That's my normal go-to, but more than once I've accidentally blocked locations that Let's Encrypt uses for secondary validation, so I've had to be more precise with my firewall blocks
Lemmy. I added a comment above since LW wouldn't let me edit the post.
Mine's only extended with some WAF rules and I've got a massive laundry list of bot user agents that it blocks, but otherwise it's pretty bog standard.
If instances have Anubis setup correctly (i.e. not in front of /api/...) then that might not help them since this is calling the API endpoint.
Can't edit the post (Thanks Cloudflare! /s) but additional info:
I truncated the log excerpts in the post. The user agent string in these requests isn't shown here, but it is blank in the actual logs.
This is for Lemmy admins only. It might apply to others in some form, but this seems to be specifically exploiting a Lemmy API endpoint
My Nginx solution may have room for improvement; I was just trying to block that behavior without breaking comments in posts and move on with my day. Suggestions for improvement are welcome.
I shouldn't say this, but whatever: It's a "troll" tactic to do that since mods/admins can't ban with content removal if the account is deleted (unless that's fixed in .13?) . Admins can remove the deleted flag in the DB for the user and then do so, but mods can only remove items individually. Not that any of these necessarily warrant removal on their own, but not doing so in this case encourages this kind of "hit it and quit it" behavior, and this user is clearly ban evading.
I'm not saying this as an instruction manual but merely as a statement of fact about how stupid Lemmy's behavior is with regard to deleted accounts.
You get banned every other day for spamming out a massive number of posts. And you just make a new account the next day, start the exact same thing again like...you've learned nothing?
I'm tired of my feed being an entire page of just you, and I'm tired of blocking you. Can you not just post things at a normal rate?
Oh, sorry. One of the new features in this dev branch is the ability to disable PMs and mentions. I've been running with those turned off. Seems like that feature is working lol.
I turned DMs back on and found the message - will try to join here when I'm back on desktop. Dunno how active I can be right now, but I am eventually going to start on Piefed so would be nice to have a sounding board.
Some of the devs are already working on shared logic/libraries between apps.
Oh, I meant just if the instance isn't know, I thought resolving would make it "aware" of that instance. I could be wrong. But yeah, the instance would have to federate with the other one for it to be able to resolve, though. e.g. it won't resolve an object from an instance that is on the current instance's "block" list.
I believe you can, yeah, and I also think that "bootstraps" that instance to yours if it doesn't already know about it. But in that case, the way I have the search written, it'll "fall back" to regular search which also does resolveObject. That just takes longer.
The ap_id check is just to short-circuit that behavior to avoid the lengthy, often unnecessary, search and quickly redirect you to your instance's local copy.
Have had that working for about a week now, and it's pretty nice. Please do steal this feature lol.
At startup, it calls /api/v3/federated_instances and stores the result to a lookup variable. Then I've got a couple of helper functions that accept either an instance ID or a domain name which looks them up from the lookup variable.
I think you would be better served by checking for the Link header
Can't really do that, client-side, in a browser application. CORS is a perpetual cockblock (though I understand why it is), and I'd rather not make an internal API endpoint to do the lookup.
The application polls Lemmy's getFederatedInstances API endpoint at startup, so it has a list of every activity pub server your instance knows about. That's the first and primary check for the URL that's being searched.
Goal isn't to "catch 'em all" but to catch the most used ones. If there's one I don't account for, either by omission or because the federated platform didn't exist when I made the patterns, then it will just fall back to a regular search which also includes trying to resolve it as a federated URL (which is the current behavior in all prior versions).
The goal is just to simply short-circuit the search behavior if the query is a known ap_id URL in order to avoid a lengthy search process and quickly redirect you to your instance's local copy.
Paste in an AP_ID into the search field, and it auto-resolves it and redirects you to your instance's local copy (which is very fast) instead of going through the whole search process (which is slow). To prevent false positives, I'm matching the various ap_id formats and only doing the resolution on those; anything else gets passed to search.
Anything else that falls through the cracks just gets passed to search as usual (which also does a resolveObject lookup).
This application is written against the Lemmy API. It only speaks API. Eventually it'll speak Piefed API as well, but right now, only Lemmy API.
Lemmy and Piefed only do server-to-server Activity Pub and not client-to-server AP. Clients have to use the API to interact with them. This is a Lemmy (and eventually Piefed) client.
Cool, thanks. I was close with /user guessing from memory.
I think the /users/.../post_id will be sufficient. It just needs to know that the given URL is an AP_ID before passing it off to the API call to resolveObject. Since it already knows instance.domain.tld is a federated instance, it just needs to see if the path is an AP_ID or the HTML (or something else). Thus, I don't have to parse the whole thing, just check that enough of it matches.
Thanks. I've largely been active here for development/testing purposes lately, but agreed. That's also why I've put so much effort into expanding and making a very powerful/granular filtering system in this release. Right now, I can filter entire instances, entire platforms (e.g. Mastodon), people/instances/platforms in specific communities, filter users/communities by regex pattern, etc. Makes it nice to filter people out of specific communities without blocking them entirely.
Eh, I know I made a big stink about it (which I stand by lol), but technically Dubvee's still online since I need it for developing/testing the admin and mod capabilities. It's mothballed but still able to be brought back if I ever choose to and get some more admins on board.
Seems like it. I was planning only on maintenance, but with the huge amount of work I've put into the current dev branch, I can't really call it maintenance anymore.
Yep, 100%. I'm waiting for the API to mature to the point where I can do everything the native interface can do. I really don't want to waste my time making a second-class app.
Unfortunately, while I do have Python experience, I don't have the spare time to contribute to the API code. At least not right now. Hopefully that changes soon.
Lol, I feel honored. I made this meme as OC 6 months ago (https://dubvee.org/post/2992196). Funniest thing was I laughed at it, upvoted it, and was like, "wait a minute....." lol.
Usually most people don't even wanna see my memes the first time 😆
That's my normal go-to, but more than once I've accidentally blocked locations that Let's Encrypt uses for secondary validation, so I've had to be more precise with my firewall blocks