(no subject)

[denise]

We've received multiple reports of crossposting to LiveJournal silently failing, and many people have asked us about the problem. Unfortunately, the issue is not one that we can resolve: it happens when someone has automatic crossposting set up and has changed their LiveJournal password, but hasn't updated the password on their Dreamwidth crosspost settings. The number of failed logins trip LiveJournal's "attempted account hacking" detection system and our IP addresses are locked out from the site. This stops all Dreamwidth users from crossposting, whether or not their passwords are correct: we are entirely blocked from accessing LiveJournal at all.

For a decade or so, when this happened, we were able to contact them and have them remove us from the lockout list manually and whitelist our IP address range so that it wouldn't happen again. At some point in the last several years, they switched to telling us that the blocking is automatic, they aren't able to whitelist any IPs manually, and that we were mistaken when we were able to resolve the issue for a decade by emailing them and having them whitelist us manually; by this point, they no longer respond to us at all about the issue. (The delay in our posting about the issue has been, once again, us attempting to contact them unsuccessfully and getting no reply.)

Many users report to us that when they've contacted LiveJournal about the issue, LiveJournal has told them that the problem is on our end and that there are changes we can make to fix the problem. This is not true, and we aren't sure why they're telling you that. There is nothing we can do differently that will make them stop locking us out when people enter incorrect passwords for their crosspost accounts. At most, we could spend months making a massive, extensive, exhaustive effort rewriting the entire crosspost system, in exchange for an infinitesimal chance it would reduce the number of times this problem happens, not prevent it entirely. We aren't willing to spend six full months rewriting the crossposting system from scratch (and introducing all kinds of inevitable new bugs) to slightly lower the chance this problem will happen as frequently as it does, without assurances from LiveJournal that they are unwilling or unable to give us that such a rewrite would solve the issue entirely.

The only long-term, guaranteed fix for the issue is for LiveJournal to whitelist our IP addresses the way they were able to do for a decade and now claim to never have been able to do at all.

I know people are frustrated about the issue: so are we, and we're disappointed that the collegial relationship we enjoyed with LiveJournal for so long appears to have evaporated at some point in the last several years. However, at this point, we must advise you to treat crossposting to LiveJournal as an "as is" service that may or may not work at any given moment, depending entirely on LiveJournal's whims regarding blocking our ability to access the service due to people having entered their crossposting passwords wrong. If problems happen during the process of crossposting, there is nothing we can do to fix it, solve it, or hasten the site's removal from LiveJournal's access blocking system. All we can do is wait until the block expires, and they will neither tell us how long any given block will be active for nor a date/time when it will expire -- as I said, at this point they no longer respond to me when I email them about the issue, and haven't for quite some time.

If you have a crossposting account set up with LiveJournal as the crosspost destination, please check that the username and password are correct: the fewer people with incorrect passwords in their crossposting setup, the less likely this problem will be triggered. However, when it does happen, there is nothing we can do to solve it, and all you can do is wait it out. I'm very sorry. We're just as frustrated as you are.

ETA: I forgot to specify: yes, this includes the importer as well. The importer is more likely to catch a period of being unblocked because of how it functions asynchronously, but it's not a guarantee. If LiveJournal is currently blocking us, no function on Dreamwidth that requires communicating with LiveJournal will work, period.

UPDATE 1 Feb 2022 21:15 EDT: We have posted a further announcement: further investigation has made us realize there are several potential causes of the block other than the "password error" cause I explained in the post above. Until we're able to a) determine the cause of the block and b) determine whether there's any way we can work around it that will not cost us a significant amount of time and effort for potentially no reward, we have temporarily disabled crossposting to LiveJournal site-wide. We deeply regret needing to do this; however, it's clear that even if the situation is fixable, which it may not be, the resolution will take a significant amount of time. Until we have more information, it doesn't make sense for us to attempt crossposts we are aware have no chance of actually succeeding.

