dw_maintenance | (no subject)

We've received multiple reports of crossposting to LiveJournal silently failing, and many people have asked us about the problem. Unfortunately, the issue is not one that we can resolve: it happens when someone has automatic crossposting set up and has changed their LiveJournal password, but hasn't updated the password on their Dreamwidth crosspost settings. The number of failed logins trip LiveJournal's "attempted account hacking" detection system and our IP addresses are locked out from the site. This stops all Dreamwidth users from crossposting, whether or not their passwords are correct: we are entirely blocked from accessing LiveJournal at all.

For a decade or so, when this happened, we were able to contact them and have them remove us from the lockout list manually and whitelist our IP address range so that it wouldn't happen again. At some point in the last several years, they switched to telling us that the blocking is automatic, they aren't able to whitelist any IPs manually, and that we were mistaken when we were able to resolve the issue for a decade by emailing them and having them whitelist us manually; by this point, they no longer respond to us at all about the issue. (The delay in our posting about the issue has been, once again, us attempting to contact them unsuccessfully and getting no reply.)

Many users report to us that when they've contacted LiveJournal about the issue, LiveJournal has told them that the problem is on our end and that there are changes we can make to fix the problem. This is not true, and we aren't sure why they're telling you that. There is nothing we can do differently that will make them stop locking us out when people enter incorrect passwords for their crosspost accounts. At most, we could spend months making a massive, extensive, exhaustive effort rewriting the entire crosspost system, in exchange for an infinitesimal chance it would reduce the number of times this problem happens, not prevent it entirely. We aren't willing to spend six full months rewriting the crossposting system from scratch (and introducing all kinds of inevitable new bugs) to slightly lower the chance this problem will happen as frequently as it does, without assurances from LiveJournal that they are unwilling or unable to give us that such a rewrite would solve the issue entirely.

The only long-term, guaranteed fix for the issue is for LiveJournal to whitelist our IP addresses the way they were able to do for a decade and now claim to never have been able to do at all.

I know people are frustrated about the issue: so are we, and we're disappointed that the collegial relationship we enjoyed with LiveJournal for so long appears to have evaporated at some point in the last several years. However, at this point, we must advise you to treat crossposting to LiveJournal as an "as is" service that may or may not work at any given moment, depending entirely on LiveJournal's whims regarding blocking our ability to access the service due to people having entered their crossposting passwords wrong. If problems happen during the process of crossposting, there is nothing we can do to fix it, solve it, or hasten the site's removal from LiveJournal's access blocking system. All we can do is wait until the block expires, and they will neither tell us how long any given block will be active for nor a date/time when it will expire -- as I said, at this point they no longer respond to me when I email them about the issue, and haven't for quite some time.

If you have a crossposting account set up with LiveJournal as the crosspost destination, please check that the username and password are correct: the fewer people with incorrect passwords in their crossposting setup, the less likely this problem will be triggered. However, when it does happen, there is nothing we can do to solve it, and all you can do is wait it out. I'm very sorry. We're just as frustrated as you are.

ETA: I forgot to specify: yes, this includes the importer as well. The importer is more likely to catch a period of being unblocked because of how it functions asynchronously, but it's not a guarantee. If LiveJournal is currently blocking us, no function on Dreamwidth that requires communicating with LiveJournal will work, period.

UPDATE 1 Feb 2022 21:15 EDT: We have posted a further announcement: further investigation has made us realize there are several potential causes of the block other than the "password error" cause I explained in the post above. Until we're able to a) determine the cause of the block and b) determine whether there's any way we can work around it that will not cost us a significant amount of time and effort for potentially no reward, we have temporarily disabled crossposting to LiveJournal site-wide. We deeply regret needing to do this; however, it's clear that even if the situation is fixable, which it may not be, the resolution will take a significant amount of time. Until we have more information, it doesn't make sense for us to attempt crossposts we are aware have no chance of actually succeeding.

If you try to crosspost to LiveJournal, the process will automatically and immediately fail, and you'll receive a failure notice in your inbox directing you to this post. Please accept our utmost apologies for needing to take this step. We'll continue trying to identify the root cause of the difficulty and see if there is any fix we can make to re-enable crossposting that doesn't involve having to redesign the entire crosspost system from the ground up with no hopes of that even helping.

