Replying to @null and @wjmaggos, @tangled_zans, @_julesh_
That's part of my concern with Mastodon/ActivityPub: they support decentralised operation but they don't enforce it. That means they're not capture-resistant and susceptible to various attacks based eg. on bundling, defaults, or entry convenience. Same as email is 85% Google.