Big spam wave
reddit / irc

----------------------------------------------------------------------
unfuckreddit · 2018-07-25 13:59

[removed]

----------------------------------------------------------------------
A-UNDERSCORE-D · 2018-07-25 14:05

Its a known thing, best way to block it is to make them unable to join
your channels, either by +i or +R (or equivalent). Id also suggest you
remove the spam from your message as spreading it does nothing to
help.

----------------------------------------------------------------------
webvictim · 2018-07-25 14:06

The best things to do are either just to ban unregistered clients from
joining, or enforce a delay on speaking after joining if your ircd
supports that. You can also set big channels to be +s (secret) so they
don't appear in the /list output.

----------------------------------------------------------------------
[deleted] · 2018-07-25 15:46

[removed]

----------------------------------------------------------------------
copenhagen_bram · 2018-07-26 00:50

i don't call trying to defame freenode people journalism

----------------------------------------------------------------------
TTEH3 · 2018-07-26 01:59

He's an /r/CringeAnarchy, WoW-playing virgin, I'd ignore him.

----------------------------------------------------------------------
MisplacedAlien · 2018-07-26 02:00

Is this what precipitated the requirement to register with the ebooks
channel?

----------------------------------------------------------------------
[deleted] · 2018-07-26 02:10

[removed]

----------------------------------------------------------------------
[deleted] · 2018-07-26 05:16

[deleted]

----------------------------------------------------------------------
White_Phoenix · 2018-07-26 05:17

+s is IMO the quickest way which doesn't require server-wide changes.

----------------------------------------------------------------------
copenhagen_bram · 2018-07-26 06:47

I think that link is fake, and you're the spammer. Fuck off with your
nonsense.

----------------------------------------------------------------------
inewsroom · 2018-07-26 07:42

Was also hitting Rizon big time today - we set our room to +s mode and
hasn't been a problem since.

----------------------------------------------------------------------
[deleted] · 2018-07-26 09:29

[removed]

----------------------------------------------------------------------
rindthirty · 2018-07-26 11:08

/list is useless anyway on most servers as it just floods real users
with a noisy output. There's almost no disadvantage to setting +s on a
channel.

----------------------------------------------------------------------
[deleted] · 2018-07-26 15:17

[deleted]

----------------------------------------------------------------------
Cowman_133 · 2018-07-26 17:31

Even if I accept the narrative that all the information being spread
is true, I could not give two fucks about freenode business on my
network.

If you have real evidence, call some cops.

----------------------------------------------------------------------
alright-ok · 2018-07-26 23:29

Just a quick question, but some of the spam came with what appeared to
be some kind of malicious js. It was in the form of <script src="site
with maliciousjs.js:malicious_port"></script> etc.

Is there any danger of this being executed in the .log files Hexchat
generates? I read [here](https://hexchat.github.io/news/hexchat-and-
antivirus.html) that Hexchat doesn't parse HTML or execute JavaScript,
but can this be done from the actual file itself?

I'm asking because the links in the .log files of channels they posted
it in triggered my AV.

----------------------------------------------------------------------
matthewt · 2018-07-27 01:50

https://mobile.twitter.com/shadowcat_mst/status/1020012864856383489
summarises the situation.

As for blocking it, I recommend regexp ignores on the URLs - or add a
+i or +r or similar. Sorry I don't have a better answer, I'm having no
fun here either.

----------------------------------------------------------------------
xCuri0 · 2018-07-27 05:15

It can't do anything but it can cause your anti virus to go insane
(Windows Defender found about 15 viruses) when it scans the log files

----------------------------------------------------------------------
samination · 2018-07-27 06:30

I can confirm that Windows Defender (Win10) does it for me too. But
yea, a log is just stored as plain text. Nothing should be executed,
as long as it's just an URL, and not actual malicious text

----------------------------------------------------------------------
ResidentChip4 · 2018-07-27 12:33

The same spam o my small network (less than 50 users)...

Using spamfilter on urealircd works fine, with gline as action. And
added a gline on \*@\*.bc.googleusercontent.com which was primary used
by the spammer.