@ghost_bird @dragon I think authorized fetch prevents (some of) that though (given the fedi software involved 'plays fair')