Flat | Top-Level Comments Only

Hey! I will cheerfully answer questions (to the best of my ability; I'm still a very inexperienced dev in the context of DW).

And as noted in some of my other commenting, we may be doing the Right Thing in a place I hadn't quite wrapped my head around. A codebase that's old enough to drink gets...weird around the edges sometimes. :)

Now I'm thinking of something like the anthropomorphic fic category in Yuletide: "Dreamwidth walks into a bar...."

Thanks for offering! Here's the thing I'm thinking about, which as I ask I can already see some of the problems with: why not have the user's browser send the crosspost request directly? So the IP is the user's?

And as I ask I am already thinking through some of the problems and answering my own questions, ha!

DW is very much an entirely server-side application. Running anything from direct client side API calls to third parties would requires some rewrites on fundamental and old parts of the code. So that's just a question of resources.
It's not like there's any of the modern toolsets in DW which are designed for this sort of direct-from-the-browser communication, and while generally I think the lack of React/Node is one of the things that makes DW so good and stable, it does mean that in this case any browser-origin communication would be writing something brand new.
The current crosspost architecture allows retries with exponential backoff, as I know D said upstream. Client side crosspost means that the user effectively gets one try, and it could get interrupted by any number of things.
Handling passwords securely becomes a mess, doesn't it? I don't remember if the LJ XMLRPC stuff requires any kind of API key, and on top of that the LJ password has to be something which can be passed back to the browser making a call. Very doable, but it's precisely the sort of security issue that even large paid teams often get wrong.

In order:

1/2) yeah, that's an entire paradigm shift, and would need someone who understands the current stuff well enough to make those changes. We have...not too many active developers right now, and even fewer who grok the codebase at a deep level.

3) I do not trust users to do exponential back off. Do you?

4) LJXMLRPC does not handle password security particularly well. Crossposting to a DW account (which is possible, by the by) is set up to use an API key instead of the password specifically because we are so limited by the existing architecture standard.

Yeah, chances are very good we could design something that would work for at least a little while (my brain went running down much the same line of thought as yours when I started thinking about it), but the level of effort it would require, with no guarantee it would work, means it's something I wouldn't be willing to put resources into without some kind of indication it would work. (As I'm sure you've noticed, time and energy is kind of a bit scarce around here this past year or so, and to the extent it's improving now, I'd rather it go to more local improvements, you know?)

It's looking like it's a moot point, anyway: it's very hard to get accurate information even with machine translation and my rudimentary Russian because they keep changing where they post to, but it's starting to look like, in addition to the usual "you have tripped our spam detection", LJ has simply shut off all third-party client access, period. Trying to confirm that, but if that's the case, it would never work again even if they didn't have a grudge.

A also told me he is pretty sure my pie-in-the sky idea would run into CORS problems unless we had cooperation from LJ, which is obviously a non-starter; I don't know enough about XMLRPC to be sure one way or t'other but he's probably right.

and to the extent it's improving now, I'd rather it go to more local improvements, you know?

Yes, this, this, this.

(In further evidence to me of my current rage obsessions, my first thought when I read your comment was "jesus people this is why NFT game artifacts you can bring in to unrelated games are a ridiculous grift pipedream, it's hard even to allocate resources to improve something somewhat related to an application like 'post to a linked outside resource' when you could be improving your own application instead, why on earth would any dev spend a ton of time enabling you to bring in something as broken in conception as an outside game's artifact???" Which I know is a stretch but apparently I'm obssessed rn, heh. But yeah, if there were still a big community of LJers who could be enticed by a crossposter it might be more worth banging heads into brick walls but there isn't.)

(I think we got most all of them that were going to move here already anyway)

YES THIS, like, I have BEEN trying to do interoperability for over a decade now, so these people not realize how HARD it is, heh.

And yeah. I know there are still people moving over from LJ and people trying to stay in touch with people who won't move, and I really wish we didn't have to make the cost/benefit calculations here -- but it's absolutely a diminishing returns thing at some point and I think we have probably hit that point. :/