@revoluciana @MzAprilDaniels @Eilistraee @lulu

I have opinions on this. In order to present this, I would like to explain my view and summarize the events:
An issue is found: A user can follow another User on other Instances immediately without approval even tho the other User has approval enabled, if there is already someone following on the local instance.
At this very moment that issue is already fixed & published.
So to say, your Statement "Pixelfed is leaking our data, and, it seems, the data of any other instance it federates with on Mastodon." is at this very moment simply wrong as i understand.

Beside that, i of course agree with your critics "It's clear that this leak is not a priority for Dansup, the sole maintainer of Pixelfed." and thats something that could be handled way better.

Beside of that, i would like to remind everyone, that you simply dont know what code other instances are running on. There were already malicious instances running in the past, there will be in the future. Everyone in fedi have to assume that other instances works as expected, so tho say: If someone want to be sure that nothing gets in the wrong hand, i strongly recommend to consider the content of every post before posting it, since there is no ultimate security here.

Which comes now your Statement "... it's a danger for any instance to expect privacy and have it neglected and disrespected to this degree. ".
Security problems happens, sadly, all the time and everywhere. I agree that the communication was a disrespect to some point. Altho, to my knowledge, The issues have been fixed.

"However, there are serious concerns about the fact that Pixelfed is run by someone who is hostile and neglectful to the Mastodon community and has a history of not taking security concerns seriously."
I agree with neglectful but can you explain to me how in the world this can be interpreted as hostile and where is there a history of "not taking security concerns seriously"? I mean, it got fixed, it got published, that would have happen without any further communication. Yes sure, one could have not publish the commit that early, one could have declare the issue as critical in the release note.

"And moreover, Pixelfed doesn't even have federated blocking implemented, so the only thing that can be done is to defederate, and even then, this only affects *new* posts. "
I dont know anything about this, and yes if it happens like that, i would count this as the bigger issue than whatever happened now.

But with all the information I currently have, like your post and the link to that blog post, and also the statistics on how many pixelfed instances are already on 0.12.5 by all the respect, i would count blocking ~150,000 monthly active users for miscommunication of the pixelfed dev as the more hostile and neglectful move.