freamon

Exactly that, yeah. Thank you for the link.

It’s straight-forward enough to do in back-end code, to just reject a query if parameters are missing, but I don’t think there’s a way to define a schema that then gets used to auto-generate the documentation and validate the requests. If the request isn’t validated, then the back-end never sees it.

For something like https://freamon.github.io/piefed-api/#/Misc/get_api_alpha_search, the docs show that ‘q’ and ‘type_’ are required, and everything else is optional. The schema definition looks like:

/api/alpha/search:
    get:
      parameters:
        - in: query
          name: q
          schema:
            type: string
          required: true
        - in: query
          name: type_
          schema:
            type: string
            enum:
              - Communities
              - Posts
              - Users
              - Url
          required: true
        - in: query
          name: limit
          schema:
            type: integer
          required: false

required is a simple boolean for each individual field - you can say every field is required, or no fields are required, but I haven’t come across a way to say that at least one field is required.

PieFed has a similar API endpoint. It used to be scoped, but was changed at the request of app developers. It’s how people browse sites by ‘New Comments’, and - for a GET request - it’s not really possible to document and validate that an endpoint needs to have at least one of something (i.e. that none of ‘post_id’ or ‘user_id’ or ‘community_id’ or ‘user_id’ are individually required, but there needs to be one of them).

It’s unlikely that these crawlers will discover PieFed’s API, but I guess it’s no surprise that they’ve moved on from basic HTML crawling to probing APIs. In the meantime, I’ve added some basic protection to the back-end for anonymous, unscoped requests to PieFed’s endpoint.

What is the update delay for Fediseer?

I don’t know. It’s not something I’m familiar with - it might just default to saying ‘closed’ if it doesn’t have the data.

It’s interesting that the obvious bot accounts on those instances were set up in mid-March last year, so I’m guessing that these are somebody’s army that they’ve used before, but overplayed their hand when they turned it on the DonaldJMusk person. The admins can reasonably be blamed for setting up instances with open registrations and no protections and then forgetting about them, but I’d be wary of blaming them for being behind the attack directly. The ‘nicole’ person is unlikely to have used their own instance - it’s probably just someone with the same MO as whoever owns the bots, finding and exploiting vulnerable instances.

lemmy.world recently updated from version 0.19.3 to 0.19.10. This change - for Lemmy communities to federate out posts with the community name as a hashtag - was introduced in 0.19.4, so that might be the other reason why this has only just become an issue for you.

The attacker seems to be the admin of those two instances. Both instances have their registrations closed.

The alternative theory would be that these instances had open registrations, but rightly closed registration down after the admins noticed the bots. chinese.lol is on 0.18.4 with an admin with a 2 year old account, lemmy.doesnotexist.club has an admin with a 1 year account, and it was also that instance that the ‘nicole’ person has used before. This downvote attack would need to be a long time in the planning for what you’re suggesting to be true.

I don’t think that blog author is male, btw.

I think that’s what he meant, yeah (no existing DB migration scripts, etc). I don’t know much about it, but I imagine it was probably always going to involve someone more familiar with Lemmy diving into the trenches.

He’s mentioned this before, but I’ve never been able to find an actual PixelFed Group (it doesn’t appear to be the same thing as what they call Collections). I’ll have another look when pixelfed.social enables them this weekend (but I suspect parsing titles for the posts will be a nightmare).

Also, ‘smithereen’ is tagged but I’m not sure of its status (all I found was 1 private instance run by the dev, federated with 1 “explicitly-free-speech” Akkoma instance).

Imgur can also handle videos with audio. The main restriction with them is that the MP4s have to be less than a minute.

I’ll embed one here, which may or may not work, depending on what you’re using (if it doesn’t embed, the post is here)

PieFed is just a Fediverse platform that aims to inter-op with Lemmy in much the same way that it aims to inter-op with any other Group-based platform (MBIN, PeerTube, NodeBB, Wordpress).

Lemmy’s “quirks” are the reason why your account won’t see Polls from MBIN, or channels from PeerTube, or posts from NodeBB, or backfilled content from Wordpress.

It’s not my intent to criticise Lemmy, but these are verifiable problems, whereas it doesn’t seem fair to criticise PieFed for problems that you can’t clearly remember.

Account -> Activity Alerts will show you everything for which you’ll get a notification.

Wordpress if that is counted as federated

It’s an option for the blog owners to select, but it’s more federated than Loops (which currently isn’t federated at all). As a random example, here is a Wordpress blog post that was federated out to Mastodon, and then federated out to PieFed.

Do all filters have that 3 level system?

Yes - that Trump/Musk form is just a shortcut to setting up your own filter - the options on that form equate to ‘hide completely’, ‘make semi-transparent’ (so you can see the post, but it’s faded out), or “don’t set up a filter”

Also, do you know of an alternative front-end for Piefed?

There’s the one I made (the one linked to by OpenStars), but I think the more promising development is that the Interstellar dev has made some progress supporting PieFed too (Interstellar is already the only app that supports both MBIN and Lemmy, and I like the idea of one app for 3 different platforms).

As a term, ‘instance’ is already baked into code, databases, and APIs.

If I wanted to use an API to block ‘lemmy.world’, for example, I’d call ‘site/block’ with the relevant ‘instance_id’. That’s already 2 different terms for the same thing (‘site’ and ‘instance’), which isn’t great, but adding ‘provider’ into the mix means you’re now saying “if you want to block a ‘provider’, use the ‘site’ endpoint with the ID for the ‘instance’”, which is arguably worse.

Ah, no. Sadly not. It installed okay, but just presents a big white window when I ran it. The OS version is BigSur (the highest that machine will run).

I doubt it’s an Issue you’ll need to prioritise, 'cos others in my position have likely just installed Linux instead.

Looks great! Is there any info about what architecture / OS versions are supported for Mac? The only Apple hardware I have is a 12 year old MacBook Air (I realise I could just download it and find out, but that would involve me getting up off the sofa). Thanks.

No. The app was forked from a Lemmy app (Thunder), so there’s not much PieFed-specific in it (e.g. there’s also no support for Polls). The exception is that it supports post / comment subscribing (I was notified of your comment, even though I’m not the OP of this post).

I created a new instance for testing the app, and I didn’t create any Topics (partly laziness, partly because the whole area is being re-evaluated for user-created Topics, aka Feeds).

The app will lag behind the site in features, 'cos adding stuff for direct HTML rendering will always be easier than adding stuff that’s got to come through an API.