@stefan now that I think about it, with instances coming and going, this is a security issue. I can go buy a domain of a defunct instance and XSS all sites that ever embedded a post.