We've got to come up with something better than attaching screenshots of web pages to social media posts. Even with alt text, it's lossy compared to the original hypertext.
@tael@matt Heck no! If a link dies I can check archive.org. If an imbed dies I can’t. And if the website I imbedded from becomes malicious, Now all my readers were exposed to it. My personal rule is that my blog should never ask the browser to load a resource I don’t directly control.
@fastfinge@matt Then you are not solving the problem discussed in the OP; having to click a link and load a page is not the same as attaching a screenshot. An embed is hypertext and can be cached (see: Discord embeds, where I have rescued many posts and images after they were deleted) and archived. Attaching a screenshot is just a lossy way of embedding the web page.
@tael@matt Yes, but readers should click through to read someone else’s content. Copying it on to your own website is just theft, and autoloading it is a security incident waiting to happen, and a privacy violation. There’s a reason email clients don’t display images by default anymore.
@fastfinge@matt No. "Embedding a link" usually means loading a preview of the embedded page as a card based on the OpenGraph meta tags. I'm not sure how Mastodon does post embeds but OpenGraph was made for allowing posts to display without needing to be screenshot. These links should get embedded when you load the post for example: myog.social/articles/og-meta-tags-guide ogp.me
@fastfinge@matt (But Mastodon counts embedded posts as quotes.) As you can see, alt text is lost in the Discord embed, which isn't great, but preserved in the Mastodon embed. This is better than a screenshot of tillian's post, which would never have any alt text, and a plain link, which would require me to click through to look at the post.
@tael@matt Clicking through is a far better solution. Browsers shouldn’t even agree to load resources from anything other than your current domain without you having to click.
@fastfinge@matt Clicking through is not a solution to screenshots of web pages, the expectation is that the content is displayed on the page
I think you have some outmoded beliefs about browser security but I respect them. I assume you have noscript set up to block JavaScript from any cross-site resources as well?
@fastfinge@matt Then I imagine a lot of websites just straight-up don't work for you. More power to you but I wouldn't expect more than a small group of people to willingly use the web that way.
@tael@matt As long as you allow loading from subdomains everything you actually want works fine. Ie example.com should also allow cdn.example.com etc. and it means you no longer need an adblocker.
