Have Questions - Will Award Reddit Gold/Premium For Good Answers reddit / irc ---------------------------------------------------------------------- needhelpwithirc · 2019-11-14 19:29 Hi, I’m brand new to IRC. I’ve done some digging and found that IRC is still a pretty cool way to find new communities and people. However, I’m a bit of a security paranoic and would like to affirm that I’m being as safe as possible. Certain things cannot be controlled such as 0-day exploits, etc. What I’m looking for here are best practices to mitigate unnecessary negative experiences. By “safe”, I do NOT mean secure from surveillance. I mean secure from anyone accessing my devices or home network in a nefarious way. For example: a rootkit or trojan that would give access to my devices and their stored information. I’ve searched many places for answers to my questions but couldn’t find any for some, found partial or outdated information for others, and just need extra confirmation for the rest. Maybe you all can help and earn some reddit gold in the process. Your time is valuable and I’ll be happy to compensate for it. FYI: I will be using mIRC on Windows 10 and Textual 7 on macOS. I **haven’t** downloaded them yet; I will be doing that as soon as I get the answers I need. Questions: #1. Do most people run IRC clients on their actual OS? What about a sandbox or virtual machine to run the IRC client? Or, do you all use online in-browser services like IRCCloud or KiwiIRC? #2. Are there certain settings that should be immediately tweaked on the above two (mIRC/Textual 7) IRC clients? #3. Is it possible to completely disable another user from “pinging” (don’t really know the actual term; is it WHOIS?) your device? I read somewhere that people can ping to figure out your OS, IRC client version, and even your IP address. I don’t care to hide this information from admins/staff on a server - just from regular users. #4. Is there a setting that **automatically** enables a SSL/TLS (secure) connection to whatever server you connect to so you don’t have to edit port number settings for each server? #5. Is it possible to **completely** **disable** Direct-Client to- Client (DCC) for **every** user and server you join? What I mean by this is if a user attempts to send you a file, their request is never even sent to your client. Also, is it possible to implement this in a way that other users will **not** be able to “ping” to check your DCC settings? I have read that people can use commands like these to see who can receive files from them or not. #6. Do most IRC clients allow you to **disable links** from being active? So if someone posts a link to a website, the URL still shows but is not clickable. Instead, it appears as plaintext and has to manually be copied and pasted in a browser. This is to protect from accidentally clicking on a malicious link. #7. On mIRC, there is an option to enter your “Real Name” and “Address.” I know it is unwise to actually enter valid data. But what is the purpose for these fields any way? Is this the data that other users can access when they ping you? #8. I am a bit confused about making accounts on IRC servers. For example, say you’re given this IRC server URL to connect to: Server: irc.testirc.com Port: 6667 You join with a temporary name, let’s say “TestAcc.” You end up enjoying the server’s community and wish to make an actual permanent account. You follow whatever process is in place to make the account - i.e. supply a valid email and password, etc. Then you get an email from the server staff with your password details and other account info. Great, but... now what? How would you join the server with your newly created account? Do you disconnect from the server so your temporary “TestAcc” is kicked and it automatically reconnect with your new permanent account? Or do you always initially connect on a temporary account and run some sort of command like this: - totally making this up here btw - /username “enter username” and /password “enter password” - each time to switch to your real account. #9. Is it possible to block any user from sending you ANY file? From EXEs to JPGs and anything in between, is there a way to ensure that nobody can send you anything? Is this the same thing as disabling DCC (Question #4 above)? #10. If a user wants to use your chosen username (username of the account you set up), they can use it for as long as they like until you log back on with your password, correct? Then they get kicked - is this right? If so, is there a way to stop anyone from using your name even when you’re disconnected aside from a bouncer/BNC service? How do users verify if a person is who they say they are? Isn’t there a significant risk if someone uses your name and fools other users by impersonating you? Or joins a server with your name and goes wild, getting your name banned? I’ve read certain server administration bots can actually kick/ban a user as soon as they join based on their name if it’s on a blacklist. So if a person causes mischief using your name, you won’t be able to connect to the server with that name the next time you log on. #11. Forgive me for being naive but will a VPN hide your IP/location information just as well as it does in the browser? Do IRC clients need certain settings changed for the traffic to route through VPN correctly? We’re assuming the following of course: reputable VPN, installed and configured well, and working as expected (no VPN server glitches/issues) #12. I read about “scripts.” Do these run on the server itself (meaning you can’t do anything about them - the second you join a server, if it has a script, it’ll run) or are these commands/code/files that a user needs to