Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Marco Cirillo
Il 03/02/2014 20:57, Evgeny Khramtsov ha scritto: Mon, 03 Feb 2014 19:45:21 +0100 Marco Cirillo wrote: Long captcha - around 50%, mainly 70% of automated bot registrations E-Mail verification - Mainly 30%, This wards off the remaining bots which manage to OCR the captcha but can't deal with ve

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Alexander Holler
Am 03.02.2014 20:57, schrieb Evgeny Khramtsov: > We're thinking to switch to SMS-based verification for > jabber.ru: we have it currently and it works fine and is pretty cheap, > just need to disable email verification completely. Hmm, nice way to collect users phone numbers. I'm not sure if suc

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Evgeny Khramtsov
Mon, 03 Feb 2014 19:45:21 +0100 Marco Cirillo wrote: > Long captcha - around 50%, mainly 70% of automated bot registrations > E-Mail verification - Mainly 30%, This wards off the remaining bots > which manage to OCR the captcha but can't deal with verifying E-Mails. > DSA Filters + IP Throttling

Re: [Operators] XMPP bashing

2014-02-03 Thread Philipp Hancke
Am 03.02.2014 20:52, schrieb Alexander Holler: Am 03.02.2014 19:56, schrieb Daniel Pocock: The Debian stuff is still in the works, had a great discussion with Matthew and some other free software projects at FOSDEM. Do you've created a task force which comes to action whenever someone has the

Re: [Operators] XMPP bashing

2014-02-03 Thread Alexander Holler
Am 03.02.2014 19:56, schrieb Daniel Pocock: > The Debian stuff is still in the works, had a great discussion with > Matthew and some other free software projects at FOSDEM. Do you've created a task force which comes to action whenever someone has the impertinence to publicly critize (some issues

Re: [Operators] XMPP bashing

2014-02-03 Thread Daniel Pocock
On 03/02/14 19:09, Dave Cridland wrote: > On 3 Feb 2014 16:44, "Andreas Kuckartz" wrote: >> >> Claudiu Curcă: >>> 1. Why is that comment classified as "XMPP bashing"? >> >> As far as I know Daniel is mostly an SIP guy and is trying to _help_ the >> XMPP community by pointing to that comment. But

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Marco Cirillo
Il 03/02/2014 19:13, Kevin Smith ha scritto: On Mon, Feb 3, 2014 at 6:03 PM, Marco Cirillo wrote: Registration form with a long complex captcha + DEA filter + ip address based throttling, E-Mail verification + 1 Mail Address associated per XMPP account. Some of these (IP throttling, limit per

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Peter Saint-Andre
On 2/3/14, 11:03 AM, Marco Cirillo wrote: Il 03/02/2014 18:50, Peter Saint-Andre ha scritto: Truly I don't know what would really help. :( Peter Registration form with a long complex captcha + DEA filter + ip address based throttling, E-Mail verification + 1 Mail Address associated per XMPP

Re: [Operators] XMPP bashing

2014-02-03 Thread Dave Cridland
On 3 Feb 2014 16:44, "Andreas Kuckartz" wrote: > > Claudiu Curcă: > > 1. Why is that comment classified as "XMPP bashing"? > > As far as I know Daniel is mostly an SIP guy and is trying to _help_ the > XMPP community by pointing to that comment. But I also do not think that > the comment is "bashi

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Kevin Smith
On Mon, Feb 3, 2014 at 6:03 PM, Marco Cirillo wrote: > Registration form with a long complex captcha + DEA filter + ip address > based throttling, E-Mail verification + 1 Mail Address associated per XMPP > account. Some of these (IP throttling, limit per email address) help multiple registrations

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Marco Cirillo
Il 03/02/2014 18:50, Peter Saint-Andre ha scritto: Truly I don't know what would really help. :( Peter Registration form with a long complex captcha + DEA filter + ip address based throttling, E-Mail verification + 1 Mail Address associated per XMPP account. Wards off 99% of Spam Registra

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Peter Saint-Andre
On 2/3/14, 10:54 AM, Marco d'Itri wrote: On Feb 03, Peter Saint-Andre wrote: Good for you. Last year I had to close registrations to jabber.linux.it because there were more fake than real users. We really do need to figure out how to solve the problem of fake users. I think that the experien

