@tael@matt Heck no! If a link dies I can check archive.org. If an imbed dies I can’t. And if the website I imbedded from becomes malicious, Now all my readers were exposed to it. My personal rule is that my blog should never ask the browser to load a resource I don’t directly control.
@fastfinge@matt Then you are not solving the problem discussed in the OP; having to click a link and load a page is not the same as attaching a screenshot. An embed is hypertext and can be cached (see: Discord embeds, where I have rescued many posts and images after they were deleted) and archived. Attaching a screenshot is just a lossy way of embedding the web page.
@tael@matt Yes, but readers should click through to read someone else’s content. Copying it on to your own website is just theft, and autoloading it is a security incident waiting to happen, and a privacy violation. There’s a reason email clients don’t display images by default anymore.
@fastfinge@matt No. "Embedding a link" usually means loading a preview of the embedded page as a card based on the OpenGraph meta tags. I'm not sure how Mastodon does post embeds but OpenGraph was made for allowing posts to display without needing to be screenshot. These links should get embedded when you load the post for example: myog.social/articles/og-meta-tags-guide ogp.me
@fastfinge@matt (But Mastodon counts embedded posts as quotes.) As you can see, alt text is lost in the Discord embed, which isn't great, but preserved in the Mastodon embed. This is better than a screenshot of tillian's post, which would never have any alt text, and a plain link, which would require me to click through to look at the post.
@tael@matt Clicking through is a far better solution. Browsers shouldn’t even agree to load resources from anything other than your current domain without you having to click.
@fastfinge@matt Clicking through is not a solution to screenshots of web pages, the expectation is that the content is displayed on the page
I think you have some outmoded beliefs about browser security but I respect them. I assume you have noscript set up to block JavaScript from any cross-site resources as well?
@fastfinge@matt Then I imagine a lot of websites just straight-up don't work for you. More power to you but I wouldn't expect more than a small group of people to willingly use the web that way.
@tael@matt You can also host a lot of the popular js libraries locally and repoint the cdns like jsdeliver with local dns. Getting to 99 percent actual functionality is much easier that way than managing an endless stream of dns blocklists.
@fastfinge@matt I do do that! But it's not really how the web is built anymore. And even if you block external JS, most websites are probably made with React now and importing tons of packages from the Node Package Manager, introducing actually serious security vulnerabilities that you have no control over at all. Backend JavaScript, baby. ;)
