https://community.nodebb.org/inbox    delivery rejected: 403 Forbidden    2025-03-30 22:51:57
https://community.nodebb.org/inbox    delivery rejected: 403 Forbidden    2025-03-30 23:28:55

@scott@loves.tech Hubzilla is formatting its Notes in a manner I wasn't expecting.

• The group actor is the attributedTo, which is not possible in NodeBB
• The note itself is not addressed to the group actor, only its followers collection
• There is no way to discern without parsing the note content itself who authored the original note.

So at present while I would be able to retrieve the note, without a proper backreference to the group actor, I don't think I can slot it correctly.

Not sure why the received activity is returning a 403, as well.

Forgot to cc @mario@hub.somaton.com re: the above.

@mario@hub.somaton.com since Hubzilla posts (incl. yours) are making it in fine I'm assuming this is only for the "forum" feature?

@mario@hub.somaton.com that's wonderful to hear! Thank you so much.

Some of the remote categories appear to be broken now.

These are the Flipboard magazines NodeBB is currently aware of when searching "flipboard" in the search page:

• [Tech News by @theverge@flipboard.com](https://community.nodebb.org/category/tech-news-theverge@flipboard.com)
• [Musik News by @musikexpressde@flipboard.com](https://community.nodebb.org/category/musik-news-musikexpressde@flipboard.com)
• [Gear by @engadget@flipboard.com](https://community.nodebb.org/category/gear-engadget@flipboard.com)

However, that very first one (tech news by The Verge) does not work; going to it gives a 404 page instead.

Something else appears to have happened to the Vivaldi Blog remote category (a WordPress blog). A week ago it was working fine, but now, searching for it lists it twice in the search page. Each listing indicates a completely different number of posts and topics for the remote category.

Even weirder though most of the topics that are correctly slotted into it, they are not actually in the category page, e.g. https://community.nodebb.org/topic/a85b0eff-5219-46ba-9ad4-a5d417a7bec5/minor-update-2-for-vivaldi-desktop-browser-7.3

Screenshots

Actually, I think I know what's going on with the Vivaldi blog group actor - it's not necessarily NodeBB's fault.

Inspecting the AP objects coming from vivaldi.com/blog, all the English-written blog posts have their as:audience field set to https://vivaldi.com/?author=0.

Meanwhile, every other blog post that is written in a different language instead have it set to https://vivaldi.com//?author=0, so for Japanese blog posts, for example, it is https://vivaldi.com/ja/?author=0.

And all these URLs link to different group actors, but all of them have the same value on the preferredUsername and webfinger properties: blog, and blog@vivaldi.com.

EDIT: Actually this also appears to be all actor objects coming from vivaldi.com/blog. E.g. if you start typing [@ruari@vivaldi.com](https://community.nodebb.org/user/ruari%40vivaldi.com) or search for it, you can see it be suggested twice too.

So my guess is that there are two person actors that NodeBB knows of that are claiming to be ruari@vivaldi.com: https://vivaldi.com/?author=46 and https://vivaldi.com/ja/?author=46.

This is probably a bug with the WPML+ActivityPub plugin combination they have going on.

Screenshots

@AltCode okay! Thanks for reporting, it sounds like there are two issues going on:

1. Categories losing their handle-to-id association
   • Frustratingly, this read very similarly to #13283, and both remote users and categories share similar logic. I have so far not been able to reproduce it at all on local development.
2. Separate users (different IDs) sharing the same preferredUsername.
   • This is an interesting one, and I am not entirely sure where the fault lies. I wonder how other software handles it?

@AltCode I forked this out to a new topic. I think it's time to loop @pfefferle@mastodon.social into the conversation (at the very least so this could be potentially escalated).

Mattias, it seems that when the WPML and ActivityPub plugins are enabled together, notes federated out by the blog user in another language have different ids but the same preferredUsername.

e.g. ruari@vivaldi.com: https://vivaldi.com/?author=46 and https://vivaldi.com/ja/?author=46

NodeBB interprets this as two different users. Curiously, Mastodon does not, the second ID explicitly does not resolve.

So there can be two solutions here:

1. The underlying issue can be fixed by WordPress, the solution of which is out of scope (for me at least)
2. NodeBB can adopt whatever mechanism Mastodon is using... which is most likely that Mastodon does a two-way when asserting an ID, and ensures that the webfinger resource points to the ID.

The remaining questions here are:

• whether preferredUsername is meant to be unique to the instance (in which case having multiple ids point to an identical preferredUsername would be a violation), and
• what exactly AP software should do when it encounters this situation... store a list of "known alias" IDs? There are potential security issues to doing so.

@AltCode all three flipboard remote categories seem to be working now

This is getting out of hand! Now, there are six of them!

@AltCode This should be fixed in the upcoming v4.3.0.

Actor assertion should not proceed if passed-in ID does not pass a webfinger query · Issue #13352 · NodeBB/NodeBB

I think NodeBB checks that the ID exists, and then proceeds with a full actor assert/update if it doesn't find it. Which leads to weird stuff as discovered by @altcode@community.nodebb.org where: One user with id: https://vivaldi.com/?au...

GitHub (github.com)

It won't proactively remove the duplicates, but they'll be pruned out within ~7 days.