Fellas, I think threads.net might be blocking some servers already.
It does not work on any Pleroma servers yet. But I believe that is an unintentional compatibility issue. However some servers seem to be outright blocked.
Let me explain. Threads requires signed fetches. What that means is that every GET request to a threads.net resource needs to be cryptographically signed. Threads will then look up the signer and verify its signature.
The flow looks something like this:
gleasonator.com -> GET threads.net/zuck (signed by /actor)
threads.net -> GET gleasonator.com/actor
The request to Threads contains a signature, with information about how to verify it. Threads will then verify it by fetching info from the origin server before returning the data.
You can see Threads fetching your own server by looking at the "facebookexternalua" user agent. Try this command on your server:
grep facebookexternalua /var/log/nginx/access.log
If you see logs there, that means Threads is attempting to verify your signatures and allow you to access their data.
On Gleasonator, I am seeing logs there. It is trying to let me establish a connection, even though it fails due to a bug in Pleroma or Threads. This means Gleasonator is not blocked.
However, on Spinster, and the Mostr Bridge, I have no requests from Threads at all, despite sending signed fetches. graf reports that Poast also isn't receiving any requests.
I do not believe they are operating on a whitelist. If so, it wouldn't make sense for Gleasonator and many other widely-blocked servers like gameliberty.club to be able to fetch from Threads.
So then I thought it may just be a caching issue, or a fluke on their end. But when I make a request from Gleasonator, I get the pingback from Threads within seconds. On Spinster and Mostr, there is no attempt being made at all.
So I am starting to think they may be blocking at the server-level already. And they are blocking Poast, Spinster, and the Mostr Bridge.
Alex Gleason /
npub108…uyev6
2023-12-14 20:47:24
Author Public Key
npub108pv4cg5ag52nq082kd5leu9ffrn2gdg6g4xdwatn73y36uzplmq9uyev6Published at
2023-12-14 20:47:24Event JSON
{
"id": "b09958dc0c060ea1f49fe162bf547bc840ceed5fac5169e396100066b9addbc2",
"pubkey": "79c2cae114ea28a981e7559b4fe7854a473521a8d22a66bbab9fa248eb820ff6",
"created_at": 1702583244,
"kind": 1,
"tags": [
[
"proxy",
"https://gleasonator.com/objects/971aec23-a2bc-4b88-8cee-e76b5692451e",
"activitypub"
]
],
"content": "Fellas, I think threads.net might be blocking some servers already.\n\nIt does not work on any Pleroma servers yet. But I believe that is an unintentional compatibility issue. However some servers seem to be outright blocked.\n\nLet me explain. Threads requires signed fetches. What that means is that every GET request to a threads.net resource needs to be cryptographically signed. Threads will then look up the signer and verify its signature.\n\nThe flow looks something like this:\n\ngleasonator.com -\u003e GET threads.net/zuck (signed by /actor)\nthreads.net -\u003e GET gleasonator.com/actor\n\nThe request to Threads contains a signature, with information about how to verify it. Threads will then verify it by fetching info from the origin server before returning the data.\n\nYou can see Threads fetching your own server by looking at the \"facebookexternalua\" user agent. Try this command on your server:\n\ngrep facebookexternalua /var/log/nginx/access.log\n\nIf you see logs there, that means Threads is attempting to verify your signatures and allow you to access their data.\n\nOn Gleasonator, I am seeing logs there. It is trying to let me establish a connection, even though it fails due to a bug in Pleroma or Threads. This means Gleasonator is not blocked.\n\nHowever, on Spinster, and the Mostr Bridge, I have no requests from Threads at all, despite sending signed fetches. graf reports that Poast also isn't receiving any requests. \n\nI do not believe they are operating on a whitelist. If so, it wouldn't make sense for Gleasonator and many other widely-blocked servers like gameliberty.club to be able to fetch from Threads.\n\nSo then I thought it may just be a caching issue, or a fluke on their end. But when I make a request from Gleasonator, I get the pingback from Threads within seconds. On Spinster and Mostr, there is no attempt being made at all.\n\nSo I am starting to think they may be blocking at the server-level already. And they are blocking Poast, Spinster, and the Mostr Bridge.",
"sig": "a3819fe52a7d73f25c134c2242cc7f051486ded4be91fc8377ac5156e4ec77b0e5aa89126fac2d52b07be80848a6645c41c036dc1f18cf39c23ae7f40b143977"
}