Annyoing "security" policy

[zebedee]

If there were a way to prevent clients from joining our channel until they have been logged into a server for long enough to have been detected as a Tor, say 5 seconds or so, then my stalker would never gain entry to the channel.

Is this something I can implement on a channel level, or would it have to be implemented at server level?

Is there a cat in hells chance of anyone implementing it?

Something like this would have to be implemented at a server level and probably would be unlikely to be done globally given that since the service needs to check dnsbl's for every client connecting to the network(which at times can be quite a lot) and also some time would need to be allowed for lag between the different servers..while I'm not sure the exact amount of time that would be needed to reliably ensure that clients are checked before being able to join, it would likely be significantly more than 5 seconds and long enough to be annoying to the majority of users who are not on tors or other banned hosts.

I can't say I'm all that surprised to learn that what seems simple to me is in fact much more difficult than is obvious.

As for what you can do about them, there are a few options. First of all, if there is any pattern to the nicks or idents that this person uses, you could try setting bans based on those rather than the ip/host.

The nicks are machine generated random words. The only really consistent feature is his use of TORs.

However it occurs to me that if I can devise a script to detect the character string "G-lined (AUTO [1] DNSBL listed" and then set a key on the channel for a period of say half an hour to several hours, this would limit his intrusions to a single event in that period, whilst resetting the channel to open (no key) until he next appears. Anyone got any advice or hints on this task?

Second and probably far more effective, while undernet does not have nick registration, we do have username registrations along with channel mode +r to prevent unregistered users from joining the channel.

After the pain and fuss involved in rounding up enough of our people and getting them registered to re-register the channel when we managed to let it lapse a while ago, I can't see this working! Plus there is the problem of a large pool of occasional visitors we don't want to exclude.

You can also try emailing abuse@undernet.org with those logs(preferably with full whois info on this person as well) and see if they may be able to provide additional assistance.

I haven't got a whois for him, just lots and lots of them for anonymous relays he has used.

Finally, especially given that this person lives nearby and knows who you are, if they are continually stalking you like this, you might also try contacting their internet servicde provider(if known) or even your local law enforcement agency(particularly if they are making any threats against you or stalking in any ways other than merely joining your channel) and provide the same logs/whois information to them to find out if they can take further action based on that.

Actually, I've gone one better and I am cautiously hopeful it will be successful.
I have contacted his mother. Although he is in his 30s, he has never held a job and lives at home with his mother!

[SteveC]

And once again more than a month passed without any serious replies from the staff. No surprise users flee from Undernet.

It's kinda sad to see an old network die, but if the staff isn't interested in solving problems and adapting to user requests, then it's probably for the best that it vanishes and gets replaced by better networks like Freenode.


@xplora

Are you really serious with the "That then comes back to why doesn't undernet just hide all hosts" question? Can't you grasp the simple concept of grouping tor users together by giving them a common tag to identify them? Chanops can ban Comcast users, Verizon users, AT&T users and so on. It's just a logical conclusion to group tor users too, as if they come from the same carrier. Just like a bouncer or vpn host, which are always suggested here (and can hide your identity just as fine).

[Torman]

SteveC, as you can see, I started this thread almost a year ago without getting anywhere.

Undernet staff just refuses to make up their minds for a serious discussion. They claim Tor is a threat to its network with its just 2000 nodes, which is ridiculous, considering the amount of bots on it. And even if you provide a perfectly fine working solution which satisfies both sides with no drawbacks and shortcomings, it gets rejected.

It's been like that for who knows how long, and shows that the promised "changes" are not happening. Things got better once I stopped caring about trying to help and moved; I have by far less problems than on Undernet's "managed" network. It is sad, yes, but there's no other option.

[Irku]

congrats, Torman, for being way above this deprecated network

[dravine]

The Tor ban policy, while implemented with good intentions, unfortunately falls short of the mark. You ban inactive Tor exit points indefinitely and arbitrarily. I sometimes run a Tor exit node, but I tend to only do so in times of political upheaval around the world when the legitimate load on the Tor network increases. As a result of having been on occasion an exit node, my current IP is apparently banned indefinitely.

It's one thing to make a claim at improving the system, it's another thing to horribly and brutishly implement alleged fixes which actually serve to do nothing but hinder the delivery of services.

Undernet relies on ident, which 99% of the internet using public hasn't got a clue about, and as far as wikipedia is concerned "[...]Ident is next to ineffective when used with personal computers[...]" which is *shocker* most of the internet.

Ban Tor, but rely on hello that hasn't been pertinent since mainframes and dialup? WTF over?

[Torman]

The Tor ban policy, while implemented with good intentions, unfortunately falls short of the mark. You ban inactive Tor exit points indefinitely and arbitrarily. I sometimes run a Tor exit node, but I tend to only do so in times of political upheaval around the world when the legitimate load on the Tor network increases. As a result of having been on occasion an exit node, my current IP is apparently banned indefinitely.

It's one thing to make a claim at improving the system, it's another thing to horribly and brutishly implement alleged fixes which actually serve to do nothing but hinder the delivery of services.

