@cel originally I wanted to use # because it doesn't get sent in the HTTP request, so it would be properly end-to-end and decrypted on the client but then:

• I changed my mind about the liteclient - I don't think it will be possible to implement all the private groups feature I want on the lite client. lite client can be public only someone still wants it.
• instead, moving towards idea for websbot, which means sbot is the end point.
• we need indexes of private messages, so doesn't make much difference if sbot also handles blob decryption.
• also, patchfoo is one of the most popular clients, and has no javascript on the client. Also same peolpe have a seemingly irrational but deepseated loathing of javascript, and they like http only.
• it was simple enough to whip up late at night before I went to bed, which is why I did it now and didn't put it off till later.

yeah, it should probably be in the mentions array too. I think this needs a isBlobWithQuery(blob_id) or something to check wether the given link is an extended blob id (maybe there will be other properties that want to go in the query string too?)