Embed Notice

@boyter the answer to this is so simple. Interacting with any end-point needs to have an HTTP Signature corresponding to a valid ActivityPub actor. This actor should be a Service for instances of fediverse servers, an Application for non client applications, a Person for client applications like Toot! or Tusky.

This way there's a simple indicator where the requests originated and what/who needs to be blocked if the traffic is un-wanted.