XMPP Service Operators - 2021-02-04

tom: as mentioned in the mail yesterday you are the first reporting this issue. logs are now active to get some more information why exactly that happens. will let you know

Thanks perf

I saw your message

Hi guys, I'm new to this. I've just setup my own ejabberd xmpp server, everything is running great, will see how it all goes.

do you have in-band-registration enabled? If yes, spammers will appreciate that ;)

Andrew Hansen: Welcome!

Ge0rG: i habe it enabled. And i am controlling the situation well ;-)

Why do spammers use in-band registration? Why do spammers create lots and lots of accounts? What advantage does that give them?

I am not a spammer... so I need to ask. 🤣

e2e.ee: you need an account to send messages, not sure what's the confusing part

I guess if you look at it from a statistical point of view, it increases the yield of the operation.

Whether or not it's diminishing returns depends on how effective each bot is at its task.

But, the spammers can create accounts from the website, so why prefer in-band reg?

e2e.ee, you need to write a new parser for each new website

in-band is standardized

you only need to write a single thing which can do that

How many accounts do they typically create in-band?

50 lines in aioxmpp, done

a lot.

a lot.

but sometimes also not a lot

I hear

but tehn again, a lot, but not at the same time

"a lot" 😂 sounds funny. tens? hundreds? thousands? more?

if left unsupervised without throttling, yes, they will easily create thousands

Wow. That sucks.

Have a wonderful day everyone!

e2e.ee: You too!

Yeah, speaking from experience, you get multiple hundreds to ~1000 accounts per batch, using a wordlist alphabetically, spreading the registration over Tor / open proxies to circumvent per-IP limits

later they'll login, one after another, all from the same IP, and send a dozen spam messages to different JIDs each

Ge0rG: That is interesting.

Ge0rG: what happened to your yax vCard image? I don't see it today.

Dunno

Maybe there was a yak shaving accident.

https://e2e.ee/upload/SjGAto02yn_q_ls4/20210204_114110.jpg

oh indeed, it’s gone

Update the image to republish.

paint a mask on your yak while you’re at it ✏

that yak is from 1989, it's immune to global pandemics from the 2020s.

but is it a sterelising immunity?

Establishing a secure connection from lebihan.pl to national-security.agency failed. Certificate hash: 20ca7c29f7942173de8718a092cf0593f5ab445fe082a02a35801fd2770f6ac8. Error with certificate 0: certificate has expired.

Whoever that it

.

Ping

mimi89999: pong

Establishing a secure connection from lebihan.pl to national-security.agency failed. Certificate hash: 20ca7c29f7942173de8718a092cf0593f5ab445fe082a02a35801fd2770f6ac8. Error with certificate 0: certificate has expired.

national-security.agency 🤔️

On http they forward to https://www.nsa.gov/ 😁

Lol

Also ironic that mimi89999 can't establish a secure connection to the security agency.

They don't want no security for citizens.