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Marco d'Itri
On Feb 03, Peter Saint-Andre wrote: > >Good for you. Last year I had to close registrations to jabber.linux.it > >because there were more fake than real users. > We really do need to figure out how to solve the problem of fake users. I think that the experience of mail operators already tells us

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Peter Saint-Andre
On 2/3/14, 10:39 AM, David Banes wrote: On 3 Feb 2014, at 17:30, Peter Saint-Andre wrote: On 2/3/14, 9:50 AM, Marco d'Itri wrote: On Feb 03, Thomas Camaran wrote: i have over 30k users with prodosy in more one domain but not have this problem Good for you. Last year I had to close regist

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread David Banes
On 3 Feb 2014, at 17:30, Peter Saint-Andre wrote: > On 2/3/14, 9:50 AM, Marco d'Itri wrote: >> On Feb 03, Thomas Camaran wrote: >> >>> i have over 30k users with prodosy in more one domain but not have this >>> problem >> Good for you. Last year I had to close registrations to jabber.linux.it

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Peter Saint-Andre
On 2/3/14, 9:50 AM, Marco d'Itri wrote: On Feb 03, Thomas Camaran wrote: i have over 30k users with prodosy in more one domain but not have this problem Good for you. Last year I had to close registrations to jabber.linux.it because there were more fake than real users. We really do need to

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Marco d'Itri
On Feb 03, Thomas Camaran wrote: > i have over 30k users with prodosy in more one domain but not have this > problem Good for you. Last year I had to close registrations to jabber.linux.it because there were more fake than real users. -- ciao, Marco

Re: [Operators] XMPP bashing

2014-02-03 Thread Andreas Kuckartz
Claudiu Curcă: > 1. Why is that comment classified as "XMPP bashing"? As far as I know Daniel is mostly an SIP guy and is trying to _help_ the XMPP community by pointing to that comment. But I also do not think that the comment is "bashing" anything. > why is the comment interesting to the operat

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Moonchild
On 03/02/2014 17:04, Felix Eckhofer wrote: >> [...] > > Unfortunately I can't help you there but I would be interested what kind of > tools Openfire has to deal with that. Also, can the spammer not just use dummy > addresses from other popular servers? The messages have to come from *somewhere* :

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Felix Eckhofer
Hey. Am 03.02.2014 16:56, schrieb Moonchild: I was sure fellow operators would be familiar with the normal range of abuse an XMPP server sees, but maybe a few examples are in order: [...] Unfortunately I can't help you there but I would be interested what kind of tools Openfire has to deal w

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Thomas Camaran
Hi, i have over 30k users with prodosy in more one domain but not have this problem 2014-02-03 Moonchild : > On 03/02/2014 14:54, Simon Tennant wrote: > > If would help if you could describe the abusive behavior you are seeing. > > I was sure fellow operators would be familiar with the normal ra

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Moonchild
On 03/02/2014 14:54, Simon Tennant wrote: > If would help if you could describe the abusive behavior you are seeing. I was sure fellow operators would be familiar with the normal range of abuse an XMPP server sees, but maybe a few examples are in order: * Automated registrations by bots (in-band a

Re: [Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Simon Tennant
If would help if you could describe the abusive behavior you are seeing. On 3 February 2014 14:29, Moonchild wrote: > Hey folks, > > I've been running prosody for a little while now, and although I'm happy > with > the c2s/s2s security of the connections it makes, I'm running into a > different

[Operators] Prosody vs. spammers - security measures?

2014-02-03 Thread Moonchild
Hey folks, I've been running prosody for a little while now, and although I'm happy with the c2s/s2s security of the connections it makes, I'm running into a different security issue which is potentially a much larger problem. The problem is: spammers and otherwise abusive users. There is no easy

Re: [Operators] XMPP bashing

2014-02-03 Thread Claudiu Curcă
Two things I don't understand here... 1. Why is that comment classified as "XMPP bashing"? His arguments are valid (Skype, and I could personally think of a few more examples, as a *service* IS more user-friendly than any XMPP-based service, especially if you want more than text chatting). 2. While

[Operators] XMPP bashing

2014-02-03 Thread Daniel Pocock
Maybe somebody would like to reply to this: http://danielpocock.com/comment/11366#comment-11366