Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (Darkly)
  • No Skin
Collapse

Chebucto Regional Softball Club

  1. Home
  2. Uncategorized
  3. Re: WP Multilingual plugin + ActivityPub bug
A forum for discussing and organizing recreational softball and baseball games and leagues in the greater Halifax area.

Re: WP Multilingual plugin + ActivityPub bug

Scheduled Pinned Locked Moved Uncategorized
8 Posts 2 Posters 2 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • ? Offline
    ? Offline
    Guest
    wrote on last edited by
    #1
    Actually, I think I know what's going on with the Vivaldi blog group actor - it's not necessarily NodeBB's fault. Inspecting the AP objects coming from vivaldi.com/blog, all the English-written blog posts have their `as:audience` field set to `https://vivaldi.com/?author=0`. Meanwhile, every other blog post that is written in a different language instead have it set to `https://vivaldi.com//?author=0`, so for Japanese blog posts, for example, it is `https://vivaldi.com/ja/?author=0`. And all these URLs link to *different* group actors, **but all of them have the same value on the `preferredUsername` and `webfinger` properties:** `blog`, and `blog@vivaldi.com`. --- **EDIT:** Actually this also appears to be *all* actor objects coming from vivaldi.com/blog. E.g. if you start typing `[@ruari@vivaldi.com](https://community.nodebb.org/user/ruari%40vivaldi.com)` or [search for it](https://community.nodebb.org/search?in=users&term=ruari%40vivaldi.com), you can see it be suggested twice too. So my guess is that there are two person actors that NodeBB knows of that are claiming to be `ruari@vivaldi.com`: `https://vivaldi.com/?author=46` and `https://vivaldi.com/ja/?author=46`. This is probably a bug with the [WPML+ActivityPub plugin combination](https://thomasp.vivaldi.net/2025/01/14/combining-wpml-activitypub/) they have going on. --- ### Screenshots ![Screenshot 2025-04-02 at 23.35.28.png](https://community.nodebb.org/assets/uploads/files/1743629967155-screenshot-2025-04-02-at-23.35.28.png) ![Screenshot 2025-04-02 at 23.40.47.png](https://community.nodebb.org/assets/uploads/files/1743630439708-screenshot-2025-04-02-at-23.40.47-resized.png)
    Link Preview ImageLink Preview Image
    julianJ 2 Replies Last reply
    0
    • ? Guest
      Actually, I think I know what's going on with the Vivaldi blog group actor - it's not necessarily NodeBB's fault. Inspecting the AP objects coming from vivaldi.com/blog, all the English-written blog posts have their `as:audience` field set to `https://vivaldi.com/?author=0`. Meanwhile, every other blog post that is written in a different language instead have it set to `https://vivaldi.com//?author=0`, so for Japanese blog posts, for example, it is `https://vivaldi.com/ja/?author=0`. And all these URLs link to *different* group actors, **but all of them have the same value on the `preferredUsername` and `webfinger` properties:** `blog`, and `blog@vivaldi.com`. --- **EDIT:** Actually this also appears to be *all* actor objects coming from vivaldi.com/blog. E.g. if you start typing `[@ruari@vivaldi.com](https://community.nodebb.org/user/ruari%40vivaldi.com)` or [search for it](https://community.nodebb.org/search?in=users&term=ruari%40vivaldi.com), you can see it be suggested twice too. So my guess is that there are two person actors that NodeBB knows of that are claiming to be `ruari@vivaldi.com`: `https://vivaldi.com/?author=46` and `https://vivaldi.com/ja/?author=46`. This is probably a bug with the [WPML+ActivityPub plugin combination](https://thomasp.vivaldi.net/2025/01/14/combining-wpml-activitypub/) they have going on. --- ### Screenshots ![Screenshot 2025-04-02 at 23.35.28.png](https://community.nodebb.org/assets/uploads/files/1743629967155-screenshot-2025-04-02-at-23.35.28.png) ![Screenshot 2025-04-02 at 23.40.47.png](https://community.nodebb.org/assets/uploads/files/1743630439708-screenshot-2025-04-02-at-23.40.47-resized.png)
      Link Preview ImageLink Preview Image
      julianJ This user is from outside of this forum
      julianJ This user is from outside of this forum
      julian
      wrote on last edited by
      #2
