@kura @hj

Some observations:

When my client (Firefox) asks my server (Pleroma) for the post, the JSON I receive contains things like " in the "description" string:

https://fedi.feministwiki.org/api/v1/statuses/AsRQBdtUVWvsKoMlcW

This seems wrong; the string is just a JSON string, and the client is responsible for rendering it as part of some UI that may or may not involve any HTML.

(Even if it involves HTML, the client should be using APIs to generate a valid HTML Element, for which it doesn't need to use escapes, since no parsing of HTML will be involved.)

In contrast, when I visit the hai.z0ne.social link, I see Firefox sending a POST to:

https://hai.z0ne.social/api/notes/children

With the request body:

Which yields a response including some "comment" and "text" JSON string fields that contain the alt text / title for the video, and those do NOT contain things like ".

This doesn't prove that it's Pleroma's fault: It could be the case that Misskey stores " etc. in the database, and strips those again before responding to its client, but this seems doubtful.

I don't know enough about ActivityPub to be able to ask the hai.z0ne.social server for the post through the actual AP protocol; that would definitively reveal the culprit, I think.