Pixelfed has shipped a fix to validate timestamps from remote activities, rejecting any dates outside the range (-10 years and +1 day)

Update AP helpers, reject statuses with invalid dates by dansup · Pull Request #5344 · pixelfed/pixelfed

GitHub (github.com)

@dansup wait, why -10 years? not every object is freshly authored activitystreams... some objects might be historical, converted from a cms, or even just fetched 10+ years later without the activity.

@trwnh lets talk aboot dis on discord