XMPP Service Operators - 2020-12-15

Is jabber.de down? Or better said it's users and rooms

I have an issue with it too. ✏

Licaon_Kter: > Is jabber.de down? Or better said it's users and rooms They had an expired cert, bit that was fixed on the weekend. However, I had to restart my server to get s2s working to them again.

`curl -s -XPOST -H 'Content-Type: application/json' -d'{"target": "jabber.de"}' https://observe.jabber.network/api/v1/check/xmpp-server` > {"auth_info":{"dialback_offered":false,"sasl_mechanisms":[]},"certificate_expiration":null,"durations":{},"request_id":"lAbnNVS_525TocRS@MY.EXT.ER.NAL","su ccess":false,"total_duration":0.08641842752695084} ✏

`curl -s -XPOST -H 'Content-Type: application/json' -d'{"target": "jabber.de"}' https://observe.jabber.network/api/v1/check/xmpp-server` > {"auth_info":{"dialback_offered":false,"sasl_mechanisms":[]},"certificate_expiration":null,"durations":{},"request_id":"lAbnNVS_525TocRS@MY.EXT.ER.NAL","success":false,"total_duration":0.08641842752695084} ✏

That `null` in cert expiration is at fault?

That does seem wrong... looks almost like it didn't get as far as enabling TLS

That is the test for c2s ``` echo | openssl s_client -starttls xmpp -servername jabber.de -connect jabber.de:5222 2>/dev/null | openssl x509 -noout -dates -subject ``` Shows NotBefore: Dec 9 08:38 NotAfter: Mar 9 08:38 Can't check s2s, flicky line on mobile.

ernst.on.tour: clients can't connect either

Afaik

No cert problem as shown.

No errors in my server log either...but then again...no workie

Seems alive again.

Whats about "conference.jabber.de" ?

One of my messages to a MUC there just went through.

Hmm, maybe flicky line, but openssl-test against conference.jabber.de shows "no cert"

Licaon_Kter, MattJ, the prober requires valid certificates, so if it cannot negotiate TLS, it will fail without certificate info

Hai

jabber.de seems to be back again

ij: yup

Any news on what happened?

No, https://www.jabber.de/ lists not much information - yet

The admin was pretty busy in the prosody MUC.

Lessons learned?

Always test updates on another instance? ✏

Don't mix community modules in prosody core modules folder.

prosody-modules is a footgun

Wait wait....so was it a _known_ issue? :)

more of a case of a server which hasn’t been maintained in a while

judging from what I read over in prosody@

mimi89999, Hey, I will forgive you to report spam not to a group chat, but to the support service xmpp:support@404.city Account intercoracoid@404.city blocked. Additionally, I will forgive you to contact support Telegram , xmpp.jp , hack-jabb.ru , jabba.biz It is more effective to block return addresses for buying spam

404.city: Thank you

_forgive_

mimi89999, https://xmpp.jp , https://hack-jabb.ru , https://jabba.biz - these services should be included first in the list of spammers because they do not respond to complaints. Perhaps they receive money or some other benefit for favoring spammers. Telegram support service also ignores spam complaints

404.city, note that it’s hard to contact support@ when it doesn’t accept messages from strangers :)

jonas’, You mean subscription request for add contact or s2s problems?

Does telegra.ph have a contact address?

mimi89999, mailto:abuse@telegram.org

No. The page on which the message was posted.

404.city: subscription request required.

I already had success in getting xmpp.jp to block a list of bot accounts BTW

not sure about the other ones mentioned.

I actually wonder is it right that the jabber spam list is that small? I want to be prepared before I release...

https://github.com/JabberSPAM/blacklist

Anyway, unless they respond or we try to contact that address we won't know if it is blocked.

Arne, servers are only added to the list as a last resort - if the admin can't be contacted or does not take steps to reduce spam

It is not a list of every server that has ever sent spam (because most public servers would be on that list by now)

creep.im? The admin is here...

