Yes, thats because Hexbear is proxying the image from lemmy.zip, not serving it via hexbear.

We do the same at lemmy.zip, it’s good practice, but you are then interacting directly with lemmy.zip to get our images, hence why it breaks if you block lemmy.zip

One of the images from the OP that they were challenged on is: https://hexbear.net/api/v3/image_proxy?url=https%3A%2F%2Flemmy.zip%2Fpictrs%2Fimage%2F9925d030-56d3-464b-95bf-8f59dd591496.webp

ETA: If Hexbear wasn’t using the proxy, then the user would be served the image from hexbear itself and therefore our cloudflare challenge would never kick in, because the user would never visit lemmy.zip and it would all be handled server side, which isn’t happening in this case.

OP is likely using a VPN on which the ASN is part of our challenge rules following waves of scraping attacks from those ASNs.

Not only are those scrapes stealing our user’s data and ignoring the do not scrape instructions, they are so overwhelming as to have taken the site offline previously.

It’s not a misconfiguration, rather a deliberate challenge to prevent scrape activity reoccurring.

Federation works fine between hexbear and .zip and likely does for most users. This behaviour is happening because hexbear uses the image proxy (which is good) and so isn’t serving you the images directly, which is why the user is hitting up against .zips’ challenges.

We monitor the solve rate on the challenges to make sure we’re not catching too many real people in the challenges and effectively preventing the scrapes - as of right now, in the last 24 hours alone we’ve prevented almost 400,000 scrape connections with only 21 solves (i.e. real people). I fully appreciate its annoying, but we’re not running on a meta/twitter/Google budget over here! We have to take steps to protect the site as a whole.

If we weren’t doing this with cloudflare, we’d be doing the exact same thing with anubis or outright blocking those ASNs entirely.

@buckykat@hexbear.net FYI.

Definitely something was up, the server maxed out.

Seems similar behaviour to when someone imports their settings from another instance, which caused a lot of problems during the .ee migration, however I’ll see if I can find any other reasons for it.

Voyager, blorp has an android app too, there’s loads in the play store. I use the web view personally though

Hey, welcome! Blorp is under active development so might not yet be feature complete. The other UIs (“frontends”) are all quite established now. You can use photon (m.lemmy.zip) on desktop or mobile, and its fully feature complete.

I usually stick to Hot/All, generally a good turnover of posts for me :)

Hot is the most upvoted posts recently, active is the most comments. I believe scaled promotes smaller communities, but I don’t use it much personally.

I enjoyed the fuck out of the beta/demo thing, can’t wait for the release

Well, thats incredibly worrying. Thanks for the info.

Runs on one of these: https://www.hetzner.com/dedicated-rootserver/ax42/

Yeah its fine, by geoblocking the UK traffic we’re outside of the scope of the OSA. While it is admittedly an odd position to be in, there’s nothing inherently wrong with it.

Always knew I was a chatbot

Weve had Alice banned for like a year unfortunately, which is why you won’t see much/any activity, especially if that account is a mod in the community.

Nope, should be all good with HC, for example https://lemmy.zip/u/AINewsBot@hilariouschaos.com should show the latest posts for you

Us person here. Does that mean that donations are tax deductible?

We’re a UK-based non-profit company, not a US 501©(3) charity. That means donations aren’t tax deductible in the US.

There are apparently avenues, but we’re not at the stage of looking into that yet.

It’s not a paid feature (we don’t pay) - its their CSAM scanning tool. In this case, because we use the Lemmy proxy, it’s taken down everything pattern matching https://i.lemmy.zip/api/v3/image_proxy which is less than helpful.

Yes there is potentially the option to block country codes in Piefed. We haven’t fully utilised that yet but its on the todo list :)

Honestly, country is gripped by clowns.

Would not be at all surprised to find the commissioner has shares or a financial interest in Age Verification companies.

Giving adults free access to high quality porn in exchange for stopping children using VPNs would probably be fairly effective.

My response wasn’t regarding the geoblock, but to the above poster saying we block VPNs (which isn’t true)

But just so you’re aware, we dont geoblock federation traffic and all our posts, comments etc are federated without issue.

The only thing geoblocked is the UIs, so UK visitors can’t access the UI.

If your client tries to direct you to lemmy.zip rather than the crossposted article, then that client isn’t working properly and you should log a bug. Like any crosspost, the content federates fine.

Hope that clears it up for you.