XMPP Service Operators - 2020-06-22

tom could you share your xmpp server address?

tom: i'd be interested in that as well

Are admins of jabber.cd or creep.im here?

mimi89999: hey there, I'm creep.im admin

a: I tried contacting you, but when I send try to subscribe, I get a message asking to fill a captcha. If I fill it and try to subscribe again, I get that message again. If I just try to send a message I get another error

Messages from strangers are rejected.

mimi89999: are you admin of jabjab.de? just guessing

No

okay

Private server.

anyway, captcha protection should be working fine, but apparently it does not work for everyone which is a bummer ✏

https://lebihan.pl/xmpp-upload/index.php/4e9729b9-3526-42fb-9f5b-553562744e46/russian_spam.txt

This is my issue.

can't download that

maybe share a link?

http://paste.debian.net/1153363/

a: Here you are.

ah, okay downloaded now

mimi89999: which software do you use for your server?

test

Prosody

got it, typical spam

Could you do something?

I do believe there is an anti-spam module for Prosody. did you check it?

I use similar module on creep.im

Did you block that account?

no, not yet. but the problem is that you can block account, but it's virtually impossible to block the spammer behind it

due to the open nature of the server

everyone can register account in a minute or so

so blocking on the origin server is possible, but frankly it's meaningless

Hmm. Did you consider trying to automatically detect them? If just after registering they send the same message to a dozen JIDs offering things, then probably it is a spammer?

no, I didn't write my own anti-spam module

also, your proposed solution does require looking into each message of each user

and I prefer not to do that

a: you might have to make a compromise there. As long as you keep the antispam detection in memory and never write out to nonvolatile storage you should bee good privacy wise. Parsing the body of messages is 75% of email heuristic spam detection

What you could probably do is have a DistributedClearingHouse type system where you fuzzyhash messages going through your server, and if someone is sending a lot of the same messages to people you can know without disclosing private contents

One of the mechanisms used for stopping spam with SMTP https://www.rhyolite.com/dcc/

Another thing you could try is if right after they join they start messaging +50 jids that's not something a human can do

Except if they were switching accounts, and noticing all of their former contacts.

that sounds like a nice project, but I'm not that fluent in Erlang and still have rather keep all messages private

I think that an installation of the already existing and working anti-spam module will work perfectly done in this case ✏

I think that an installation of the already existing and working anti-spam module will work perfectly fine in this case ✏

Schroedinger's chat has crasht