overview for barista

5

Lemmy.ml is blocking all requests from /kbin Instances (kbin.social)

submitted 1 year ago by barista@kbin.social to c/kbinMeta@kbin.social

11 comments fedilink

I discovered yesterday evening that Lemmy.ml is blocking all inbound ActivityPub requests from /kbin instances. Specifically, a 403 'access denied' is returned when the user agent contains "kbinBot" anywhere in the string. This has been causing a cascade of failures with federation for many server owners, flooding the message queue with transport errors.

This doesn't appear to be a mistake; it has been done very deliberately, only on Lemmy.ml. Lemmy.world and other large instances do not exhibit the same behavior. It also isn't a side effect of the bug introduced in Lemmy 0.18. You can observe by sending the following in a terminal

> curl -I --user-agent "kbinBot v0.1" https://lemmy.world/u/test
HTTP/2 200
[...]

> curl -I --user-agent "kbinBot v0.1" https://lemmy.ml/u/test                                
HTTP/2 403
[...]

> curl -I --user-agent "notKbinBot v0.1" https://lemmy.ml/u/test
HTTP/2 403
[...]

> curl -I --user-agent "placeholder-user-agent" https://lemmy.ml/u/test
HTTP/2 200
[...]

Additional evidence of this not being a Lemmy 0.18 bug:

This occurs when making web requests to any location on the Lemmy.ml webserver, not just ActivityPub endpoints.
Go to https://fedidb.org/software/lemmy and pick an instance running 0.18.0. Perform the above commands, replacing the URL for Lemmy.ml with that particular instance's address.

If this continues, my instance may need to defederate from Lemmy.ml. This is especially problematic because Lemmy.ml continues to federate information outbound to other kbin instances while refusing to allow inbound communication from them.

Spoofing the user agent is less than ideal, and doesn't respect Lemmy.ml's potential wish to not be contacted by /kbin instances. I don't post this to create division between communities, but I do hope that I can draw awareness to what's going on here. Defederating /kbin instances entirely would even be better than arbitrarily denying access one-way. This said, we should all attempt to maintain a good-faith interpretation until otherwise indicated by the Lemmy developers. It's possibel that this is a firewall misconfiguration or some other webserver-related bug.

Relevant comment from me (#354 - [BUG] Critical errors/failed messages during messenger:consume)

Edits:

Yes, people have already tried reaching out to the Lemmy instance admins in their Matrix room with no answer.
Someone has posed a question on Lemmy.ml about the block here: https://lemmy.ml/post/1563840

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 1 points 1 year ago

This is from another comment in the thread, copied here since it's relevant. Regarding missing user avatars - there is an open pull request to replace these with a remote instance's logo, rather than the browser default for unlocated images: https://codeberg.org/Kbin/kbin-core/pulls/334

Additionally, I've tweaked some things server-side and it looks like that's helped caching remote avatars (but there's still work to be done).

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 1 points 1 year ago

Regarding missing user avatars - there is an open pull request to replace these with a remote instance's logo, rather than the browser default for unlocated images: https://codeberg.org/Kbin/kbin-core/pulls/334

Additionally, I've tweaked some things server-side and it looks like that's helped caching remote avatars (but there's still work to be done). Please keep me updated on any further issues.

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 4 points 1 year ago

Unfortunately, as of right now, no. This may change in the future, but currently it's best to decide on a Kbin instance early on so you don't have too many posts and comments that will be left behind.

There's also the possibility of having multiple accounts, but that's cumbersome for a multitude of reasons.

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 2 points 1 year ago

Thanks, I had to step away and was pleasantly surprised by this being debugged for me by the time I got back! 😊 I've pinged the Kbin space on Matrix to see if anyone has thoughts on how we can re-download these avatars. I may end up writing a custom script to handle this manually if there's no way to trigger a warmup on media cache.

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 1 points 1 year ago

Currently debugging this. I'm just using the default styles found in /kbin so I'll need to experiment a little. I'll follow up here.

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 3 points 1 year ago

Is this on the homepage, on the linked post, or everywhere? Definitely not expected behavior.

Kbin Cafe, a fun, general-purpose instance, is now open for registrations ☕ by barista in c/RedditMigration@kbin.social

[-] barista@kbin.social 10 points 1 year ago

There's https://fedidb.org/software/kbin, but this hardly helps users differentiate based on various instance characteristics like joinmastodon.org, for example (I have no experience with Lemmy's instance listing).