I discovered yesterday evening that Lemmy.ml is blocking all inbound ActivityPub requests from /kbin instances. Specifically, a 403 ‘access denied’ is returned when the user agent contains “kbinBot” anywhere in the string. This has been causing a cascade of failures with federation for many server owners, flooding the message queue with transport errors.

This doesn’t appear to be a mistake; it has been done very deliberately, only on Lemmy.ml. Lemmy.world and other large instances do not exhibit the same behavior. It also isn’t a side effect of the bug introduced in Lemmy 0.18. You can observe by sending the following in a terminal

> curl -I --user-agent "kbinBot v0.1" https://lemmy.world/u/test
HTTP/2 200
[...]

> curl -I --user-agent "kbinBot v0.1" https://lemmy.ml/u/test                                
HTTP/2 403
[...]

> curl -I --user-agent "notKbinBot v0.1" https://lemmy.ml/u/test
HTTP/2 403
[...]

> curl -I --user-agent "placeholder-user-agent" https://lemmy.ml/u/test
HTTP/2 200
[...]

Additional evidence of this not being a Lemmy 0.18 bug:

  • This occurs when making web requests to any location on the Lemmy.ml webserver, not just ActivityPub endpoints.

  • Go to https://fedidb.org/software/lemmy and pick an instance running 0.18.0. Perform the above commands, replacing the URL for Lemmy.ml with that particular instance’s address.

If this continues, my instance may need to defederate from Lemmy.ml. This is especially problematic because Lemmy.ml continues to federate information outbound to other kbin instances while refusing to allow inbound communication from them.

Spoofing the user agent is less than ideal, and doesn’t respect Lemmy.ml’s potential wish to not be contacted by /kbin instances. I don’t post this to create division between communities, but I do hope that I can draw awareness to what’s going on here. Defederating /kbin instances entirely would even be better than arbitrarily denying access one-way. This said, we should all attempt to maintain a good-faith interpretation until otherwise indicated by the Lemmy developers. It’s possibel that this is a firewall misconfiguration or some other webserver-related bug.

Relevant comment from me (#354 - [BUG] Critical errors/failed messages during messenger:consume)

Edits:

  • Yes, people have already tried reaching out to the Lemmy instance admins in their Matrix room with no answer.

  • Someone has posed a question on Lemmy.ml about the block here: https://lemmy.ml/post/1563840

  • ernest@kbin.social
    link
    fedilink
    arrow-up
    2
    ·
    1 year ago

    It’s possible that this is a consequence of the latest Lemmy update, in which a lot has changed. I have noted that kbin has some issues with request signature in communication with certain instances. I will try to check it tomorrow first thing in the morning.

  • dedale@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    It’s possibly an overreaction to the bot problem.
    People started defederating suspicious instances, but what exactly count as suspicious is up for interpretation.
    It’s also very possible that was the point of the bot signups all along.

    And on a relatively unrelated note, splitting the already minuscule fediverse, will kill any chance for it to become a real alternative.
    Even if Lemmy’s dev political views can be outrageous to some people, defederating them would be the beginning of the end imo.

    • Pamasich@kbin.social
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      The issue is, it’s only “kbinBot” and variations of that that don’t work. If you just use “bot” itself, everything works fine. So it’s not just an overreaction to the bot problem, unless all bot instances impersonated kbin.

      The more likely answer is that lemmy.ml wanted to exclude kbin users from participating, but without actually limiting the freedom of their own users (which defederation would do).

      And on a relatively unrelated note, splitting the already minuscule fediverse, will kill any chance for it to become a real alternative.
      Even if Lemmy’s dev political views can be outrageous to some people, defederating them would be the beginning of the end imo.

      The current situation is misleadingly confusing to the average user and kbin moderators can’t do their job properly.
      I don’t see how defederation, especially when temporary until the issue is fixed, harms anyone when we already can’t interact properly anyway. I think the current situation is more harmful. Imo this sounds like the kind of situation defederation exists for.

