XMPP Service Operators - 2022-08-19

lurk.org seems to be down, both the xmpp server and the website

sup

> Who here operates this FXTIA bot which joined every room listed? Same question. Edit: PM it as MUC owner for info. It's cool ✏

Why don't you tell everyone why you joined every room (or at least a lot of rooms) listed, FXTIA? What's this bot for?

Hello Sheev Palpatine, I'm a bot. I'm here to watch for spam. I'm in every public MUC on the Jabber network. I can alert you about spammers before they arrive in your room. I can alert you when a known spammer joins your room. I can help moderate your room when its under attack. I also provide other services, like resolving URLs and extracting titles descriptions and even images. I also rewrite urls to use privacy frontends for urls pointing to youtube, wikipedia, odysee, reddit, twitter, etc. As this MUCs owner, you can use the 'Owner Config' command: *ocfg* ...

https://chat.her.st:5443/upload/805cad6b852b3640d60a17edd9d4a1cf8190e207/81pyFjszOnquGwjUFhsNttiiHhlsTfm1dbp5LDHt/1660912290.webp

so it is a bot? or is that something else?

its a bot

and consent? privacy policy? source code?

no, no, no

I'll blacklist it from my server

perhaps jabberspam needs a jabberunconsensualbox list added

FXTIA: could you limit your joins to only chats that you as a person follow?

Licaon_Kter, yes

Oops wrong account

That's the best account maybe...

https://social.tchncs.de/@trashserver > metalhead.club and trashserver.net will take a short break for maintenance. We'll be back in a few minutes.

how often do you all have your server set to automatically reboot?

Sapotaceae: automatically reboot, why?

what good are (kernel) updates if you don't load them?

I reboot whenever there is a kernel update or a debian point release. But I'm running a small private server. So if I had a public one with lots of users I'd probably try to minimize reboots.

croax, Sapotaceae: re: ntp pool remember when it was discovered that shodan was running a bunch of ntp servers to harvest ipv6 IPs to scan?

hadn't heard that

> its a bot Sheev Palpatine: Why would you make it join every room? It has no value to the muc. What value does have for you?

read my earlier responses please

https://chat.her.st:5443/upload/805cad6b852b3640d60a17edd9d4a1cf8190e207/rJiNFirhuhAUX7zq4GaDhYRtf0s1yJVt4Phffka6/1660938643.webp

this is the kind of shit i dont want to arrive in my mucs

moparisthebest: hehe... even meaningless protocol is sensible in the end. Run it in chrooted environment, bind an IPv6 temporary address :-) overkill

thats why its everywhere, so it detects the spam before it reaches me and whoever else gives the bot permissions to moderate

Sapotaceae, croax: https://weekly-geekly.imtqy.com/articles/276831/index.html

Sapotaceae: > what good are (kernel) updates if you don't load them? You right. That's my answer: on every kernel update I don't miss

Sapotaceae: > how often do you all have your server set to automatically reboot? How often do you update kernels?

I use fedora with updates-testing enabled for security flagged packages

kernel updates are within two days, and sometimes same day

as mainline

dnf is set to update automatically daily, with an automatic reboot if packages are installed

Sheev Palpatine, why would you trust a proprietary bot to see the JID of all your users?

i wouldnt

ok, understood. Another option would be setting muc to moderated.

Sheev Palpatine: your messages above sound like you defend this bot and/or owner, what's the deal, what's it to you?

i wrote it

its my bot

wait I thought you said it wasn't your bot?

?

you have 3 socks alone in this room then?

what?

I've tried as an owner to ocfgfukkkk no response, banned, f this $hit. You make me nostalgic after Morf, at least they are a human

morph inspired me to write this one

he raided us too

As said above, permission was neither asked nor given. Pls unjoin it at least from the rooms I happen to randomly moderate...

i have no command to unjoin, just ban it or pm me a list of mucs so i can turn off autojoin

I think you got it backwards, it should join the rooms it's invited in NOT ALL then get banned.

Here's a room list: `*`

also you didn't pm the bot, nor banned it, at least not in the last 5min xD

idk who you pmd and banned xD

this is starting to sound like malware

There's no PM in offtopic, how to interact then? See... you brought an untested bot and joined all the rooms? Wtf?

it works fine, i just tested it myself to make sure

you pm'd an imposter or the wrong user

if you're going to rudely join all rooms, you need to at the very least document it, provide a privacy policy, provide an explciit opt-out

it is bannable, you can opt out anytime

it has the same name everywhere

its not being sneaky

> also you didn't pm the bot, what is the bot? because you've already commented here about it from 3 accounts

it only joins *public* mucs that are listed on search.jabber.network

I was joking lol

Sheev Palpatine: > you pm'd an imposter or the wrong user Which part of "offtopic has no pm" was unclear?

