Sharkey cannot receive or fetch a note that is `inReplyTo` another, inaccessible note

What happened? (Please give us a brief description of what happened.)

I sent a post from my NodeBB account to @jdp23@blahaj.zone, with strict visibility (to in activity and object contained only jdp23's actor uri). It was inReplyTo another post with the same visibility that Sharkey did not know about.

Sharkey did not process the post or notify jdp23.

However, if my post is inReplyTo a Sharkey post id, then the post is properly processed and jdp23 is notified.

What did you expect to happen? (Please give us a brief description of what you expected to happen.)

The post was accepted and jdp23 was notified.

Version (What version of Sharkey is your instance running? You can find this by clicking your instance's logo at the top left and then clicking instance information.)

Instance (What instance of Sharkey are you using?)

2024.8.2

What type of issue is this? (If this happens on your device and has to do with the user interface, it's client-side. If this happens on either with the API or the backend, or you got a server-side error in the client, it's server-side.)

Server-side

How do you deploy Sharkey on your server? (Server-side issues only)

N/A

What operating system are you using? (Server-side issues only)

Ubuntu

Relevant log output (Please copy and paste any relevant log output. You can find your log by inspecting the page, and going to the "console" tab. This will be automatically formatted into code, so no need for backticks.)

1. NodeBB receives a request for the inReplyTo object id.
2. NodeBB checks the HTTP signature to resolve the sending actor. The sending actor is the Sharkey instance actor
3. NodeBB rejects the request and sends an HTTP 400

Contribution Guidelines By submitting this issue, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have searched the issue tracker for similar issues, and this is not a duplicate.

---

The issue is that the instance actor is not allowed to request that object because that specific actor is not scoped to access it. I would recommend that one of the addressed recipients make the call to retrieve the object.

Secondly, Sharkey should still process the object even if it cannot resolve inReplyTo.

changed the description

added bugbackend label

This is a known problem that we somehow don't have an open issue for. For privacy, Sharkey (and all other Misskey forks) fetch unknown posts using the instance.actor account. This works for public posts, but breaks for followers-only / direct messages. It is possible to fix, but not trivially. Any "simple" fix would allow remote instances to de-anonymize local users, which is the same vulnerability that Mastodon has had for years.

I understand the desire for privacy, and your comment my discussions on fedi about it have confirmed that that is indeed the case.

Understanding that this isn't a trivial fix, I think there is still an issue with Sharkey dropping the received object if inReplyTo can't be retrieved. Even if it cannot link up the inReplyTo post, showing the received object standalone might be better for the end user.

Thanks for your time!

At some point we'll need to figure something out, yes.

I believe that we'll need to mark notes as "this one has a inReplyTo/quote, but we've not fetched it yet / we can't fetch it at all".

Other problems that would be solved by that: very long threads (replies/quotes over 100 deep).

oh, this is actually the combination of two different bugs. There's the one above, and also an architectural weakness that prevents Misskey/Sharkey from loading a reply if it can't load the parent note. Even if the reply is accessible, it can't be saved into the database without loaded the parent first. And if the user can't access the parent, then it can't be loaded and therefore neither can the reply.

changed title from {-Potential crash on limited visibility Create(N-}ote{-)-} to {+Sharkey cannot receive a note that is inReplyTo another, inaccessible n+}ote

changed title from Sharkey cannot receive a note that is inReplyTo another, inaccessible note to Sharkey cannot receive or fetch a note that is inReplyTo another, inaccessible note

mentioned in issue #745

added federation label