this post was submitted on 27 Jun 2023
167 points (100.0% liked)

/kbin meta

200 readers
2 users here now

Magazine dedicated to discussions about the kbin itself. Provide feedback, ask questions, suggest improvements, and engage in conversations related to the platform organization, policies, features, and community dynamics. ---- * Roadmap 2023 * m/kbinDevlog * m/kbinDesign

founded 1 year ago
 

I discovered yesterday evening that Lemmy.ml is blocking all inbound ActivityPub requests from /kbin instances. Specifically, a 403 'access denied' is returned when the user agent contains "kbinBot" anywhere in the string. This has been causing a cascade of failures with federation for many server owners, flooding the message queue with transport errors.

This doesn't appear to be a mistake; it has been done very deliberately, only on Lemmy.ml. Lemmy.world and other large instances do not exhibit the same behavior. It also isn't a side effect of the bug introduced in Lemmy 0.18. You can observe by sending the following in a terminal

> curl -I --user-agent "kbinBot v0.1" https://lemmy.world/u/test
HTTP/2 200
[...]

> curl -I --user-agent "kbinBot v0.1" https://lemmy.ml/u/test                                
HTTP/2 403
[...]

> curl -I --user-agent "notKbinBot v0.1" https://lemmy.ml/u/test
HTTP/2 403
[...]

> curl -I --user-agent "placeholder-user-agent" https://lemmy.ml/u/test
HTTP/2 200
[...]

Additional evidence of this not being a Lemmy 0.18 bug:

  • This occurs when making web requests to any location on the Lemmy.ml webserver, not just ActivityPub endpoints.

  • Go to https://fedidb.org/software/lemmy and pick an instance running 0.18.0. Perform the above commands, replacing the URL for Lemmy.ml with that particular instance's address.

If this continues, my instance may need to defederate from Lemmy.ml. This is especially problematic because Lemmy.ml continues to federate information outbound to other kbin instances while refusing to allow inbound communication from them.

Spoofing the user agent is less than ideal, and doesn't respect Lemmy.ml's potential wish to not be contacted by /kbin instances. I don't post this to create division between communities, but I do hope that I can draw awareness to what's going on here. Defederating /kbin instances entirely would even be better than arbitrarily denying access one-way. This said, we should all attempt to maintain a good-faith interpretation until otherwise indicated by the Lemmy developers. It's possibel that this is a firewall misconfiguration or some other webserver-related bug.

Relevant comment from me (#354 - [BUG] Critical errors/failed messages during messenger:consume)

Edits:

  • Yes, people have already tried reaching out to the Lemmy instance admins in their Matrix room with no answer.

  • Someone has posed a question on Lemmy.ml about the block here: https://lemmy.ml/post/1563840

top 50 comments
sorted by: hot top controversial new old
[–] ernest@kbin.social 116 points 1 year ago (3 children)

It's possible that this is a consequence of the latest Lemmy update, in which a lot has changed. I have noted that kbin has some issues with request signature in communication with certain instances. I will try to check it tomorrow first thing in the morning.

[–] Upvotes_Kills_Birds@kbin.social 15 points 1 year ago (1 children)

Wow, thank you for the quick communication. Amazing aptitude. Almost nowhere else do you find a lead dev in the comment trenches letting us know what's happening, I'm kinda baffled.

load more comments (1 replies)
[–] svovl@kbin.social 5 points 1 year ago (1 children)
[–] LollerCorleone@kbin.social 8 points 1 year ago (10 children)

Those links are working fine. Kbin is federating well with those instances. A bit of latency is normal.

load more comments (10 replies)
load more comments (1 replies)
[–] svovl@kbin.social 29 points 1 year ago

In the spirit of a thriving fediverse, I suggest not to assume the worst of other parts of it before we know a bit more of what's going on.

[–] crowsby@kbin.social 29 points 1 year ago

They're moving to a paid API as a prank.

[–] phi1997@kbin.social 27 points 1 year ago (1 children)

If they don't want us to communicate with the users of their server, they should be defederated. Sucks for the users, but they can hop to another server whose admins don't break communication inelegantly and ghost admins who want to know what's going on.

If it's just a bug, then obviously we should wait for it to be fixed, but if they're not even saying they'll look into it, I don't have much hope.

[–] ripcord@kbin.social 19 points 1 year ago (4 children)

Before assuming, has anyone...asked them?

[–] Deceptichum@kbin.social 23 points 1 year ago (1 children)

Before assuming no one has asked them, let’s read the post

“Yes, people have already tried reaching out to the Lemmy instance admins in their Matrix room with no answer.”

[–] ripcord@kbin.social 15 points 1 year ago* (last edited 1 year ago) (2 children)

Ok, but, as the thread over there says, it's not like they're singling out kbin as far as the code shows. Just because no one there has answered yet doesn't mean they've refused to answer. Give it some time or some actual replies before assuming the worst.

Also that edit was added after my question.

It's been a few hours, this is way way too fast for the pitchforks to come out.

[–] frex@kbin.social 8 points 1 year ago* (last edited 1 year ago) (1 children)

If I use a firewall to block kbin in user agent then it doesn't matter what code is running, it will throw 403.

