jdev - 2023-09-26

imagine "permanently bricking your rooms" being a thing that exists in a protocol lol https://grapheneos.social/@GrapheneOS/111123792907620861

good to know we are ahead of the curve on moderation tooling too, and sadly not the only one that needs it

moparisthebest: there's actually a good blog post which summarizes the flaws in the matrix protocol, like the one mentioned in the toot, in a bit more detail: https://telegra.ph/why-not-matrix-08-07 ✏

> another fun way to attack a room is just to join hundreds or thousands of bots to the room ... > the only way to discard all of this spam complexity is to recreate the room. Sounds like effectively a way to brick rooms.

What xmpp Server would prevent 100.000 Bots Form joining a muc? ✏

Of course one could think of measures, but i doubt any Server has them now

most servers will probably just collapse ;)

lovetox, but it won't render the room useless forever

and countermeasures like not broadcasting presence do exist

(in some implementations anyway)

True we don't need to destroy a room to get rid of the problem

What I wanted to say is ddos measures could be better on most servers

sure

there is always room for improvement

lovetox, Prosody comes with mod_limits built-in, which would effectively prevent such an attack.

mod_limits prevents joins?

It prevents 100k joins at the same time, by preventing that s2s from delivering such traffic.

assuming they're all from the same domain

Link Mauve, actually, mod_limits may make things much worse in reality

a join request is just a few dozen bytes. the response to a join fans out to multiple s2s links typically, and typically more than once on each s2s link. mod_limits will thus cause a massive backlog of outbound stanzas eventually (assuming other servers also use mod_limits)

Application aware multipliers for response size?

> lovetox, but it won't render the room useless forever This is the point ↺

Plus no json and split brain problems. Matrix has said: > In future we can and will switch to a canonical binary format (eg the MIMI IETF work is rather quaintly fixated on using TLS Presentation Layer as a binary format).

Which mimi btw seems to adopt. Matrix is out of the picture it seems

good. let's create yet another standard. what could go wrong

Obligatory https://xkcd.com/927/

What.

> Obligatory https://xkcd.com/927/ xmpp is the universal messaging standard, with it's focus on gateways