If you try to crosspost to LiveJournal, the process will automatically and immediately fail, and you'll receive a failure notice in your inbox directing you to this post. Please accept our utmost apologies for needing to take this step. We'll continue trying to identify the root cause of the difficulty and see if there is any fix we can make to re-enable crossposting that doesn't involve having to redesign the entire crosspost system from the ground up with no hopes of that even helping.

Comments

[edenfalling]

Thank you for keeping us updated on this issue ♥

[queenofhalves]

thank you for your hard work on addressing the issue.

[bemused_writer]

Thanks for an update! Such a shame how LJ is handling it, but always a good reminder to double check our passwords.

[denise]

Like I said, it won't completely prevent the problem -- even one person trying to crosspost with an incorrect password can sometimes be enough to trigger a block, based on the phases of the moon, the astrological sign, and whether or not we're currently in a leap year, or something. (We don't know! They won't tell us!) But the more people who check theirs and correct it, the less likely it will happen. We think.

[spikedluv]

How frustrating. Arrgh, LJ!

[muccamukk]

Thank you for the explanation and all the work you've put into it.

[medievalrosalie]

I just copy paste the posts across. It takes only a few more minutes and it's a workable solution.

[alexia_drake]

Same.

[falena]

Thank you for letting us now.

[symbioid]

That sounds terrible. :(

Thanks for making DW and keeping it chugging along!

[tanithryudo]

Is this the same reason why crossposting to insanejournal also stopped working a few months ago, or is that a different reason?

[batrachian]

Different issue entirely, actually; IJ updated their code to use https links everywhere, including the LJXMLRPC portal we ping to Do Crossposting (and importing).

That said, there is a patch in to resolve the issue (which I'll admit I'm a bit biased about, as I wrote it), that should go live at the next code push.

[eve11]

Thanks for the info. QQ: why would this result in difficulties arising for many people at once? It has hit my whole friends list. Is this because many DW-ers are all using the same IP address that has been blocked?

[denise]

Every crosspost coming from DW looks to LiveJournal like it's coming from the same few IP addresses -- it's not YOUR IP address that matters, it's ours. So if someone trips the automated "attempted account hacking" detector, they block all of our IP addresses again.

[slaymesoftly]

I'm a little confused about how this can happen if I haven't changed any passwords anywhere. My crossposting has been set up for years and I haven't changed any passwords, so not sure what to check if anything. Copy/pasting works, but it sure adds a lot of work to something that was so easy before. Which password to I need to check? my LJ password but on the crossposting request on here?

I'm sorry this is happening. But not blaming you.

[denise]

It's not your issue, it's LiveJournal's. If ANYONE on Dreamwidth tries to crosspost to LJ with the wrong password (not just you individually), there's a chance LJ will block ALL OF DREAMWIDTH because they claim that "too many failed logins" has tripped their "automated account hacking" detection. The "please check your password" request was for people to make sure that their LiveJournal password as saved in their crossposting settings on Dreamwidth is correct: the fewer people who have an incorrect LiveJournal password saved for their crossposting settings, the less chance of LJ deciding that all of Dreamwidth is trying to automate mass account breakins instead of, you know, a few people changed their passwords and forgot to update their settings. But that's just a mitigation attempt: even if everyone on DW updated their crosspost settings to make absolutely certain they have the correct LiveJournal password saved, there's still no guarantee LJ wouldn't block us just because it's Tuesday or a full moon or a full moon on Tuesday.

It (likely) isn't happening because of anything you in particular did. Even a single person trying to crosspost with an incorrect password because they forgot they changed it on LJ can make them block all of Dreamwidth, and the blocks are for varying lengths of time, with zero notification to us, and zero indication of how long the block will last. Like I said, when we started DW, we used to be able to contact them and have them whitelist our IP addresses again if the problem started happening, because they understood that we weren't automating mass account breakin attempts, we were (essentially) a posting client where all posting attempts come from a small range of IP addresses and sometimes people using that posting client mess up their logins.