Edit: Just checked out, the first request with kbin user agent, it doesn't have x-powered-by: Express, suggesting that it is blocked in nginx level, it doesn't even reach the backend Express. This will not be reflected in the code whatsoever.

 ~  curl -I --user-agent "notKbinBot v0.1" https://lemmy.ml/u/test
HTTP/2 403
server: nginx
date: Wed, 28 Jun 2023 01:50:53 GMT
content-type: text/html
content-length: 146
vary: Accept-Encoding

 ~  curl -I --user-agent "placeholder-user-agent" https://lemmy.ml/u/test
HTTP/2 200
server: nginx
...
x-powered-by: Express
...

load more comments (1 replies)
[–] Deceptichum@kbin.social 7 points 1 year ago

Code and config is different, it’s irrelevant if it’s not in the git.

load more comments (3 replies)
[–] Eisenhowever@kbin.social 24 points 1 year ago (2 children)

Doesnt surprise me, the developers of lemmy (which are owners of .ml) have an agenda. They are into censoring on ukraine news, and other stuff. I dont get why people are choosing lemmy over kbin when they are equally bad looking

[–] TheRoarer@kbin.social 21 points 1 year ago (2 children)

Wait why is kbin bad looking?

[–] TwilightVulpine@kbin.social 12 points 1 year ago (1 children)

It looks better than reddit.

[–] slicedcheesegremlin@kbin.social 14 points 1 year ago (3 children)

yeah, kbin is probably the nicest looking reddit alternative i've seen. Really sleek design without leaning into the overly overly mobile-focused watered down New Reddit bs, while also not nearly as hideous as old reddit.

load more comments (3 replies)
load more comments (1 replies)
[–] UrbenLegend@kbin.social 7 points 1 year ago* (last edited 1 year ago) (4 children)

Eh? What are you talking about? There's literally a bunch of Russia and Ukraine news at https://lemmy.ml/c/worldnews. This rumor mill needs to stop. People started some bad rumors about Lemmy devs just because of their political association and now its blown up into full lies.

I use both Lemmy and Kbin, but I prefer Lemmy for a bunch of different reasons:

  1. Interface is cleaner and more performant.
  2. Getting to your list of subscribed magazines in kbin is a pain in the ass. Why is it buried in Settings?
  3. Kbin votes are public. This is just bad for privacy. It's one thing to say that votes are public due to federation, and whole other thing to blatantly show it in the UI. There's a reason why voting at a government level is kept secret, just sayin'.
  4. Also why the hell are they called magazines? None of the names in kbin map to existing conventions. "Threads" are posts. "Magazines" are communities or groups. I never get used to it because it isn't natural to call these things the way kbin calls them.
[–] EnglishMobster@kbin.social 17 points 1 year ago* (last edited 1 year ago)

I wouldn't really call it "rumors" when you can go directly to the horse's mouth:

https://www.reddit.com/r/communism/comments/cqgztr/fuck_the_white_supremacist_reddit_admins_want_me/

https://web.archive.org/web/20230626055233/https://old.reddit.com/r/communism/comments/cqgztr/fuck_the_white_supremacist_reddit_admins_want_me/

Hey all, longtime Marxist-leninist, recorder of left audiobooks, and megathread shitposter here.

Posting this in light of a recent one week Reddit ban I earned for shitting on US police, as I'm sure many of us have gotten in recent weeks.

So I've spent the past few months working on a self hostable, federated, Reddit alternative called Lemmy, and it's pretty much ready to go. Unlike here we'd have ultimate control over all content, and would never have to self censor.

Obviously as communists, we agitate where the people are, so we should never abandon Reddit entirely, but it's been clear to all of us from day one, that communities like this stand on unsteady ground, and could be banned or quarantined at any moment by the white supremacist Reddit admins. This would be both a backup and a potentially better alternative. Moderation abilities are there, as well as a slur filter.

Raddle isn't an option obviously since it's run by this arch anti tankie scum, ziq.

I wanted to ask ppl here if they'd like me to host an instance, and mod all the current mods here.

My concern is with this line: Obviously as communists, we agitate where the people are. I'm pretty left-leaning myself (I draw the line at authoritarianism though), but they're very open about using their platform to push an agenda.

That post was made by the founder of Lemmy and the instance they mention at the end where they mod all the mods of /r/communism became Lemmygrad (because lemmy.ml and Lemmygrad are the same people - the ".ml" in "lemmy.ml" even stands for "Marxist-Leninist").

With Lemmy.ml as the "main" instance, you're exposing all these posts to an admin team who has openly said "we are agitating for our views wherever the people go, and we have ultimate control over all content." They have already removed posts critical of China as being "orientalist" (which shows a severe lack of understanding of what "orientalism" even is - it's not "anything that criticizes our Dear Leader"). I can't trust that any community hosted on lemmy.ml is free of bias.

It isn't "rumors" when you can clearly go and back it up with a source.