How is that possible?

Sheev Palpatine: > it is bannable, you can opt out anytime When did you announce its entry on Offtopic exactly? To whom? Who did you announce here?

Aren't you a mod?

> offtopic has no pm

FXIA =\= I'm a bot pls ban me

[czar]: RTFM

I'm sure it has a ban

dude whenever someone mentions the bot i join the muc and talk to people

thats why im here

bot got tagged, i joined and started explaining

just ban it and be done with it

Licaon_Kter, this part of prosody is very poorly implemented

Why do you impose extra work on mods exactly? How is that NOT spam???

[czar]: ejabberd, ban is not the point, interactions "only via PMs" is

jesus christ

Don't get religious, c'mon

https://upload.magicbroccoli.de/cf0a30dd6843708ed8b63a0daf86ee4be7739546/rwa89fqRw684GNCMbQL2ze80N1ZIR3YuDEPSlAkv/obscura1660939359205.jpg

Is that you in the conv Sheev Palpatine ?

yes

Wrong answer lol

that deserves a bit more context though lol

How dare you mention someone ethnic group Sheev Palpatine

Unacceptable

https://chat.her.st:5443/upload/805cad6b852b3640d60a17edd9d4a1cf8190e207/cTGcBPgxiKOThmFjVR3JL9vf4eiUxxduE7jDCPww/1660940105.webp

Sheev Palpatine: you might come with good will, but just imagine everyone doing the same as you. There's a name, it's spam.

Join spam?

you guys honestly think im the only bot in your mucs or what

all the lurkers are surely real people!

i get the drama cause im honest lol

yes its a bot, yes its in every PUBLIC muc, yes it looks for spam

Critism/different opinion ≠ drama

the jabberspam repo has a shit solution for anti-spam, stopping federation with entire servers

i dont want to stop federating with servers cause theres spam bots

i rather ban the spam bots and offer that service to everyone

i thought it was a good thing to help fight spam

ass-backwards approach

all i get is shit from you

when i saw morph unleash havoc on mucs and realized there was nothing you can do, i decided to solve the problem

> yes its a bot, yes its in every PUBLIC muc, yes it looks for spam _That moment when you become that which you hated the most_

Did you collect enough feedback Sheev Palpatine? Was this the "disrupt" model from startups? Did you prefer to apologize later than ask permission? Is this mission accomplished? Does this make you fight spam harder? Are you gonna make your own federation with blackjack and hookers next?

Why are you saying joining public rooms is spam? I don't see the point Licaon_Kter

me neither

[czar]: it's the nature of the beast, you fight fire with fire, the whole forest burns

how is joining spam

We had a good run without spammy bots or Morfs. Thanks for nothing

The spam is fought because it drives real people away. Your solution was: _bring more bots_?

how the fk does it drive people away, its not saying anything

until proven otherwise I consider it spyware

its completely passive

> until proven otherwise I consider it spyware with that logic you have to consider every lurker spyware

> until proven otherwise I consider it spyware This was my first thought. Why does a person join? To see posts. Why does a bot join? To collect posts that later...its masters...can...

> and consent? privacy policy? source code? ?

Until Sheev Palpatine apologize or something for discriminative shitchat he frequently joins, I'll ban it anyway from every channel I can.

I've banned matrix bridges too, as this is a known thing that matrix.org collects all the chats. Hard to grasp? It's public but this doesn't give you or others extra rights.

And that is, because so far you have proofed to not be a person I can trust.

go ahead

> until proven otherwise I consider it spyware Better than saying it's spammy

This is not a contest...