run on their own? If scripts are files, then by disabling DCC, you won’t have to worry about malicious scripts, right? No one can send you any files (including scripts) so you’re all good? #13. Anything else that I missed? What other settings do you tweak to ensure maximum privacy/security? Other IRC tips, tricks, or info? — Like I said earlier in the post and the title, I am more than happy to gift Reddit Gold to anyone who gives a good answer - the more people the better. Everyone has something to contribute - your responses might be the extra clarification I need. No copypastas, blatant repeats of existing comments (confirmation is good though!), or a few vague sentences. Please read the actual questions and put some effort if you want to be gifted. The deadline is ~ Sun, Nov 17, 2019. I **truly** appreciate any answers after that deadline but won’t be gilding/giving gold for them. Thank you in advance and I look forward to hearing from you all. In the mean time, I am going to continue doing some more research. ---------------------------------------------------------------------- stillfun · 2019-11-14 20:00 In general you will be quite safe if you avoid suspicious channels/networks. It is fine to run IRC client on your own computer. But since you are being paranoid, I would recommend using IRCCloud. You will be outsourcing all the drama/security to the them. When you learn more about the IRC, you will be more comfortable running your own clients. The price is not that bad and the service is superb. ---------------------------------------------------------------------- dorisfrench · 2019-11-14 20:07 Omg, just get irccloud.com to hide your IP for Christ's sake. ---------------------------------------------------------------------- [deleted] · 2019-11-14 20:21 [removed] ---------------------------------------------------------------------- yunocchi · 2019-11-14 20:29 Welcome to /r/irc! ​ **Do most people run IRC clients on their actual OS?** Many people do! Many people use desktop clients as their primary application as web clients (notably IRCCloud) consume more resources and could put a strain on machines running with fewer resources. I personally use a combination of IRCCloud for mobile devices, HexChat on Windows/Linux and Textual 7 on macOS. I've not used mIRC personally for some time however have few things to say negatively about it, other than the new licensing structure. Also, please note that neither Textual or mIRC are freeware, though Textual is open source and available on GitHub. ​ **Are there certain settings that should be immediately tweaked on the above two (mIRC/Textual 7) IRC clients?** In both clients, unless you plan on using DCC (either for chat or file transfers), I'd suggest starting there. It is a potential avenue for users to discover your real IP address. In Textual, I'd suggest disabling loading of images inline, as it is again a way for users to potentially discover your IP address. Plus, as is the nature of IRC, certain images shared might be unsafe for some eyes, if you know what I mean. Other than that, others might be able to chime in with their own suggestions, but everything else is relatively safe to remain default. ​ **Is it possible to completely disable another user from "pinging"** What you are referring to is CTCP. You can not disable "VERSION" in mIRC however can change other replies (such as PING) following the CTCP events guide on their site. In Textual, it is again not possible to disable CTCP VERSION. I use it infrequently enough that I'm not sure on the other events. Google is also not helpful in this instance. ​ **Is it possible to completely disable DCC** Thankfully, per the Lock dialog on mIRC you can disable most DCC functionality and a few other potentially annoying futures also. As for Textual, it definitely does support DCC but they don't seem to want to tell us how to disable it. You might want to drop by #textual on [irc.freenode.net](https://irc.freenode.net) and ask them. ​ **Do most IRC clients allow you to disable links from being active?** In my own client HexChat, the standard behavior is to warn before opening links. IRCCloud does not warn, and I'm fairly confident that Textual doesn't either. I'm unsure about mIRC. ​ **On mIRC, there is an option to enter your “Real Name” and “Address.”** Feel free to put whatever you want in there, but be aware that other users can see what you've provided. ​ **I am a bit confused about making accounts on IRC servers.** You can join an IRC network with any nickname you want so long as its available. If you want to make an account but would rather not use the name you chose when connecting, you can change to a different nickname with "/nick " (without the "<>) and then follow the appropriate instructions to register your name. You do not have to disconnect and reconnect with another name in order to register it. ​ **Is it possible to block any user from sending you ANY file?** Again, in mIRC it is possible to block sending/receiving files using the Lock dialog, but in Textual it is unfortunately unclear. I'd suggest paying their community on freenode a visit to inquire. ​ **If a user wants to use your chosen username (username of the account you set up), they can use it for as long as they like until you log back on with your password, correct? Then they get kicked - is this right?** In most cases, no. Our network (Snoonet) features a configurable enforcement policy that is per account. Users that happen to choose your nickname when connecting or changing nicknames are given so long to identify for that name before being forcefully changed to a configurable "guest" nickname. Many other networks also implement this also. ​ **Forgive me for being naive but will a VPN hide your IP/location information just as well as it does in the browser?