XMPP Service Operators - 2024-04-22

> deimosBSD, experienced then. What software do you use? prosody? for family/friend servers, i switched to snikket because it was so much easier, otherwise ejabberd at work and probably for public/open registration ↺

!info 5222.de

there it is!

Looks like XEP-0157 works now :)

and I thought authbot no longer worked.. glad to be proven wrong.

Hi all, has anyone tried using Slidge? If so then how's the experience and how easy is it to maintain?

I'm considering hosting it, but I want to know about the drawbacks before doing so. ✏

is this jid known for abuse and such? -> brokenhunt@5222.de

was told its the person that did the invite spam earlier

Not known to me

MSavoritias (fae,ve): afaik he is a normal user. He had been messaging in some of my muc's.

Only annoyance is double posting across multiple muc's

what did they post

admin: set a proper nick pls, everyone is `admin` here

i am asking to see if there is pattern especially since they posted across group chats

Licaon_Kter: my bad, I'm normally here as 'Strix' but had to switch accounts due to the channel being moderated

> what did they post MSavoritias (fae,ve): something about sharing classified information to media outlets ↺

right. same here. i also learned that the invite spam in the morning was coming from that server

Polarian, no, having a proper abuse contact is good even if you are the only user. Consider that a service may be malfunctioning and being abused from the outside (common with services like DNS, for instance, less common with XMPP). It's good practice to have a human contact for things which do automated actions.

Wasn't xmpp av stuff being abused a while back?

Still ongoing?

referring to the reflection abuse on STUN servers?

Yes that

I have monitoring for that for my own STUN server, but since I changed its port, it's been mostly quiet.

I suspect that is kind of unavoidable as it's a flaw in the protocol

(and/or a feature, like with DNS)

jonas’: what kind of monitoring?

moparisthebest, the specific attack wave back then had patterns clearly distinguishable from legitimate traffic

I have nftables rules which count matching packets and I get emails when they increase significantly

(and I think I also have "more packets/second than usual" alerts for both STUN and DNS)

Are they in a shape you can share perhaps ?

yes, not publicly though

I'm still using iptables... Probably will have to rewrite everything one day :'(

f_, authbot was indeed broken for a long time, we brought it back a while ago when things got messier here.

nice