😅

not again...

sorry for that...

it's okay

Spam should be economically unprofitable, then it will stop. Blocking bots has no effect in the global fight against spam: 1) Captchas are required when adding to a subscription 2) mandatory subscription when for send first messenge 3) blocking addresses for buying spam mailings. All these measures taken at the same time will make spam economically disadvantageous. It is very easy to solve one captcha when creating an account. Solving a million captchas when sending subcrition is very difficult

I hope that those accounts will get blocked.

The ones for buying spam

you wish

404.city, https://craphound.com/spamsolutions.txt, I leave it up to you to find the correct places to [x]

Since the captcha on the servers is poorly done, I recommend everyone admins XMPP server to use a mandatory subscription. This significantly solves the problem with spam, because the spammer cannot send more subscriptions than the limit. This is an elementary defense that shows good effectiveness.

You mean mandatory subscription "fee"?

404.city: there is a limit to pending subscriptions?

how do you move an account then?

Asshats?

How blocking most spammers? Example for ejabberd: nano /etc/ejabberd/ejabberd.yml mod_block_strangers: drop: true allow_local_users: false allow_transports: true

404.city: mod_block_strangers is horrible

> 404.city: mod_block_strangers is horrible +1

how do you know which subscription requests are from bots and which are real people?

404.city: I only got a hold of you after telling you in here that I want to talk to you directly

Do servers advertise that module in disco info? Would be nice to have a module which activates mod_block_strangers only for mod_block_strangers servers. 😂

normal people will just give up and move to whatsapp

> 404.city: I only got a hold of you after telling you in here that I want to talk to you directly I also gave up on that module several times.

Ge0rG, Martin You will change your mind after the first case of flooding to your account.

Is this a threat? 😁

404.city, you will change your mind after (a) enough other operators failed to contact you for handling spam from *your* domain or (b) spammers learning to use subscription requests :)

Martin, no

> Ge0rG, Martin You will change your mind after the first case of flooding to your account. Also, this is why open servers should apply limits and/or monitor new users.

jonas’, The subscription module has a limit on the number of subscriptions sent and received. You cannot send many subscriptions from one account. Do you understand how this makes the lives of spammers worse?

to be honest, no

404.city: my JID is on some spammers' spam list, but I somehow manage to block all the spambots on the server level.

Ge0rG, The largest number of messages that I received on JID 10,000 from 500 jids per minute. Spammers love you if you handle your load manually.

2 party fo ejabberd.yml file: mod_pres_counter: count: 10 interval: 86400

404.city: If you can't send more subscriptions, you register a new account. Is there something I'm missing?

I wish you all successful spam with a speed of 10 messages per day!

But all servers must have such rules, and not one, then only this will work for real.

mod_block_strangers is best suited to block human strangers

Hence the name, otherwise it would be mod_block_spammers…

🤣

It's a module for introverts.

I would recommend disabling s2s then. :)

>mimi89999‎: 404.city: If you can't send more subscriptions, you register a new account. Is there something I'm missing? Enters captcha every 10 messages as efficiently as entering captcha every 1 message. Spammers have databases with millions of addresses, for 1 spam mailing they receive $ 100. I think very few people will agree to enter a million captchas for $ 100

did you consider that spammers are able to abuse other people into solving their captchas?

or that captchas are just broken in general.

spammers are solving captchas in IBR, despite there being enough servers with captcha-less IBR

so solving captchas must be roughly free.

Do you know the admin of hacker.im? I have worst thing that spam. Not sure if I can post that here.

It's the real and rare...

If you know what it is

>‎Ge0rG‎: mod_block_strangers is best suited to block human strangers Subscription was conceived as a tool to combat unwanted messages. There is such Afarism: Why invent bicycle if can use already been invented for us?

Also 1jabber.com

‎creep.im‎ Wow. Are you alive

404.city: Russian?

Are there any problems with jabber.de again?

Sometimes

Yup....Offtopic MUC is unreachable again...pfft

Where're we gonna go off-topic now?!

?

just deleted them from my list. offtopic? For offtopic there's still the Debian forum :D

Arne: the whole internet is an offtopic forum :)

well, as long as nobody on the internet knows that I’m a dog…

I thought the Disroot channel became the official off-topic channel for XMPP 😉

you mean the privacy and security one?