      • dedale@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        defederation, especially when temporary
        It will create ill will. Perhaps first have kbin’s instances admins try to contact the dev.
        And if they’re unresponsive after a reasonable time then assume bad intent. Or maybe call them out publicly?

        If Lemmy’s dev them are actually trying to shadowban kbin, yeah fuck em, it would be evil behaviour.
        But that would be a serious setback since lemmy has metcalfe’s law running for it.

        I think dissolution is one of the most obvious and dangerous vectors of attack on the fediverse (along with flooding and the classic embrace and extinguish), so we should keep that in mind.
        Not to let paranoia take the better of me, but there are huge financial and political interests rooting against a free, transparent social media platform.

  • phi1997@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    If they don’t want us to communicate with the users of their server, they should be defederated. Sucks for the users, but they can hop to another server whose admins don’t break communication inelegantly and ghost admins who want to know what’s going on.

    If it’s just a bug, then obviously we should wait for it to be fixed, but if they’re not even saying they’ll look into it, I don’t have much hope.

      • Deceptichum@kbin.social
        link
        fedilink
        arrow-up
        0
        ·
        1 year ago

        Before assuming no one has asked them, let’s read the post

        “Yes, people have already tried reaching out to the Lemmy instance admins in their Matrix room with no answer.”

        • ripcord@kbin.social
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Ok, but, as the thread over there says, it’s not like they’re singling out kbin as far as the code shows. Just because no one there has answered yet doesn’t mean they’ve refused to answer. Give it some time or some actual replies before assuming the worst.

          Also that edit was added after my question.

          It’s been a few hours, this is way way too fast for the pitchforks to come out.

  • svovl@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    In the spirit of a thriving fediverse, I suggest not to assume the worst of other parts of it before we know a bit more of what’s going on.

  • camelbeard@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    At first I thought it was maybe a config error to block bots. But after some testing I see that the 403 is only given when the word “kbinbot” is in the user agent. String that just return the normal response I tested are “testbot”, “kbinbo”, “binbot”.

    • AnonymousLlama@kbin.social
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      I think the approach of changing the user agent in the interim is a good solution, if there’s a technical reason they don’t want kbin traffic they can be adults and reply in the chat, not just sneakily blocking incoming traffic

  • Eisenhowever@kbin.social
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    Doesnt surprise me, the developers of lemmy (which are owners of .ml) have an agenda. They are into censoring on ukraine news, and other stuff. I dont get why people are choosing lemmy over kbin when they are equally bad looking

    • UrbenLegend@kbin.social
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      Eh? What are you talking about? There’s literally a bunch of Russia and Ukraine news at https://lemmy.ml/c/worldnews. This rumor mill needs to stop. People started some bad rumors about Lemmy devs just because of their political association and now its blown up into full lies.

      I use both Lemmy and Kbin, but I prefer Lemmy for a bunch of different reasons:

      1. Interface is cleaner and more performant.
      2. Getting to your list of subscribed magazines in kbin is a pain in the ass. Why is it buried in Settings?
      3. Kbin votes are public. This is just bad for privacy. It’s one thing to say that votes are public due to federation, and whole other thing to blatantly show it in the UI. There’s a reason why voting at a government level is kept secret, just sayin’.
      4. Also why the hell are they called magazines? None of the names in kbin map to existing conventions. “Threads” are posts. “Magazines” are communities or groups. I never get used to it because it isn’t natural to call these things the way kbin calls them.
      • Bodleum@kbin.social
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        I think liking an internet post and voting for the leadership of the government are not suitable for comparison here.

        • slicedcheesegremlin@kbin.social
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          yeah, kbin is probably the nicest looking reddit alternative i’ve seen. Really sleek design without leaning into the overly overly mobile-focused watered down New Reddit bs, while also not nearly as hideous as old reddit.

          • mochi@kbin.social
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            I do wish kbin looked a bit better on mobile, though. I have larger font on my iPhone and instead of wrapping, the text just goes off the screen and can’t be viewed.