At some point in the last several years, they switched to telling us that whitelisting was impossible and the only thing we can do is make sure that none of our users ever attempt to crosspost to LJ with an incorrect password. Obviously, that's impossible -- we can't verify that everyone's LJ password is correct without, you know, sending that username/password combination to LiveJournal, which is what triggers the block if someone has it wrong! -- and they also won't tell us what the thresholds for blocking are so we can introduce a delay to spread out our crossposting attempts so that incorrect logins won't trip the block. So there's literally nothing we can do to prevent it, only wait it out if and when it happens again.

A lot of the times, the blocks are transient and people don't notice them at all! This time it's been extremely prolonged. We have absolutely no information about when (or if) it might expire. If our users write to them, they say the problem is on our end, and that we have to fix it, but there's fundamentally nothing we can do to fix it, only reduce the chances of it happening -- and the only way we could even reduce the chance of it happening would be to massively rewrite the crossposter functionality, essentially from scratch, because the way it's written right now assumes that LJ will treat us reasonably as a legitimate third-party client, rather than the "hostile actor to block at all costs" they appear to have now chosen to classify us as. That rewrite would take us months (if not more), inevitably introduce a shitton of New and Exciting bugs, and not even guarantee that it would fix the problem: it isn't worth the amount of time and energy we would have to expend on it without assurances from LiveJournal they're unable or unwilling to give and information about how to best handle the problem that they're unable or unwilling to provide us, because any changes to the process that we made would only be guessing at what they think the problem is based on the extremely few times they've been willing to reply to us about the issue. (This was not one of the times they've been willing to reply to us about the issue.)

I'm really sorry. I know it's frustrating as hell. Believe me, we are deeply, deeply frustrated as well, and I wish we could return to our previous collegial relationship with LiveJournal in which they were willing to work with us to remove blocks when they happened and whitelist our IP ranges so that the problem wouldn't continue to happen. They've chosen instead to deny that whitelisting was ever a possibility (it was) and their official response to any inquiry we make about it is that the decade-plus in which we were able to be whitelisted was simply some sort of mistaken or erroneous belief on our part. (It wasn't.)

So, like, when we've reached the point where the only responses we can get, if we are lucky enough to even get a response, is a flat-out denial that the entirety of, like, 2009-2019 inclusive ever happened, there really isn't much we can do with any of that except apologize to all of you and advise you that you should consider crossposting an "as is" feature that works when it works, will not work most of the time, and if you choose to contact LiveJournal about it, they're going to either lie to you or ignore you. I'm really sorry. I wish I had a different answer.

[lovelyangel]

Thank you for the update! I appreciate all your hard and conscientious work that you do behind the scenes, 'round the clock. And I'm always happy to pay every year for my account!

[erulissedances]

I'm sure this addresses some of the problems, but I haven't changed passwords for either DW or LJ for several years, and it's only over the past couple of weeks or so that cross-posting hasn't worked. It stopped working for me when I turned it off on DW for a single post that I didn't want to pull over to LJ. Then, I reactivated cross-post, but it has refused to do so ever since. It's extremely frustrating.

I understand that it's not your fault, but indeed, it isn't anyone's fault, but people are being impacted by it. It's highly annoying.

- Erulisse (one L)

[denise]

Believe me, I very much know how annoying it is! I just gave an extended answer to someone who had a similar question to you, here: blocks don't happen because you individually had an incorrect password, they can happen if any Dreamwidth user has an incorrect password, at which point all DW users will be unable to crosspost. I advised people to update their crosspost settings and check that they had the correct password because the more people who have their passwords correct, the less of a chance LJ will decide to block us, but LJ decides to block us without warning, at a whim, and with no communication and absolutely no recourse.

When a block happens, it blocks all of Dreamwidth, not just the individual person who had the wrong password. LiveJournal has claimed there is no way to turn off this detection system or whitelist our IPs, despite having been able to do so for the entire decade of 2009-2019 inclusive. If users contact them about the problem, they lie and say it's our fault. We've reached the absolute limit of what we can do to solve the issue, and any additional attempts to address it would take months of massive effort, inevitably introduce a number of new bugs, and have zero guarantee it would even fix the problem. We can't make the problem stop happening without accurate information and timely communication from LiveJournal, and they've chosen not only not to provide that communication or information to us, but to deny extremely basic facts of documented reality going back a decade, for which we have extensive documentation, ever existed.

