Post #3095533

@silverpill@mitra.social I don't think this makes sense: "Servers MUST NOT allow clients to publish activities where embedded objects are owned by another actor." We've never had this requirement; it's not built into ActivityPub; it's not how federation work. - Like - Announce - inReplyTo - Follow - Accept - Reject I think two way verification is a better mechanism than same-origin. So, check that the `object` of a `Create` has the same `attributedTo` as the `actor`.