Lemmy.ml is blocking all requests from /kbin Instances
I discovered yesterday evening that Lemmy.ml is blocking all inbound ActivityPub requests from /kbin instances. Specifically, a 403 'access denied' is returned when the user agent contains "kbinBot" anywhere in the string. This has been causing a cascade of failures with federation for many server owners, flooding the message queue with transport errors.
This doesn't appear to be a mistake; it has been done very deliberately, only on Lemmy.ml. Lemmy.world and other large instances do not exhibit the same behavior. It also isn't a side effect of the bug introduced in Lemmy 0.18. You can observe by sending the following in a terminal
Additional evidence of this not being a Lemmy 0.18 bug:
This occurs when making web requests to any location on the Lemmy.ml webserver, not just ActivityPub endpoints.
Go to https://fedidb.org/software/lemmy and pick an instance running 0.18.0. Perform the above commands, replacing the URL for Lemmy.ml with that particular instance's address.
If this continues, my instance may need to defederate from Lemmy.ml. This is especially problematic because Lemmy.ml continues to federate information outbound to other kbin instances while refusing to allow inbound communication from them.
Spoofing the user agent is less than ideal, and doesn't respect Lemmy.ml's potential wish to not be contacted by /kbin instances. I don't post this to create division between communities, but I do hope that I can draw awareness to what's going on here. Defederating /kbin instances entirely would even be better than arbitrarily denying access one-way. This said, we should all attempt to maintain a good-faith interpretation until otherwise indicated by the Lemmy developers. It's possibel that this is a firewall misconfiguration or some other webserver-related bug.
It's possible that this is a consequence of the latest Lemmy update, in which a lot has changed. I have noted that kbin has some issues with request signature in communication with certain instances. I will try to check it tomorrow first thing in the morning.
If they don't want us to communicate with the users of their server, they should be defederated. Sucks for the users, but they can hop to another server whose admins don't break communication inelegantly and ghost admins who want to know what's going on.
If it's just a bug, then obviously we should wait for it to be fixed, but if they're not even saying they'll look into it, I don't have much hope.
At first I thought it was maybe a config error to block bots. But after some testing I see that the 403 is only given when the word "kbinbot" is in the user agent. String that just return the normal response I tested are "testbot", "kbinbo", "binbot".
Doesnt surprise me, the developers of lemmy (which are owners of .ml) have an agenda. They are into censoring on ukraine news, and other stuff. I dont get why people are choosing lemmy over kbin when they are equally bad looking
If this is intentional, I have to wonder why they're doing it in such a troublesome way rather than defederating properly. If they want to defederate, so be it, but then just do that.
I was almost ready to say that maybe they're just looking for "bot" in the UA. But, no. It must be "kbinbot" anywhere in the UA, and case insensitive. So, pretty deliberate it seems.
If this continues, my instance may need to defederate from Lemmy.ml.
That probably isn't the right fix for the long term, because otherwise it leaves kbin vulnerable to being DoSed by another instance intentionally returning 403s, or breaking down if something goes wrong with a lemmy or kbin instance that causes it to throw errors for totally innocent reasons. Kbin should be fixed to handle getting 403s reasonably-gracefully.
EDIT: Also, might be a good idea to check lemmy's handling of getting 403s as well for the same reason.
EDIT2: I don't know if lemmy/kbin have any kind of test code to test how well they deal with federated servers malfunctioning, but my guess is that using one set of tests for both would probably save effort.
They also do not sent POST / updates to my /f/inbox instance anymore. Lemmy.ml seems to activity ban Kbin instances. Which is very bad. I really hope this is not on purpose..
I think I had similar issues with one of the mobile clients using my Beehaw account, whenever I tried to write a reply I'd get a 40X (not sure which one exactly) error. I didn't pay attention to the server the post was on though but Beehaw being still on the .17 version might mess with other instances & clients in weird ways.
It's possibly an overreaction to the bot problem.
People started defederating suspicious instances, but what exactly count as suspicious is up for interpretation.
It's also very possible that was the point of the bot signups all along.
And on a relatively unrelated note, splitting the already minuscule fediverse, will kill any chance for it to become a real alternative.
Even if Lemmy's dev political views can be outrageous to some people, defederating them would be the beginning of the end imo.