img-src *; is therefore better for remote images in articles. I thought my selfoss had stopped working when I removed object-src but I've just (re)tried it and it seems fine.