Gregory's Server
FEP-171b update: https://codeberg.org/fediverse/fep/pulls/454
Some clarifications, and an explanation of why FEP-fe34 authentication is important:
>The processing of unauthenticated embedded activities is strongly discouraged. If such activities are not rejected by the consumer, a malicious conversation owner may be able to perform a cache poisoning attack and overwrite any actor or a post in consumer's local cache by sending a forged Update(Actor) or Update(Object) wrapped in an Add activity.
This is not difficult to do. Someone makes a post and says "hey everyone, join my new @group about <popular_topic>". People join and the next day Gargron is messaging them and asking to fund Mastodon's new Trust & Safety initiative by donating bitcoins.
Similar attacks might be possible against FEP-1b12 implementations that don't authenticate announced activities.