(FWIW - I don't mind Lemmy as a platform. My Lemmy account is actually from 2020, before I realized what they truly were. The maintainers have done a good job of keeping politics out of the software, and the concept of only using "ethical" things is a myth when your computer has rare earth elements in it. As far as instances go, Lemmy.world seems fantastic and has grown to be far larger than the tankie instances. But Kbin is more fully-featured and has a lot more long-term potential, even though it's lacking in the short-term.)

[–] assbutt@kbin.social 16 points 1 year ago (1 children)

just because of their political association

Their political association is the whole goddamn point. Their fucked up ideals are the reason I don't want to support them in any way.

[–] Onii-Chan@kbin.social 10 points 1 year ago* (last edited 1 year ago)

This guy acting like those in charge at Lemmy being pro-CCP and censoring dissenting opinions isn't a valid reason for not wanting to be involved with them. Fuck Lemmy. Fuck authoritarians.

load more comments (2 replies)
[–] camelbeard@kbin.social 20 points 1 year ago (2 children)

At first I thought it was maybe a config error to block bots. But after some testing I see that the 403 is only given when the word "kbinbot" is in the user agent. String that just return the normal response I tested are "testbot", "kbinbo", "binbot".

[–] Jajcus@kbin.social 11 points 1 year ago

Maybe it is some kind of automated rule 'block bots that cause lots of traffic'. kbin is becoming more and more significant, so it probably causes some non-insignificant load on Lemmy servers. Legitimate load, but the IDS rules would not know that.

load more comments (1 replies)
[–] Tyrannosauralisk@kbin.social 19 points 1 year ago (2 children)

There is a question about this up on lemmy.ml here:

https://lemmy.ml/post/1563840

[–] AnonymousLlama@kbin.social 9 points 1 year ago

At least they're equally as confused, hopefully this is just an issue in communication and the federation of content will be back in full swing soon

[–] btaf45@kbin.social 6 points 1 year ago

Hey Yote.zip is saying this. What's up with that?

" I’ll add that I have recently noticed that practically nothing that I post has been getting through to kbin."

[–] luna@kbin.social 14 points 1 year ago (1 children)

Happy to see this. I've been avoiding .ml anyway, this makes my job easier. Fuck the Lemmy devs.

load more comments (1 replies)
[–] missingno@kbin.social 9 points 1 year ago (2 children)

If this is intentional, I have to wonder why they're doing it in such a troublesome way rather than defederating properly. If they want to defederate, so be it, but then just do that.

[–] phi1997@kbin.social 8 points 1 year ago (1 children)

This approach only makes sense as a blanket defederation of all kbin servers. Seems shady.

[–] jiml78@kbin.social 10 points 1 year ago* (last edited 1 year ago) (4 children)

Well, lemmy.ml is the lemmy devs. Kbin is a competitor to their software. They might hate that Kbin is growing really fast and I think is overall better than straight lemmy.

[–] luna@kbin.social 10 points 1 year ago (1 children)

I think it's more likely they just disliked the fact most Kbin users don't support genocide, while Lemmy has a history of that. The Stalinist side of Lemmy, moderated and endorsed by the developers, has made fun of Kbin.social before

load more comments (1 replies)
[–] harmonea@kbin.social 9 points 1 year ago* (last edited 1 year ago)

It would be pretty against the spirit of ActivityPub if this were the case. Holding out to actually hear from them on this, hopefully, rather than assume such bad things about them.

They just recently had a software update I believe, so hopefully it's just a side effect of that.

load more comments (2 replies)
load more comments (1 replies)
[–] Hakaku@kbin.social 9 points 1 year ago

I suspect it's nothing more than an overeager web application firewall (WAF) blocking the requests automatically.

[–] r00ty@kbin.social 8 points 1 year ago

I was almost ready to say that maybe they're just looking for "bot" in the UA. But, no. It must be "kbinbot" anywhere in the UA, and case insensitive. So, pretty deliberate it seems.

[–] Cloudless@kbin.social 8 points 1 year ago (4 children)

This will save me time. I am trying to block all communities hosted by the tankies instance.

load more comments (4 replies)
[–] static@kbin.social 6 points 1 year ago (1 children)

Any news on this? It's till broken.

load more comments (1 replies)
[–] Zzinck@kbin.social 5 points 1 year ago (1 children)

Lemmy is no different than Reddit. They silence and ban anyone they don't agree with and do not care about the users.

[–] ripcord@kbin.social 17 points 1 year ago (5 children)

You're making one hell of an assumption here.

Most likely it is a misconfiguration or bug. Or misunderstanding.

[–] assbutt@kbin.social 9 points 1 year ago (1 children)

That's not an assumption based solely on this one post, it's an opinion based on the words and actions of the lemmy devs. I want nothing to do with them.

load more comments (1 replies)
load more comments (4 replies)
[–] Patrick-Haverkamp754@kbin.social 5 points 1 year ago (1 children)

has anyone message lemmy.ml admins to see what may be up? maybe this is a bug rather than outright blocking

[–] barista@kbin.social 6 points 1 year ago

Yes, folks have tried reaching out in their Matrix chat without luck so far.

load more comments
view more: next ›