      [@AltCode](https://community.nodebb.org/user/altcode) okay! Thanks for reporting, it sounds like there are two issues going on: 1. Categories losing their handle-to-id association * Frustratingly, this read very similarly to [#13283](https://github.com/NodeBB/NodeBB/issues/13283), and both remote users and categories share similar logic. I have so far not been able to reproduce it at all on local development. 1. Separate users (different IDs) sharing the same `preferredUsername`. * This is an interesting one, and I am not entirely sure where the fault lies. I wonder how other software handles it?
      1 Reply Last reply
      0
      • ? Guest
        Actually, I think I know what's going on with the Vivaldi blog group actor - it's not necessarily NodeBB's fault. Inspecting the AP objects coming from vivaldi.com/blog, all the English-written blog posts have their `as:audience` field set to `https://vivaldi.com/?author=0`. Meanwhile, every other blog post that is written in a different language instead have it set to `https://vivaldi.com//?author=0`, so for Japanese blog posts, for example, it is `https://vivaldi.com/ja/?author=0`. And all these URLs link to *different* group actors, **but all of them have the same value on the `preferredUsername` and `webfinger` properties:** `blog`, and `blog@vivaldi.com`. --- **EDIT:** Actually this also appears to be *all* actor objects coming from vivaldi.com/blog. E.g. if you start typing `[@ruari@vivaldi.com](https://community.nodebb.org/user/ruari%40vivaldi.com)` or [search for it](https://community.nodebb.org/search?in=users&term=ruari%40vivaldi.com), you can see it be suggested twice too. So my guess is that there are two person actors that NodeBB knows of that are claiming to be `ruari@vivaldi.com`: `https://vivaldi.com/?author=46` and `https://vivaldi.com/ja/?author=46`. This is probably a bug with the [WPML+ActivityPub plugin combination](https://thomasp.vivaldi.net/2025/01/14/combining-wpml-activitypub/) they have going on. --- ### Screenshots ![Screenshot 2025-04-02 at 23.35.28.png](https://community.nodebb.org/assets/uploads/files/1743629967155-screenshot-2025-04-02-at-23.35.28.png) ![Screenshot 2025-04-02 at 23.40.47.png](https://community.nodebb.org/assets/uploads/files/1743630439708-screenshot-2025-04-02-at-23.40.47-resized.png)
        Link Preview ImageLink Preview Image
        julianJ This user is from outside of this forum
        julianJ This user is from outside of this forum
        julian
        wrote on last edited by
        #3
        [@AltCode](https://community.nodebb.org/user/altcode) I forked this out to a new topic. I think it's time to loop [@pfefferle@mastodon.social](https://community.nodebb.org/user/pfefferle%40mastodon.social) into the conversation (at the very least so this could be potentially escalated). Mattias, it seems that when the WPML and ActivityPub plugins are enabled together, notes federated out by the blog user in another language have different `id`s but the same `preferredUsername`. e.g. `ruari@vivaldi.com: https://vivaldi.com/?author=46` and `https://vivaldi.com/ja/?author=46` NodeBB interprets this as two different users. Curiously, Mastodon does not, the second ID explicitly does not resolve. So there can be two solutions here: 1. The underlying issue can be fixed by WordPress, the solution of which is out of scope (for me at least) 2. NodeBB can adopt whatever mechanism Mastodon is using... which is _most likely_ that Mastodon does a two-way when asserting an ID, and ensures that the webfinger resource points to the ID.
        1 Reply Last reply
        0
        • ActivityPubA ActivityPub shared this topic on
        • julianJ This user is from outside of this forum
          julianJ This user is from outside of this forum
          julian
          wrote on last edited by
          #4
          The remaining questions here are: * whether `preferredUsername` is meant to be unique to the instance (in which case having multiple `id`s point to an identical `preferredUsername` would be a violation), and * what exactly AP software should do when it encounters this situation... store a list of "known alias" IDs? There are potential security issues to doing so.
          1 Reply Last reply
          1
          0
          • ? Offline
