View Issue Details

IDProjectCategoryView StatusLast Update
0006163unrealircdpublic2022-09-26 14:50
Reporterairforcer Assigned Tosyzop  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionno change required 
Product Version6.0.4 
Summary0006163: +D does not prevent data leakage with /list and /whois
DescriptionChannel mode +D is supposed to hide quiet member list from non-operators. They are not visible in /names and the JOIN for them only appears as soon as they say something.

However, doing /list on the channel displays the real number of the members on it, and the channel is seen in /whois of its members.
Steps To Reproduce1. Create a channel, and set mode +D
2. Remove channel operator privileges from oneself
3. Join the channel with another nickname
4. Do /list on the channel (will say two members) and /whois on the second nickname (will list the channel)
TagsNo tags attached.
3rd party modules

Activities

syzop

2022-08-17 16:52

administrator   ~0022621

Last edited: 2022-08-17 16:52

+D is not meant to "hide users", it's only meant to hide unnecessary joins/parts/quits. So it is not meant for like.. hiding a secret.
That's why in HELPOP CHMODES the description is:
"D = Delay showing joins until someone actually speaks"
and in https://www.unrealircd.org/docs/Channel_Modes the description is:
"Delays someone's JOIN message until that person speaks. Chanops and higher, opers and ulines/services are exempt. "

It's mostly meant for busy channels to cut down on the noise, but the use case varies of course...

I heard some ircds even implement a /NAMES #channel -someoption to show users in +D channels (or however they call it).

Issue History

Date Modified Username Field Change
2022-08-17 16:35 airforcer New Issue
2022-08-17 16:52 syzop Note Added: 0022621
2022-08-17 16:52 syzop Note Edited: 0022621
2022-08-17 16:52 syzop Note Edited: 0022621
2022-09-26 14:50 syzop Assigned To => syzop
2022-09-26 14:50 syzop Status new => closed
2022-09-26 14:50 syzop Resolution open => no change required