Found this via Aurynn Shaw:
When following someone on a different server on the Fediverse, the remote server decides whether you are allowed to do so. This enables features like private accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. When a legitimate user from a Pixelfed instance follows you on your locked fediverse account, anyone on that Pixelfed instance can read your private posts. You don’t need to be a Pixelfed user to be affected.
Pixelfed admins should update to v1.12.5 ASAP, but upgrading can be a major hurdle.
Importantly, your Mastodon or GoToSocial instance isn’t handing your private posts to any random server, just because it asks. The problem only becomes apparent when you have at least one legit accepted follower from a Pixelfed server. Now that server is allowed to fetch all your private posts. And when it knows the posts, it has to decide who to show them. When you accept a follower, you not only place your trust to keep a secret on them, but also on their admin and the software they are running.
Edited to add the last block quote.
There’s easily over a thousand fediverse instances at this point, having to whitelist them all would be impractical.
Okay but this demonstrates why defaulting to federation is a bad idea, doesn’t it?
The issue is that if you don’t default to federation, it becomes essentially impossible for new instances to join the fediverse. A potential new instance would have to go around to every single existing instance and ask to be allowlisted, which is onerous for both the new instances and for the large server admins who would be getting tons of requests. It would also essentially kill small-scale selfhosting as a result.
The entire point of the fediverse is to federate. Not federating by default kills discoverability and the potential for discoverability among other things
It demonstrates that nothing on the fediverse is private, and bad hacks that pretend otherwise are a terrible idea.
Imo it demonstrates that for certain threat models the fediverse simply doesn’t have the 100% secure answers.
Defaulting to not federating is what the major email providers currently do, and is why email has now become a centralised service that you cannot practically self host.