@evan @daniel @evanprodromou unrelatedly, #nodebb sanitizes post content too, and I did think it was a little weird that #ActivityPub sends HTML back and forth.
It all boils down to never trusting user input (that includes input from servers acting as intermediaries!)
I would rather see #markdown passed around, but that's just me 😊