0002218: spamfilter anti-mass-kill-ideas - UnrealIRCd Bug Tracker

ID	Project	Category	View Status	Date Submitted	Last Update

0002218	unreal	ircd	public	2004-12-04 12:38	2023-10-07 11:16

Reporter	syzop	Assigned To
Priority	normal	Severity	feature	Reproducibility	always
Status	feedback	Resolution	open

Summary	0002218: spamfilter anti-mass-kill-ideas
Description	I've had some thoughts on making spamfilter a bit less-destructive "at once".. like that you at least have some time to take action before everyone is dead. The ideas are: - a 'test' target that only notifies (actually, this kinda exists), this however conflicts with spying :[ - a 'activate delay' meaning the spamfilter will not be active for the first 30.. 60 seconds (configurable) but only NOTIFY first {this one I like most} - the usual if >XX% is affected, reject.. only useful for 'u' target, and I kinda hate it anyway, BUT we could add it and make it optional. {why do I hate it? well... because drones might take 80% of your userbase at some time and it sucks then if you cannot kill them, then again.. perhaps an override option?} blahh.. you get the idea ;)
Additional Information	Initial report by Rocko (only the >XX% affected = reject idea), later on the mail @ unreal-users, but also because I'm working on distributed spamfilter in which I would like to use the 'activate-delay' (which might be a few minutes for that) :p.
Tags	No tags attached.

3rd party modules

~~codemastr~~ 2004-12-04 12:43 reporter ~0008486	Well I've also decided to write a regex tutorial for Unreal. Hopefully, if more people are familiar with regexp, the errors will be reduced. Also, I'm going to talk with the TRE author about testing whether is regex is broad. What I mean is, we have the "matches everything" test, but we don't have a "matches everything except NULL" meaning .* is caught as bad, but .+ is not. IMHO if we could detect those kinds of regexps, it would also help.

syzop 2004-12-04 17:16 administrator ~0008491	Yeah, sounds good.. especially the docs, I think quite some people would be helped by that. I know.. there are plenty of regexes tutorials on the web, but putting it in unreal32docs will mean they will read it (much) sooner and... TRE specific-stuff of course :).

aquanight 2007-05-17 20:25 reporter ~0014158	(Cannot personally remember if the date on this (Dec 2004) was before or after /spamfilter action warn got added. Assuming before for this post, at least.) We do have action 'warn' now, and an 'activate delay' would be useful in some cases (for example, /spamfilter + pc gline\|30s (to say "start glining after 30 seconds") or something like that). What I wouldn't mind also seeing is basically support for 1-shot spamfilters. That is: instead of adding to the spamfilter list and leaving it, just do it like an atomic add + immediate remove (optionally, do so only locally). It'd only work for target u. It wouldn't be just for warn (eg, just find everyone on now that matches) - you could do it with kill/gline/etc for quick removal of things and you don't want the spamfilter to stay. Not block though. That doesn't make sense at all anymore than 1shot with message targets. Oh, and bump.

syzop 2019-04-14 11:19 administrator ~0020577	Recently brought up again by pegasus/the_myth regarding the 'u' target mostly. For 'u' spamfilters I thought we added the option 'test' which would just output the matched users and not actually add the thing, but it seems we never did. Anyway, the usual XX% match check idea from 2004 (and used by anope) is probably a better idea. And then, indeed, some bypass option.

Date Modified	Username	Field	Change
2004-12-04 12:38	syzop	New Issue
2004-12-04 12:43	~~codemastr~~	Note Added: 0008486
2004-12-04 17:16	syzop	Note Added: 0008491
2007-04-27 06:26	~~stskeeps~~	Status	new => feedback
2007-05-17 20:25	aquanight	Note Added: 0014158
2015-08-08 17:52	syzop	Severity	minor => feature
2019-04-14 11:15	syzop	Relationship added	has duplicate 0005236
2019-04-14 11:19	syzop	Note Added: 0020577
2023-10-07 11:16	syzop	View Status	private => public