Once you've reached the point in trying to solve a problem where the other party is denying basic facts of reality for which you have documentation going back a decade, the ability to solve any problem involving that other party is virtually nil. I'm extremely sorry. It frustrates us a lot more than it frustrates you, I promise. If we could fix it, we would have fixed it. The problem is entirely on LiveJournal's end, and they will lie to you if you contact them about it, have repeatedly lied to us when we've tried to contact them about it, and have now switched to completely ignoring our communications in an attempt to resolve the problem. There's nothing else we can do.

I'm afraid that going forward, you'll need to treat crossposting as an "as is" service that may or may not work at any given moment and assume the answer is probably "not". I wish I had a better answer for you. It isn't our fault, but "it isn't anyone's fault" is wrong: it is LiveJournal's fault, they have chosen to deny that they ever could whitelist our IP addresses, and they will directly lie to you if you contact them about it. We are very, very angry, but our hands are completely tied.

[halfmoon_mollie1]

thank you very much for your work on this.

[madfilkentist]

LiveJournal keeps getting worse. There was a discussion of recent changes to their ToS, which appear to make users legally responsible for comments made on their posts.

[kore]

The "User who posted comments in Blog and User keeping such a Blog shall be jointly and severally liable in respect of such comments" thing? Yeah, that was....weird. "This Agreement constitutes a public offer in accordance with Article 437 of the Civil Code of the Russian Federation" was also very weird, mostly because I couldn't figure it out for the life of me. It must be possibly 1437 (about copyright?) or 437(2) (about licensing and possibly copyright?).

[morgandawn]

Yep, the error message I am seeing is

Failed to update crossposted entry at morgandawn@LiveJournal: Client error: Sorry, there is a problem with content of your entry: spam patterns were detected. Please contact Abuse Prevention team if you consider this is a mistake.: 'http:// ' is banned for spam. Exclude it to post entry

(Password is correct)

[denise]

Oooh, that's more than literally any other attempts to post have gotten that I've seen! Everyone else (my own trial attempts included) is just silently failing with no error message at all.

(Unfortunately, it won't do us any good to have that error message, because they stopped responding to my communications sometime in 2020 and they have no way to contact them about client-related issues for any client developer, not just us. But it's still funny as fuck!)

[chuka_lis]

Thank you, you do what you can. Surely it is another issue related to the LJ maintenance.

[pronker]

Thanks for the transparency and sending soothing vibes your way in what must be frustration itself. Here they come: ~~~~00000ooooo~~~~~~

[denise]

Thank you! Soothing vibes always appreciated.

[ai]

Strange that they seem to have no recollection of doing so prior, but what can you do? Looks like you guys did everything you could to communicate the issue and offered solutions that worked in the past.

Thanks to you and your team for trying to alleviate this frustrating matter. Sorry it didn't work out, but hey at least we as a community are aware of the issue now so we can help spread the word.

[denise]

Yeah, when you reach the point where the other party in the discussion is flat-out denying reality for which you have extensive years of documentation about the only response it's possible to have is ¯\_(ツ)_/¯

[weofodthignen]

Thank you sincerely for trying so hard to resolve this.

[such_heights]

Oh god what a nightmare, my sympathies!

[brooksmoses]

Would it be possible/useful to have something that, if things ever work again, detects the error case of "your attempted crosspost failed due to an incorrect LJ password" and turns off that user's crossposting for future posts until the affected user changes their password and/or turns it back on?

Sigh.

