@alyx @schnouki Even if i love minimal websites, an url can legimately require "lot" of resources on a server and possibly can't be cached. And yes, 20k requests in a few second is technically a ddos.

I never understood why mastodon choosed to delegate card creation to the receiving instances and not the sending instance.
Why wouldn't you trust the card but still trust the toot itself ?
just let the sending instance generate the card and use it and problem's gone.