The image is not federated.

That's not at all the same thing. That's just the inability to handle large amounts of unexpected normal user traffic.

This is essentially bot traffic driven by servers all independently but simultaneously fetching the same image, without even a single human necessarily looking at it.

From server's perspective the only difference between those is the user-agent. Traffic is the same

the image should be federated

But what OP is talking about is a technical detail that can be fixed.

I don't think compute resources should be an issue, if anything it saves other instances resources.

As far as I understand, right now, all instances are fetching this data individually, so they all have the same compute load from this. Doing it on one and sending it along with federation should keep resource useage pretty much the same on the originating instance, and less for all others.

This would still increase bandwidth of course, but at least with all VPS providers I have used, bandwith is pretty cheap.

That's weird. Is that how it's supposed to work, or did they just implement it in a bad way?

The origin and purpose of the traffic is not the same. That's why they block one and not the other.

Did I say "shouldn't be"? Could have sworn i said "is"...

You're talking about 2 different kinds of blocking here. NPR can't block a URL, that concept doesn't really exist at this level. They could block ip addresses, or user agents as you mentioned.

A workplace can't block by user agent (at least not on any website using TLS), as this header is not readable by any intermediary devices.

Are you sure? In your post you're talking about fetching an image for a link preview, not an image post.

Usually, when I see an image post, the source is actually the pictrs of the source instance, so in that case I think it is federated.

How else can you be sure the content is valid though? Lemmy posts are sent as Announces from the community, not from the actor posting the post. The community could just fake a post if you just trust it.

How do you know that data is authentic?

NPR can't block a URL

I wasn't talking about NPR, I was talking about their employer...

You mentioned both in the same comment...

NPR apparently blocks the former

I'm just saying, their employer can't block like NPR does, because they are fundamentally different things. The one is a server receiving a request, the other is a firewall seeing encrypted packets.

Edit: the other could also be a DNS resolver that just does not resolve certain domains.

No one was talking about an image post...

Yes, but then a comment mentioned the "hug of death" - high spike of requests resulting from a link being shared on some site, and OP asked why centralized sites were also creating problems

There was another post regarding previews some months/(knowing me probably a year) ago and personally I would go with federating previews. With a button for mods to refresh it from source for when something goes fucky

But social networks have been creating random bursts of requests, this way or another, even in the times of centralized socials

I figured a post with a link with preview image wouldn't be the same in terms of event as an image post. Turns out it pretty much is, but also, I checked a few posts and cross-posts across instances, all of them have an image url of the original instance, not the one I'm viewing on. So if they are individually fetching this image, they're not using it.

Edit: I was wrong, two of the crossposts just didn't respond to the request for activity, so I was looking at the wrong response data

It's almost like the software that powers the internet was designed for a different time and is only still used because there's monied interest in keeping it around. We need GNUnet.

I just took this random post from my frontpage: https://sh.itjust.works/post/68605733
and made a manual request for the federated JSON-LD.

{
  "@context": [
    "https://join-lemmy.org/context.json",
    "https://www.w3.org/ns/activitystreams"
  ],
  "type": "Page",
  "id": "https://sh.itjust.works/post/68605733",
  "attributedTo": "https://sh.itjust.works/u/derrickoswald",
  "to": [
    "https://lemmy.world/c/technology",
    "https://www.w3.org/ns/activitystreams#Public"
  ],
  "name": "Stratospheric airship flew from US to Japan and back",
  "cc": [],
  "content": "<p>It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.</p>\n",
  "mediaType": "text/html",
  "source": {
    "content": "It seems with an unmanned airship they should be using hydrogen for the ~8% increased payload capacity.",
    "mediaType": "text/markdown"
  },
  "attachment": [
    {
      "href": "https://arstechnica.com/gadgets/2026/10/trans-pacific-journey-tested-stratospheric-cell-tower-concept-in-japan/",
      "mediaType": "text/html; charset=utf-8",
      "type": "Link"
    }
  ],
  "image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  },
  "sensitive": false,
  "published": "2026-10-19T20:16:37.383385Z",
  "language": {
    "identifier": "en",
    "name": "English"
  },
  "audience": "https://lemmy.world/c/technology",
  "tag": [
    {
      "href": "https://sh.itjust.works/post/68605733",
      "name": "#technology",
      "type": "Hashtag"
    }
  ]
}

Notice the

"image": {
    "type": "Image",
    "url": "https://sh.itjust.works/pictrs/image/df608ab3-b644-489d-b217-9224aa09e203.jpeg"
  }

Yes the image itself isn't sent over (iirc they never are?), but it's stored on sh.itjust.works. Other instances grab it from there, not the website the post links to.

I did notice just now though that some Lemmy instances seem to just proxy the image through their servers, which I assume is to avoid CORS. But that's an instance choice, not a general fediverse issue.

Mbin does the same as Lemmy, but it also includes the image in the attachment property. Probably for compatibility with some other platform.

One thing I didn't notice before was that you're using Piefed. That's the one software I didn't check before writing my previous comment. It does seem like Piefed is the outlier here. I tried a post from piefed.ca and the image is nowhere to be seen. The image property is not present, it's not in the attachment array, and I can't see any other property that contains it.

Edit: A piefed.social post I just tried did have an image, so I assume I'm just blind.