Re: [Operators] Rosters flood

2011-06-20 Thread Tomasz Sterna
Dnia 2010-09-08, śro o godzinie 10:22 -0500, Jesse Thompson pisze: > 1. first identify/stop unrestricted servers > 2. then identify/stop bad servers > 3. then identify/stop bad users on good servers > 4. then identify/stop compromised users on good servers +1 We have abuse reporting XEPs.

Re: [Operators] Rosters flood

2011-06-20 Thread Tomasz Sterna
Dnia 2010-09-08, śro o godzinie 10:22 -0500, Jesse Thompson pisze: > Has anyone ever suggested the idea of clients and/or servers > implementing features to not deliver, or segregate, messages from > users > that aren't subscribed to each others presences? > > Maybe this is already implemented t

Re: [Operators] Rosters flood

2010-09-09 Thread Nicolas Vérité
So what's the summary of this discussion? Only the use of CAPTCHA at account/MUC creation? On Thu, Sep 9, 2010 at 13:58, Evgeniy Khramtsov wrote: > 07.09.2010 13:59, Evgeniy Khramtsov wrote: >> >> Recently our SPAM filter on jabber.ru detected massive flood targeted >> users rosters. Sample spam

Re: [Operators] Rosters flood

2010-09-09 Thread Evgeniy Khramtsov
07.09.2010 13:59, Evgeniy Khramtsov wrote: Recently our SPAM filter on jabber.ru detected massive flood targeted users rosters. Sample spam jids: 40tman_rullezz_1z2...@gornyak.net 40tman_rullezz_ezz0054...@highsecure.ru 40tman_rullezz_zum6...@jabber.zs1.wroc.pl 40tman_rullezz_m8m...@deshalbfrei

Re: [Operators] Rosters flood

2010-09-08 Thread Marco Cirillo
Il 08/09/2010 12:18, Evgeniy Khramtsov ha scritto: 08.09.2010 20:07, Arsimael wrote: I think the easiest and most effective way is a small Question: The Jabber Clients want to register a new Account. before the Server grants the new Account he opens a small textfile with 10 (or 20 or 10.000)

Re: [Operators] Rosters flood

2010-09-08 Thread Jesse Thompson
On 09/08/2010 11:29 AM, Evgeniy Khramtsov wrote: 09.09.2010 02:19, Jesse Thompson wrote: Do you mean that spammers could flood users with subscription requests? I suppose that would be difficult to deal with. Could it be solved with UI improvements? e.g., a queue listing of pending requests, as

Re: [Operators] Rosters flood

2010-09-08 Thread Evgeniy Khramtsov
09.09.2010 02:19, Jesse Thompson wrote: Do you mean that spammers could flood users with subscription requests? I suppose that would be difficult to deal with. Could it be solved with UI improvements? e.g., a queue listing of pending requests, as opposed to a pop-up for each request. Curre

Re: [Operators] Rosters flood

2010-09-08 Thread Jesse Thompson
On 09/08/2010 10:30 AM, Evgeniy Khramtsov wrote: 09.09.2010 01:22, Jesse Thompson пишет: Has anyone ever suggested the idea of clients and/or servers implementing features to not deliver, or segregate, messages from users that aren't subscribed to each others presences? There is a problem with

Re: [Operators] Rosters flood

2010-09-08 Thread Evgeniy Khramtsov
09.09.2010 01:37, Dave Cridland wrote: On Wed Sep 8 16:30:08 2010, Evgeniy Khramtsov wrote: 09.09.2010 01:22, Jesse Thompson пишет: Has anyone ever suggested the idea of clients and/or servers implementing features to not deliver, or segregate, messages from users that aren't subscribed to ea

Re: [Operators] Rosters flood

2010-09-08 Thread Dave Cridland
On Wed Sep 8 16:30:08 2010, Evgeniy Khramtsov wrote: 09.09.2010 01:22, Jesse Thompson пишет: Has anyone ever suggested the idea of clients and/or servers implementing features to not deliver, or segregate, messages from users that aren't subscribed to each others presences? There is a prob

Re: [Operators] Rosters flood

2010-09-08 Thread Evgeniy Khramtsov
09.09.2010 01:22, Jesse Thompson пишет: Has anyone ever suggested the idea of clients and/or servers implementing features to not deliver, or segregate, messages from users that aren't subscribed to each others presences? There is a problem with subscriptions: you cannot block them efficiently

