XMPP Service Operators - 2020-08-30

> Is there a way to limit the number of messages per hour per user as spam prevention? Per hour limits require mod_firewall: https://modules.prosody.im/mod_firewall.html

MattJ: Please give your advise on an _anti-monologue firewall rule_ ... `%RATE monologue: 0.0083 (burst 1800)` `KIND: groupchat` `LIMIT: monolouge` `BOUNCE=policy-violation (Sending too much!)` Would this firewall definition check if a user writes more than 15 times per half hour to a MUC on that prosody server?

Typo in monologue kikuchiyo

kikuchiyo, KIND: message TYPE: groupchat

Are you trying to limit per MUC, or per user?

MattJ: per user per MUC

MattJ: The idea is to prevent single users from impolitely dominating public MUCs without getting answers from other participants.

Licaon_Kter: soliloquy?

kikuchiyo: ?

kikuchiyo: and do you want to apply this to your users or your MUCs?

MattJ: public MUCs

Ok, then you need to load mod_firewall explicitly on the MUC component, and add the firewall_scripts option under it too

MattJ: The longer I think about it, the more skeptical I am about whether the condition is the right approach. Actually, the point is that the share of individual users in the overall communication of a public room should not get out of hand.

Yeah

You would probably be better with something like an adapted mod_muc_limits

MattJ: Is it possible to base the action on several conditions?

How could I calculate the _share_ of an individual to use it as one of those conditions?

Easier to do in a module than in a firewall script

And do you want total share, or total within a given time period?

It's not easy :)

> total within a given time period? I think that would be the best way.

Maybe the easiest is probably something like "no more than N messages in a row from a single occupant"

Within a time period is tricky... after an hour of silence the first person to write would have a 100% share immediately

MattJ: Yes, I thought about that too, but then it would limit the possibility to run a news channel.

> Within a time period is tricky... after an hour of silence the first person to write would have a 100% share immediately There has to be a threshhold.

> Maybe the easiest is probably something like "no more than N messages in a row from a single occupant" If this rules counter would reset after an hour or so... It could fit the needs.

How about incremental delays (like brute force protection for passwords) ?

MattJ: `%RATE` values would have to depend on Nₜ messages per timeframe xor Nᵣ messages in a row for a single user.