Undernet relies on ident, which 99% of the internet using public hasn't got a clue about, and as far as wikipedia is concerned "[...]Ident is next to ineffective when used with personal computers[...]" which is *shocker* most of the internet.

Ban Tor, but rely on hello that hasn't been pertinent since mainframes and dialup? WTF over?

Another year passed, and nothing changed.

From what it seems, Undernet had to deal with an bigger attack in December. Looks like blocking all those evil evil Tor exit nodes didn't protect the network. Well who would have guessed?

Despite all official claims, Tor is not malicious and obviously attackers have by far better resources when they need to mess with Undernet.

Tor is a proven tool of free speech. When Iran tried to censor everything going outside, Tor helped users to get around it, enabling free speech again.

By blocking Tor, one sides with regimes like Iran, China and Syria who do the same "to protect its citizens". Funny how similar the reasons are.

[Ashur]

I go here to ask about tor problem and see this.
tor work fine weeks ago but now blocked again saying tor forbidden or infected.
my land censoring internet and tor is only way to go free online.
I chat here for week, now not possible

[Ashur]

why no reply why tor work and then blocked again?

[zebedee]

And 15 months later my stalker is still persisting... Any time we unlock the channel, he'll show up within about 5 to 10 minutes and then continue rejoining at short intervals as fast as the undernet detects his TOR status and kicks him out.

I for one would really appreciate an effective TOR exclusion which kept this pest out of the undernet altogether.

This is a really good example of a reason why it is a very good thing that TORs are banned from the undernet:

I am a long term user (since 1996) and the current manager of an undernet channel with a long history going back to at least 1995. I'm struggling with a stalker who lives nearby, who is known to me and who knows my identity, and who is stalking me on the undernet. This has been going on intermittently for several years and he has now started using tors to evade channel bans. He has previously successfully used this method to evade bans on freenode and has forced the abandonment of a channel there.

While the current pool of regulars in our channel is relatively small, we have an enormous pool of old members going right back to 1995 who drop by from time to time, who we do not want to lock out by setting a key.

Until recently, the tors he used were only very occasionally automatically G-lined by the undernet, but today the system seems to have suddenly become much more effective, detecting about 90% to 95% of my stalker's attempts at entry.

Unfortunately he succeeds in joining the channel before getting G-lined a couple of seconds later. This leads to an ongoing series of joins and G-lines at intervals of a few minutes as well as allowing him access, albeit very briefly, to the channel.

As you might imagine, just as he intends, this is really getting on my nerves and is seriously cheesing off other channel users too. As far as he is concerned, IRC is a public space, and anything he can find a way to do is acceptable behaviour. Not surprisingly, he describes himself as an anarchist too.


One more measure would pretty much eliminate this issue:

If there were a way to prevent clients from joining our channel until they have been logged into a server for long enough to have been detected as a Tor, say 5 seconds or so, then my stalker would never gain entry to the channel.

Is this something I can implement on a channel level, or would it have to be implemented at server level?

Is there a cat in hells chance of anyone implementing it?

You can get an idea of the scale of the problem from how frequently he joins our channel:

[21:55] * nephrodinic has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 212.74.233.43))
[21:57] * awardment has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 68.206.36.124))
[22:03] * overhonesty has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 75.30.97.142))
[22:11] * intercircle has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 128.233.94.137))
[22:16] * ventromyel has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 98.212.204.40))
[22:21] * freckleproof has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 80.79.125.131))
[22:22] * dogal has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 77.41.78.126))
[22:24] * shamefacedly has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 217.211.78.184))
[22:26] * executively has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 213.9.93.174))
[22:27] * reluctant has quit IRC (G-lined (AUTO [1] DNSBL listed. Check http://www.swiftbl.org/lookup for removal. Your IP is 83.227.30.29))
[22:29] * phaeophycean has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 76.5.40.10))
[22:29] * unspiced has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 31.163.103.161))
[22:33] * unwalkable has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 180.149.96.69))
[22:36] * Campodea has quit IRC (G-lined (AUTO [1] DNSBL listed.
TORs are forbidden on this network. Your IP is 98.113.149.36))
[22:37] * mandibulosus has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 82.183.140.104))
[22:37] * arthrocarcin has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 62.107.252.144))
[22:41] * unweddedly has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 94.50.106.109))
[22:58] * unhooper has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 87.18.45.7))

(channel key set from 22:58 to 00:02)

[00:38] * gastrula has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 173.0.52.171))
[01:03] * rhodizite has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 77.65.144.81))
[01:16] * phthisiogeni has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 83.233.187.231))
[01:27] * thyreoiditis has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 109.107.35.128))
[01:34] * rejecter has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 78.107.237.16))
[01:38] * inconsonantl has quit IRC (G-lined (AUTO [1] DNSBL listed. TORs are forbidden on this network. Your IP is 91.66.3.127))

(channel key set again at 01:38)

[xplora]

Asher,

1, because the people that could do anything about it won't because they have long since decided to block Tor, and do not support it in anyway.

2. because those same people do not read this forum.

As for all the other issues raised in this thread, I have already said my piece, and I support Undernet's decision to block Tor. I will not respond to people that refuse to accept my previous responses, and they have failed dismally to provide better reasons for Undernet to remove the block.