Also Sheev Palpatine that avatar isn't really helping your cause

*sigh*

lmao

anyways, i've made my case, you make your judgement, im tired of this conversation, it leads nowhere

good night

I was hoping it leads you to unjoin the rooms where it was never invited. ✏

I have a captcha on all my rooms too and the FXTIA bot was in it

Very effective then

the bot cant solve captchas...

either you're blatantly lying now to stirl up more drama or you misconfigured your rooms

it is possible I manually approved it

i wasnt even aware that you can have captchas on rooms

> I was hoping it leads you to unjoin the rooms where it was never invited. i told you to give me the jids of the rooms so i can disable autojoin but you didnt want to do that

if you run an entire network, i can leave the entire network

wtf happened

sheev didnt make me lol

There is https://modules.prosody.im/mod_muc_rtbl.html To get the same without a bot approach ✏

> sheev didnt make me lol yes i did

put i another words ... I will invoke Eric Cartman's saying with a little Galactica's sensoship... Sheev Palpatine if u wanna frack us at least I wanna be wined and dinned 😉️ owner in cyberdelia's channels is mostly offline ... and as an administrator I tried several times to contact FXTIA and didnt get a response ... u should fix that so all moderator users can talk ✏

put i another words ... I will invoke Eric Cartman's saying with a little Galactica's sensoship... Sheev Palpatine if u wanna frack us at least I wanna be wined and dined 😉️ owner in cyberdelia's channels is mostly offline ... and as an administrator I tried several times to contact FXTIA and didnt get a response ... u should fix that so all moderator users can talk ✏

put in another words ... I will invoke Eric Cartman's saying with a little Galactica's sensoship... Sheev Palpatine if u wanna frack us at least I wanna be wined and dined 😉️ owner in cyberdelia's channels is mostly offline ... and as an administrator I tried several times to contact FXTIA and didnt get a response ... u should fix that so all moderator users can talk ✏

i'll make it respond to admins by tomorrow UTC

put in another words ... I will invoke Eric Cartman's saying with a little Galactica's sensoship... Sheev Palpatine if u wanna frack us at least I wanna be wined and dined first 😉️ owner in cyberdelia's channels is mostly offline ... and as an administrator I tried several times to contact FXTIA and didnt get a response ... u should fix that so all moderator users can talk ✏

do u have it published somewhere?

I prefere the module approach ... but u know ... if u are gonna sit a bot that will process our talks at least I wanna know that our users privacy is not compromised ✏

no, i just started it recently, i dont have a website or repo yet

Sheev Palpatine, FXTIA well ... bot banned ... let me know when u get it published and open

sure

if u wanna test it let me know too

well, ill just let you know when its published and you can chose to unban it then

i dont test in production xD

Is it an inconvenient time to share that this MUC is bridged to a public Matrix room? 🙁 https://matrix.to/#/#xmpp-operators:aria-net.org

With all history logged and all.

But yeah, we are fighting similar daemons over here and some of the ideas could be shared. And I also strongly favor FOSS & published code where bots can be deployed & hosted with a "single click" and then could federate some of the interesting metadata among each other for a limited time (i.e., to detect join waves and mass messages/images between different MUC).

lol.

I don't think that it's the way to go if a _single_ bot would need to join _every_ MUC in the world - it's neither sustainable, nor transparent enough.

I hate how everything ends up data harvesting by matrix nowdays

> I don't think that it's the way to go if a _single_ bot would need to join _every_ MUC in the world - it's neither sustainable, nor transparent enough. yes i can tell, its pretty heavy to run

federating the bot is on my todolist too, i haven't quite figured out how to exchange data between instances yet

XMPP is pretty good at that :D

there's multi-addressing stanzas which could work as a sort of broadcast between all the instances

but the problem would be how they even find eachother

maybe have the bot auto-accept friendrequests and then if you run your instance, you have to make it friend one that already runs and it will share all the other instances

By the way, although the Matrix room is publicly joinable, but at least it's not world readable. I.e., it won't appear on static.matrix.org or be indexable by search engines.

a poor mans DHT

I get the joke about federating over XMPP. And yes, indeed if the bots would need to exchange too much data, you would actually just duplicate the whole XMPP federation that wouldn't make much sense. Hence why they should only record (in memory) and exchange only filtered or key metadata about suspicious events, hashes and such.

i've been working on this bot for about 20 days, learning the xmpp protocol and reading through all the xep documentations...

a single instance was just all i could manage for now

@bkil:matrix.org: Or not doing anything without the consent of the people occuping these rooms. Opt in not opt out

spammers wont opt in

Maybe.

Same stuff happened in matrix with the traveler bot or whatever.

