Misunderstanding about the ListenBrainz User-Agent contact requirements?

[FibreTTP]

The ListenBrainz client was updated in 0.17.0 to send the user's contact address in the User-Agent header:

multi-scrobbler/src/backend/common/vendor/ListenbrainzApiClient.ts

Line 71 in 8c69ae0

this.userAgent = `multi-scrobbler/${getRoot().items.version}${config.contact !== undefined ? ` (${config.contact})` : ''}`

However, the ListenBrainz docs quite clearly states that the contact address is supposed to be the application maintainer's contact address instead:

We require that all requests to the ListenBrainz API include a valid User-Agent header, with enough information for us (MetaBrainz) to contact the application maintainers.

The URL example they give supports this: MyMusicApp/1.0 ( https://mymusicapp.example.com/contact )

[FoxxMD]

I realize it says "application maintainers" but I believe the intention is that Listenbrainz can contact the entity making the requests in the event their request behavior is problematic.

---

If I put my own contact in their, or a placeholder to reach me like contact@multi-scrobbler.app consider this scenario:

• You, FibreTTP, have a flaky network connection that triggers a bug in MS that causes it to hammer request retries at the LZ servers
• LZ sees problematic behavior from your IP 123.456.78.101 with user agent multi-scrobbler/0.17.1 ( contact@multi-scrobbler.app )
• LZ contacts the UA email (me) saying "your app at IP 123... is spamming us with requests, please stop
• I respond saying "I don't know who that IP belongs to. I can try to fix the behavior in my code but I can't stop them from running the app"

You can't be contacted because all LZ has is your IP. The contact info does not help them track you down and resolve things amicably. Your buggy version keeps running, spamming their servers. They eventually block your IP.

Versus...

You put your contact info in the user agent: fibrettp@gmail.com

• You, FibreTTP, have a flaky network connection that triggers a bug in MS that causes it to hammer request retries at the LZ servers
• LZ sees problematic behavior from your IP 123.456.78.101 with user agent multi-scrobbler/0.17.1 ( fibbrettp@gmail.com )
• LZ contacts the UA email (you!) saying "your app at IP 123... is spamming us with requests, please stop
• You say "oops I didn't realize! Sorry. I'll turn it off, or try to rollback to a working version, for now."
• You file an issue with MS saying "LZ says I'm spamming them with retries". I can then try to isolate and fix the bug in MS.

You are contacted by LZ. You can mitigate the bad behavior until a fix is put out. LZ does not need to block your IP.

---

This is how I interpret what their intention is with the UA contact info. The "application maintainers" language is there because they are assuming the person running the application and the person who developed the application are the same person. That's not the case for self-hosted stuff like MS.

If instead every instance of a specific MS version was hammering LZ with request retries then LZ could block the application based on the start of the UA, EX multi-scrobbler/0.16.4, and then contact me (the developer) by googling for multi-scrobbler to let me know they are seeing systematic issues with this version. I could then release a fix in 0.16.5. LZ would continue to block 0.16.4 but not any other version, mitigating the issue for that problematic version for every user.

Maybe @MonkeyDo can chime in here and clarify what the intention should be.

[MonkeyDo]

Hi! I was just going to leave a message on the other thread regarding this.

The intention is for us to be able to contact you, the developer, rather than the person running the instance.

Basically, if we identify, for example that an application distributed to thousands of people is not respecting rate limits, we need to be able to ask the developer to make the changes to the source code and deploy a new version.
Usually these sort of issues are at scale rather than from individual instances, basically what you describe in your last paragraph. The contact is there so that we don't have to search for a developer to contact.

LZ contacts the UA email (me) saying "your app at IP 123... is spamming us with requests, please stop
I respond saying "I don't know who that IP belongs to. I can try to fix the behavior in my code but I can't stop them from running the app"

We would not be contacting you regarding a specific IP, but if we identify that all requests with user agent multi-scrobbler/a-bad-version are causing issues at scale, we would be contacting you to, say, review if the rate limiting code is functioning as intended, or whatever it might be, and help you test it and deploy a new version.
I will note that this rarely happens, as we do not enforce a lot of rules.

[FoxxMD]

Ah ok thanks for the clarification! Do you know if this is the same intention for the musicbrainz user agent? I'm currently having MS users do the same thing (personal email) for contact there.