Forums Scripts & Popups Newbie channel security

Hi there,
I'm slowly building a new channel on IRC and I'm now starting to code security scripts for the room. The problem is being new I'm not too sure about the things I should be protecting against as I aint really seen them in action yet. eg. I know some people flood the room with a mass join, but are all the host names the same or do they somehow come in as 'different' hosts (if their the same you can trigger on that)? I'm just trying to get an idea of the things people try in order to be a pain, and any techniques you wish to share with me please?

Thank you in advance!


Ninko

They will try everything lol you might want to look at clanx protections

Hi Fantas,
Thank you for that link, that site is very useful!
Regarding my example question, from what the site is suggesting then, those that do a mass join do appear with the same host, is that always the case or are there ways they can get round that?

Thanks


Ninko

Technically there are ways of doing a mass join using multiple hosts, but it's not the simplest method, and correctly identifying a mass join that uses multiple hosts vs. a lot of people joining at once (such as after a net split) isn't simple either.
Generally speaking, it's unlikely that you'll actually encounter a situation where one person tries to do a mass join using multiple hosts.
I've been an IRCop on a couple of networks for a couple of years now, and, to the best of my recollection, I've only seen it happen once.

What it really comes down to for channel protection is having good ops that are there. If you have ops that have a variety of schedules (perhaps from different places in the world), who are in the channel as often as possible, you'll find they can take care of issues much more easily than any script. I've run channels for years and I really have almost no "security" problems. It will really depend on the network(s) you are on and the kind of channel you run. Some networks are full of spammers. Some aren't. Spammers also tend to focus on certain types of channels more than others.

If you just have some decent ops who monitor the channel and logs regularly, you can find the types of spam that occurs in your room and then you can set up protections against those kinds of spam. Otherwise, you end up having protections against a TON of things that you'll never see and possibly give your legitimate users problems.

For example, on one network, the only real spammers tend to join using a nick in the form of a female name followed by a number (supposedly the age, I guess). They will then spam porn stuff. It was easy to automatically ban such nicks and allow them an option to get around the ban if they are legitimate. That and a channel limit are the only things I use for protections in the channel as they are all that are needed. Since there aren't any other issues that every come up there, it's not worth the time or effort to throw in a ton of other protections that won't even be used.

Not to be disagreeable, but it happens with some frequency on some of the larger channels on undernet. Depending on who's mad at what channel you can see them anywhere from once a month to nearly daily.

The easiest way to handle mass joins like that is to set the channel to +m if the joins continue for more than 3-4 seconds. Netsplits all come back at once, so it is possible to see the difference, though it does take a fine touch at times.

It is logical to presume that this type of thing happens more often on larger channels and larger networks. This is part of the reason I prefer smaller networks, as when it does happen it's not as often, and is easier to detect.