            ? Offline
            Guest
            wrote last edited by
            #5
            [This is getting out of hand!](https://www.youtube.com/watch?v=lD_ag67tH3I) Now, there are six of them! ![Screenshot 2025-04-22 at 11.27.24.png](https://community.nodebb.org/assets/uploads/files/1745314130970-screenshot-2025-04-22-at-11.27.24.png)
            Link Preview Image
            1 Reply Last reply
            0
            • julianJ This user is from outside of this forum
              julianJ This user is from outside of this forum
              julian
              wrote last edited by
              #6
              [@AltCode](https://community.nodebb.org/user/altcode) This should be fixed in the upcoming v4.3.0. https://github.com/NodeBB/NodeBB/issues/13352 It won't proactively remove the duplicates, but they'll be pruned out within ~7 days.
              1 Reply Last reply
              0
              • julianJ This user is from outside of this forum
                julianJ This user is from outside of this forum
                julian
                wrote last edited by
                #7
                Bit of a thought experiment here as to how to handle these duplicate accounts. (**tl;dr** two federated accounts with different IDs report the same webfinger handle, what do?) Let's say [@ruario@social.vivaldi.net](https://community.nodebb.org/user/ruario%40social.vivaldi.net) posts an English article under his account (and then is federated), and posts a translated Japanese one that is also federated, but under the _Japanese_ ID. What should NodeBB do when encountering the latter? Currently, it will try to assert the actor, fail the webfinger backreference check, and _probably_ drop the post. Not so good. One _could_ adjust the actor to the former (canonical ID), but that's not technically right either. That also opens up potential account impersonation possibilities, so that is something that would need addressing as well.
                1 Reply Last reply
                0
                • julianJ This user is from outside of this forum
                  julianJ This user is from outside of this forum
                  julian
                  wrote last edited by
                  #8
                  [@pfefferle@mastodon.social](https://community.nodebb.org/user/pfefferle%40mastodon.social) just wanted to poke you about this issue again. The latest updates to NodeBB now do a webfinger backcheck to ensure that the actor has a valid webfinger entry for their purported handle. If it does not, then the user is not properly created. Mastodon also does this. This check is probably for security as well as for preventing handle collisions. The multilingual plugin in conjunction with the ActivityPub plugin creates users that share the same handle, and that causes issues with federated content. For example, [this article](https://vivaldi.com/blog/news/official-statement-regarding-the-eus-first-dma-antitrust-fines/) by [@jonvt@vivaldi.com](https://community.nodebb.org/user/jonvt%40vivaldi.com) will load up just fine in Mastodon, but [this japanese article](https://vivaldi.com/ja/blog/ios/ios-snapshots/ios-7-2-3617-4/) by [@akira@vivaldi.com](https://community.nodebb.org/user/akira%40vivaldi.com) will not, because that second article's `attributedTo` is `https://vivaldi.com/ja/?author=176`, which fails that check (the author's ID is actually https://vivaldi.com?author=176 as per the handle backcheck) cc [@AltCode](https://community.nodebb.org/user/altcode)
                  1 Reply Last reply
                  0

                  Reply
                  • Reply as topic
                  Log in to reply
                  • Oldest to Newest
                  • Newest to Oldest
                  • Most Votes


                  • Login

                  • Don't have an account? Register

                  • Login or register to search.
                  Powered by NodeBB Contributors
                  • First post
                    Last post
                  0
                  • Categories
                  • Recent
                  • Tags
                  • Popular
                  • World
                  • Users
                  • Groups