[boyter]

They can. Someone could get your post, then boost it, which distributes it to whoever follows them and so on.

Anyone thinking their post is only seen by their followers when they have federation turned on is grossly misinformed.

[OctopusLupid]

I was under the impression that boosting follower only posts does not work (via the API too, actually, it returns a HTTP error code if you try to do so), but then again the server code may be modified, or people can just screenshot.

I think this is simply a social problem — when sending a post to your followers, you have to trust that they do not share your post. The same applies in private messaging. You have to trust the recipients.

[boyter]

I agree with you when it comes to private messages, and anyone sharing those is a jerk.

I don't agree in this case where the system is designed to spread those posts. Fair enough if you don't want that to happen, in which case don't use a federated system where that is a design goal.