[denise]

We may already do that, actually? I think. (It's been a long time since I've looked at the crossposter code.) When these whole shenanigans started we did genuinely try to make a bunch of changes to avoid tripping their detectors, but eventually we realized the only way to guarantee it would work would be for LJ to cooperate with us to an extent they were clearly unwilling or unable to do, and honestly, the amount of time we've spent making massive changes based on the vague and handwavey guidance they are willing to give, and then having them change their mind completely about that being the thing we needed to do, means that I am just so completely, immensely over this. When the other party to a discussion starts denying a decade of reality for which you have extensive, exhaustive documentation that you have provided them and their answer is that obviously you are mistaken, the chance of working anything out is over and it's time to just cut your losses and stop even sending messages into the black hole for them to ignore.

I am 99% sure they are very, very mad at us still that we, Firefox, and Troy Hunt of Have I Been Pwned had to reveal the massive, extensive, prolonged and wide-ranging data breech they had after they refused to disclose to their users for over two years of said massive etcetera and that's why they've stopped even pretending to work with us, but, hey.

[kelly_chambliss]

My LJ/DW cross-posting hasn't worked for at least five years, maybe more. I just manually post my entries to both venues; it's quick and simple. So no real loss, for me at least. Thanks for trying to get it resolved, though! LJ is difficult to deal with, no question.

[aicqt]

Seems a bunch of people are a little confused about the process that's happening here and causing the issue so I thought I'd do a quick rundown:

DW user ilikecats:dreamwidth, please take this post and also send it to my livejournal account ireallylikecats. here are the keys (password and ljusername with permission to post to ireallylikecats) so livejournal will let you.
dreamwidth: sure thing, we'll go talk to livejournal and get that done.

dreamwidth: hi livejournal, DW user ilikecats would like you to post this post to ireallylikecats, here are the keys.

livejournal, to itself: dreamwidth, huh... we've been hearing a lot from dreamwidth. THESE keys are good, but we've had bad keys from dreamwidth. nope. we're not accepting any more posts from dreamwidth. dreamwidth is clearly bad news.


And then livejournal is not telling dreamwidth this (via an error or warning response to the initial request) and denying they can do anything to accept dreamwidth requests via manual comminucations.

this process doesn't involve the user ilikecats talking to livejournal, so the ilikecats' IP address is irrelevant, and it also doesn't involve the user ilikecats providing bad "keys" to their livejournal account to dreamwidth, though other people have.

[denise]

this is an excellent and succinct explanation of the problem, and I commend your ability to summarize so well!

[matrixmann]

Okay, that's a word on this issue.

The even more frustrating thing about it this time was: Crossposting didn't work and at the same time importing content from LJ didn't either.
I don't know if the two are connected with each other (someone else pointed me at it currently working some couple of hours ago, I tried it and, even with error messages of failing in between, some trial in the chain eventually makes it through and entries and comments are imported), at least I could see in LJ's login sessions list in my account over there that the content importer seemingly makes it to achieve a login in the system - which the Xposter doesn't at a time like this when crossposting fails without a notification about the failure.

Since the import feature encountered troubles not that long ago too (which feature suffered lesser from spam/hack blockouts on LJ over time), I better mention this. If it might be of any use.

[denise]

The problems are absolutely connected, in that when LiveJournal has blocked our site from accessing their servers, the block involves everything. The importer is more likely to catch one of the windows of Not Blocked because of how it schedules jobs, but even if a window of Not Blocked happens, it's not guaranteed the importer will catch it.

We are deeply sorry. We would love to fix it. Same problem as the crossposter: LiveJournal will not communicate with us, claims there's no way to whitelist us despite having been able to do so for the vast majority of our 13 years of existence, and has chosen to stop even acknowledging our attempts to communicate with them regarding problems when they happen. For bonus points, they also lie to any of our users who contact them and say it's our fault. I am deeply sorry that it appears our 13 years of being able to offer seamless data transfer between your LJ and DW accounts is over, and I deeply hope not over permanently but who knows, because we can no longer communicate rationally with LiveJournal and trust that the responses we receive (if we even receive them, which we generally don't) accurately reflect reality and will not change tomorrow.