces), probably the validation needs to check that attributedTo corresponds to the one of the parent object or missing.

Interesting corner case.

@technical-discussion