But people like surveillance there i guess

> Sheev Palpatine: > spammers wont opt in Thats not a reason for you to surveillance anything. Either its opt in or you are a spammer

well, in my country you need the consent of one person to *record* conversations

legally speaking

I think most people actually got used to the traveler bot, as it had published its source, had a website with info and it shared the stats that it collected. It was banned by only a few. But after the recent wars, similar traveler bots appeared with fake human names that only joined & left. They seem to be coming from China and Russia and it is much more creepy.

on the other hand in a public room you really don't have any expectation of privacy

and we're not even talking about recording here, its counting words and lines

> on the other hand in a public room you really don't have any expectation of privacy thank you, finally someone else saying it

That doesn't justify it

Expectation of privacy vs. GDPR is a complicated manner. You can't do OSINT to dox somebody regardless if you got it from archive.org.

it's still in rather poor taste, and if people ask you to leave it's the nice thing to do

a network owner asked me to and i did

network rules dont forbid what im doing

its just muc owners who get triggered left and right

the bot literally has a jid that says BOT@SERVICE

right, and if you wanted to be a jerk about it you'd just join each muc with a different name and likely no one would even notice

and they still give it voice and make it member

> right, and if you wanted to be a jerk about it you'd just join each muc with a different name and likely no one would even notice exactly

like Sapotaceae

Anyway, using the bot as a data collector and making it mod everywhere to execute its actions is conceptually equivalent to implementing an extension for each XMPP server that processes its own MUCs using similar heuristics, federates with other servers through XMPP (hopefully through a new XEP!) and then initiate the admin actions from the server side. But there are too many servers in a bunch of different languages to implement this for each of them. https://github.com/bkil/freedom-fighters/tree/master/hu/service/xmpp-server.md And in certain cases, the server operators aren't interested in enabling such patches. Hence why separation of server operations & moderation decisions might make sense. We are having the same dilemma about Mjolnir & co.

Why the conflicting information then? Fxtia messaged saying you didn't make it, and czar claimed/joked that they made it

the bot doesnt do anything until it is explicitly enabled by the muc owner

all it does it count lines and words and nick changes for repetitions

idk about czar

but the bot has a say command

Also how tf were muc admins supposed to activate any of those disabled features if it never announced itself?

It never said "hey I'm a bot pm me ocfg or whatever to activate me"

i have not made up my mind how to announceit

I'm just an outsider in the discussion, but all in all, I agree that the code must be published first, its heuristics must be discussed first and how it is operated and on which server. And only then should it be widely deployed. ✏

its barely over 2 weeks since i started writing it

So you just join rooms because???

i dont want to spam everyone

And then claim you don't test in prod

i test in my own mucs

We usually test our own bots in our own MUC created just for testing. Then perhaps one or two (small, but real) MUC might opt-in to test. But still not in production.

> @bkil:matrix.org: > I think most people actually got used to the traveler bot, as it had published its source, had a website with info and it shared the stats that it collected. It was banned by only a few. But after the recent wars, similar traveler bots appeared with fake human names that only joined & left. They seem to be coming from China and Russia and it is much more creepy. Of course people get used to surveliiance. Thats not news. Its still a shitty thing to do.

the bot is 100% passive outside the mucs where it was explicitly enabled

its just another lurker

but unlike lurkers, who have their client archive everything most likely

the bot counts shit

So then why join the rooms if you hadn't decided how to announce it?

load testing

see how it scales

Had any muc admin "activated it"

joining 100s of mucs has its own challenges man

processing all the data

i cant simulate that locally

until now there was only one trigger for it to message owners of mucs

when it detected spam in the room it would PM the owner

"hey it looks like you're under attack, i can help" [wall of text with config options]

https://www.ejabberd.im/benchmark/index.html

but i had to disable that because it kept spamming the muc owners XD

> https://www.ejabberd.im/benchmark/index.html oh shit thats useful, thanks

https://chat.her.st:5443/upload/805cad6b852b3640d60a17edd9d4a1cf8190e207/BaPAxrNgHnQNCYu5D004rqERKdINzKM7Y1eWqGQX/1660912290.webp

thats the wall of text

In a much smaller, closed community tied to a single CoC and registration, they still have a policy about bots, specifically identifying them as such, name the bot master, providing sources, providing help, option to kick (opt out), replying to a rollcall, and enumerating them on this wiki page https://tilde.chat/wiki/bots https://rfc.tildeverse.org/rfcs/2

interesting read

i actually wanted to include the !botlist stuff in the vcard but im having trouble getting the vcards to work

theres multiple xeps for vcards and none of them worked so far :D

If you think this talk is a bit off topic here, we welcome you in our existing Matrix room bridged over XMPP where we discuss just this - moderation automation ideas! mod-ideas@conference.movim.eu

sweet

52 people over the matrix side already.