[SteveC]

Asher,

1, because the people that could do anything about it won't because they have long since decided to block Tor, and do not support it in anyway.

2. because those same people do not read this forum.

As for all the other issues raised in this thread, I have already said my piece, and I support Undernet's decision to block Tor. I will not respond to people that refuse to accept my previous responses, and they have failed dismally to provide better reasons for Undernet to remove the block.

What better reason than freedom of speech could there be? As shown by Asher's question, Undernet has successfully managed to silence the voice of someone who is suffering under a dictatorship. I don't think anybody could be proud of that. And that was just one who bothered to register and ask; nobody knows how many others share the same problem.

To 1. Perfect workarounds have been presented which satisfy both sides but they still refuse to even consider giving it a try. It's just not logical.
To 2. I think it's amazing, disappointing and depressing that officials do not show the slightest interest.

By the way, has anybody of those who is in charge here let the officials know about this issue? Or is this a "we decide, don't let us bother the gods" thing?

[xplora]

[url]http://it.slashdot.org/story/12/12/09/2315249/tor-network-used-to-command-skynet-botnet[/url]

Interesting... seems to me to be another black mark against TOR.

[zebedee]

There is a place for TORs, but the difficulty is that there are also lots of places where they are not appropriate and lots of people who use them inappropriately.

The undernet has not "successfully managed to silence the voice of someone who is suffering under a dictatorship." The management have elected to deny access to clients connecting via TORs to protect the integrity and utility of their own network.

That this also denies a handful of people with a legitimate need for anonymity access to the undernet is an unintended consequence, but the undernet does not exist to provide communications for political dissidents.

If you (the reader, not any particular poster) are sufficiently concerned about this, you might see fit to set up an alternative IRC network specifically intended for political dissidents and everyone else who you cannot distinguish from them, using TORs to access it. Expect to have problems with trouble makers.

Meanwhile my stalker continues to attempt to break into my channel or to cripple it by taking advantage of TORs and netsplits. You've no doubt heard of people who are bullied or abused becoming abusers or bullies when they are adults; this seems to be a classic case. He's got it into his head that I am a legitimate representation of everyone who has ever given him a hard time about anything and is determined to make sure I know it.

This has been going on for about 4 years now. I have no time for TORs on the undernet, they have no place here.

[SteveC]

[url]http://it.slashdot.org/story/12/12/09/2315249/tor-network-used-to-command-skynet-botnet[/url]

Interesting... seems to me to be another black mark against TOR.

http://www.save-our-kids.com/irc.html
Interesting... seems to me to be another black mark against IRC.

http://www.dailymail.co.uk/news/article-1223193/Culture-violence-Gun-crime-goes-89-decade.html
Interesting... seems to me to be another black mark against guns.

http://www.prweb.com/releases/2012/11/prweb10109138.htm
Interesting... seems to me to be another black mark against email.

http://www.thelocal.de/national/20090314-18025.html
Interesting... seems to me to be another black mark against fps games.

http://zerosecurity.org/security/paypal-phishing-scams-increase-for-holiday-season/
Interesting... seems to me to be another black mark against Paypal.

http://www.washingtonsblog.com/2011/10/yes-the-middle-eastern-wars-really-are-all-about-oil.html
Interesting... seems to me to be another black mark against oil.

http://www.prb.org/Articles/2006/RoadTrafficAccidentsIncreaseDramaticallyWorldwide.aspx
Interesting... seems to me to be another black mark against roads.

http://en.wikipedia.org/wiki/Adolf_Hitler
Interesting... seems to me to be another black mark against humans.

Dumb and narrow-minded argumentation? I thought so too.

The undernet has not "successfully managed to silence the voice of someone who is suffering under a dictatorship." The management have elected to deny access to clients connecting via TORs to protect the integrity and utility of their own network.

What if said dissident drops Tor and connects "normally?". People doing that get arrested, interrogated, jailed and even executed if caught by dictators in e.g. China, Iran, Syria and so on. Would you say that does not matter?

but the undernet does not exist to provide communications for political dissidents

A sad day for freedom

If you (the reader, not any particular poster) are sufficiently concerned about this, you might see fit to set up an alternative IRC network specifically intended for political dissidents and everyone else who you cannot distinguish from them, using TORs to access it. Expect to have problems with trouble makers.

Are you seriously suggesting that someone who is already having a hard time because he's fighting for freedom builds a complete IRC network because Undernet does not want to support him?

Meanwhile my stalker continues to attempt to break into my channel or to cripple it by taking advantage of TORs and netsplits.

Yet you support the global ban, even though it's rather useless to you and you keep being stalked.


What is so bad about letting a channel operator set a ban on *!*@tor and give them the freedom to decide, instead of treating everybody as a criminal/abuser? zebedee can ban them for his channel, while other ops are free to let them join their channels.
Again, I am just asking to cloak Tor users so chanops can decide if they want them banned or not.

[MrEen]

but the undernet does not exist to provide communications for political dissidents

A sad day for freedom

I don't know if that was meant as hyperbole or not, but it stopped me from reading back through the previous posts to get the gist of the thread.