Re: [Operators] Rosters flood

2010-09-08 Thread Jesse Thompson
On 09/07/2010 03:22 AM, Mathias Ertl wrote: I still think that _good_ anti-spam solutions now are vital to the XMPP community. The fact that XMPP has almost nothing to fight this, worries me greatly. In that respect XMPP is not superior to email at all Rather than re-hash the exact path that em

Re: [Operators] Rosters flood

2010-09-08 Thread Evgeniy Khramtsov
08.09.2010 20:07, Arsimael wrote: I think the easiest and most effective way is a small Question: The Jabber Clients want to register a new Account. before the Server grants the new Account he opens a small textfile with 10 (or 20 or 10.000) Questions and Answeres. He Picks andsom a Question a

Re: [Operators] Rosters flood

2010-09-08 Thread Arsimael
I think the easiest and most effective way is a small Question: The Jabber Clients want to register a new Account. before the Server grants the new Account he opens a small textfile with 10 (or 20 or 10.000) Questions and Answeres. He Picks andsom a Question and sends it to the client. Like "what

Re: [Operators] Rosters flood

2010-09-08 Thread Peter Viskup
I remember that we already discussed XMPP SPAM messages on the end of last year. Unfortunately I do not know what will be best procedure for these type of accounts/messages. My proposal was that we could implement something like SPAM-ratio for accounts as it was already discussed in 'How-to fight w

Re: [Operators] Rosters flood

2010-09-08 Thread Evgeniy Khramtsov
08.09.2010 17:47, Peter Viskup wrote: I configured restriction for account creation based on regexp and filter these account names. I think administrators of other affected jabber servers should follow this approach. {acl, jabber_sk_bad_users, {user_regexp, "^[40tman_rullez,ws_conference_jabber_

Re: [Operators] Rosters flood

2010-09-08 Thread Nikolaus Polak
that only DNS IN-A reachable servers are (by these two persons, and for now) targeted? regards, Nik - Ursprüngliche Mail - Von: "Peter Viskup" An: "XMPP Operators Group" Gesendet: Mittwoch, 8. September 2010 10:14:41 Betreff: Re: [Operators] Rosters flood

Re: [Operators] Rosters flood

2010-09-08 Thread Peter Viskup
Small correction in regexp: "^(40tman_rullez|ws_conference_jabber_ru)" and the name in access rule should be jabber_sk_bad_users of course. On Wed, Sep 8, 2010 at 9:47 AM, Peter Viskup wrote: > I configured restriction for account creation based on regexp and filter > these account names. > I th

Re: [Operators] Rosters flood

2010-09-08 Thread Peter Viskup
I configured restriction for account creation based on regexp and filter these account names. I think administrators of other affected jabber servers should follow this approach. {acl, jabber_sk_bad_users, {user_regexp, "^[40tman_rullez,ws_conference_jabber_ru]", "jabber.sk"}}. {access, register_j

Re: [Operators] Rosters flood

2010-09-07 Thread Evgeniy Khramtsov
08.09.2010 08:36, Peter Viskup wrote: I have evidence of these '40tman_rullez' accounts being created on jabber.sk server for last weeks. Most of connections of '40tman_rullez' accounts are made from IPs 188.168.78.102, 188.168.78.162, 81.177.33.11... But there are also others e.g.: ws_confere

Re: [Operators] Rosters flood

2010-09-07 Thread Peter Viskup
On 09/07/2010 05:59 AM, Evgeniy Khramtsov wrote: Recently our SPAM filter on jabber.ru detected massive flood targeted users rosters. Sample spam jids: 40tman_rullezz_1z2...@gornyak.net 40tman_rullezz_ezz0054...@highsecure.ru 40tman_rullezz_zum6...@jabber.zs1.wroc.pl 40tman_rullezz_m8m...@desha

Re: [Operators] Rosters flood

2010-09-07 Thread Yann Leboulanger
On 09/07/2010 07:23 PM, Evgeniy Khramtsov wrote: 08.09.2010 02:43, Yann Leboulanger wrote: On 09/07/2010 01:07 PM, Evgeniy Khramtsov wrote: I think in the first we all should disable in-band registration on our servers. I really think we need to block servers with in-band registration enabled o

