federation / allow-list broken?

[pixlguru]

Instances not on the allow-list of feddit.de are able to subscribe/federate content:
e.g.
https://lemmygrad.ml/c/main@feddit.de
https://dissonanz.xyz/c/main@feddit.de

whilst set "strict_allowlist": true
the instance is allow-list only from the beginning

[Nutomic]

This is expected, the allowlist only prevents sending activities to not allowed instances, and prevents receiving activities from them (and same for blocklist). Fetching objects (communities, posts etc) cant be blocked that way, because it doesnt use authentication. You can try it yourself with curl -H 'Accept: application/activity+json' https://feddit.de/c/main. #868 would fix this.