Embed Notice

> - Recipient: trust embedded object only if the wrapping object has the same owner.

@silverpill no, dereference object and use that instead. The canonical version of an object is the one retrieved from the originating service.

Mastodon has popularised this behaviour where embedding collections (like your replies) is done by servers in the name of "optimizing" for request counts. But this introduces issues and personally I think it's a "code smell" for ActivityPub. Embedding should be restricted to anonymous objects. When an ID exists it should be used most of the time.

@technical-discussion @julian @grishka