Re: [Operators] Rosters flood

2010-09-07 Thread Evgeniy Khramtsov
08.09.2010 02:43, Yann Leboulanger wrote: On 09/07/2010 01:07 PM, Evgeniy Khramtsov wrote: I think in the first we all should disable in-band registration on our servers. I really think we need to block servers with in-band registration enabled on jabber.ru :( Regarding spam: in my case this is

Re: [Operators] Rosters flood

2010-09-07 Thread Yann Leboulanger
On 09/07/2010 01:07 PM, Evgeniy Khramtsov wrote: I think in the first we all should disable in-band registration on our servers. I really think we need to block servers with in-band registration enabled on jabber.ru :( Regarding spam: in my case this is not actually spam, but flood. So content fi

Re: [Operators] Rosters flood

2010-09-07 Thread Виктор Попов
We have the opportunity to defend ejabberd conferences captcha. I use it at conferences. 2010/9/7 Evgeniy Khramtsov : > 07.09.2010 18:22, Mathias Ertl wrote: >> >> I still think that _good_ anti-spam solutions now are vital to the XMPP >> community. The fact that XMPP has almost nothing to fight

Re: [Operators] Rosters flood

2010-09-07 Thread Evgeniy Khramtsov
07.09.2010 18:22, Mathias Ertl wrote: I still think that _good_ anti-spam solutions now are vital to the XMPP community. The fact that XMPP has almost nothing to fight this, worries me greatly. In that respect XMPP is not superior to email at all :-( greetings, Mati I think in the first we

Re: [Operators] Rosters flood

2010-09-07 Thread Evgeniy Khramtsov
07.09.2010 19:19, Виктор Попов wrote: Hi! Block means the whole network firewall IP registration. This is a spam bot I don't understand, what do you mean? Should I block the whole s2s? ;) -- Regards, Evgeniy Khramtsov, ProcessOne. xmpp:x...@jabber.ru.

Re: [Operators] Rosters flood

2010-09-07 Thread Виктор Попов
Hi! Block means the whole network firewall IP registration. This is a spam bot. 2010/9/7 Evgeniy Khramtsov : > Recently our SPAM filter on jabber.ru detected massive flood targeted users > rosters. Sample spam jids: > > 40tman_rullezz_1z2...@gornyak.net > 40tman_rullezz_ezz0054...@highsecure.ru

Re: [Operators] Rosters flood

2010-09-07 Thread Mathias Ertl
I still think that _good_ anti-spam solutions now are vital to the XMPP community. The fact that XMPP has almost nothing to fight this, worries me greatly. In that respect XMPP is not superior to email at all :-( greetings, Mati -- I only read plain text mail! I prefer pgp|gpg signed & encrypt

Re: [Operators] Rosters flood

2010-09-06 Thread Evgeniy Khramtsov
07.09.2010 16:45, Yann Leboulanger wrote: On 09/07/2010 05:59 AM, Evgeniy Khramtsov wrote: Recently our SPAM filter on jabber.ru detected massive flood targeted users rosters. Sample spam jids: 40tman_rullezz_1z2...@gornyak.net 40tman_rullezz_ezz0054...@highsecure.ru 40tman_rullezz_zum6...@jabb

Re: [Operators] Rosters flood

2010-09-06 Thread Yann Leboulanger
On 09/07/2010 05:59 AM, Evgeniy Khramtsov wrote: Recently our SPAM filter on jabber.ru detected massive flood targeted users rosters. Sample spam jids: 40tman_rullezz_1z2...@gornyak.net 40tman_rullezz_ezz0054...@highsecure.ru 40tman_rullezz_zum6...@jabber.zs1.wroc.pl 40tman_rullezz_m8m...@deshal

[Operators] Rosters flood

2010-09-06 Thread Evgeniy Khramtsov
Recently our SPAM filter on jabber.ru detected massive flood targeted users rosters. Sample spam jids: 40tman_rullezz_1z2...@gornyak.net 40tman_rullezz_ezz0054...@highsecure.ru 40tman_rullezz_zum6...@jabber.zs1.wroc.pl 40tman_rullezz_m8m...@deshalbfrei.org 40tman_rullezz_am...@jabber.ozerki.net