** Don't worry about asking noob questions! If you're using a VPN such as then simply connecting using their software or through OpenVPN using their config files should do the trick. You may want to use the "Kill switch" feature, should it be available. This will prevent your client from reconnecting to the IRC network on VPN failure, exposing your real IP address. Perhaps a bit off the record here, but contrary to popular belief vanity hosts (commonly referred to as VHosts) do little to protect your privacy as services can go down, your account can go away, or unscrupulous users can find ways to get your IP address - which renders them ineffective. A VPN would give you that extra peace of mind. ​ **I read about “scripts.”** Many people customize their clients with scripts that can be configured to do different things, such as /WHOIS automatically when you join a channel, or other things (like /CTCP VERSION, a common thing used by network service bots to detect potential bad clients). Scripts are generally harmless, but if you plan on running them on your own machine, you should take care to understand what your script is doing to prevent malicious scripts from being run. To answer your first question, scripts that you run are ran on your local machine. ​ **Anything else that I missed?** Don't be afraid to ask more questions, especially if you are newer to IRC. People like myself understand that you're going to have questions. Most networks have a help channel where you can get answers to questions pertaining to their specific setup. Most clients also have an official channel where you can get help with features pertaining to the specific client that you're using. **edit:** Oops, forgot the mIRC Real name question! All better. ---------------------------------------------------------------------- needhelpwithirc · 2019-11-14 23:06 **1. For a new user, would you recommend running a desktop client from the get-go?** As long as I tweak the settings (like disabling DCC), don’t click any sketchy links, or run any scripts, I should be fine? I would prefer using a desktop client for the convenience rather than something like IRCCloud. **2. Do you run HexChat/Textual like normal programs on your PC or do you sandbox them/use in a virtual machine?** **3. I want to use IRCCloud on my mobile devices and mIRC/Textual on my Mac/PC.** Can I be logged into a server or network on multiple devices at the same time? If I use a BNC/bouncer on my Mac/PC to keep me logged in so I don’t miss any messages while I’m AFK, can I also chat on my servers with my phone via IRCCloud? **4. IRC networks and IRC servers are separate, correct?** Let’s use Discord and Freenode as examples. Basically, individual IRC servers are hosted on large IRC networks just like individual Discord channels are part of a big Discord server. Is this analogy correct? **5. It’s not possible to register an account on just a individual IRC server (like #textual)? You can only register on an IRC network?** So if I go to #textual and register an account and password with my email, that account and password is active for ANY server on Freenode, not just #textual? **6. Disabling in-line images is to stop my IP being grabbed via the old remote images trick, right?** People do this with emails where they embed an image that grabs your IP once you click on the email when your computer requests access to load the image. **7. You said it isn’t possible to disable CTCP Version in mIRC.** I found this under “Remote Commands” in the mIRC knowledgebase: https://www.mirc.com/help/html/index.html?mirc_commands.html Will the first command disable all CTCP Events including VERSION, PING, etc.? **8. Once you register an account on a network like Freenode, are those login credentials (username & password) valid for ANY server that is hosted on Freenode?** I can use them on #textual or any other community as long as its on the Freenode network? **9. What is the purpose of the “Nickname”, “Second Choice”, etc. in HexChat/mIRC settings?** Don’t you manually set your nickname once you connect to a server? Also, can you have different nicknames on different servers that are on the same network. For example: can you be “User1” on #textual and “TestAcc” on another Freenode server? **10. Do IRC clients store your login information for different servers once you register an account?** Say I register an account on Freenode, Snoonet, DALnet, and Rizon one night. The next day, I want to log back in and begin chatting on those networks. Will mIRC be able to automatically connect me to each of those networks and all of the servers on each network I was using the previous night automatically? Or do you need to manually run a command that enters your username and password on each network separately to connect? **11. Are IRC clients capable of remember different username/password combinations for different networks?** Can you register as “JohnDoe” on Freenode and “DoeJohn” on DALnet and have the client be able to login to both automatically? ​**12. Does a DCC connection bypass a VPN and expose your IP address as its a direct connection from your IRC client to another user’s client?** Or will a VPN keep you masked no matter what you do on IRC as long as its actively running? ​**13. Can someone remotely activate a malicious script on another person’s system/IRC client?** For example, say you accidentally join a malicious IRC server that has a few bad scripts and malicious users. The second you connect... *BOOM*, you’re infected with malware without even clicking on or accepting anything/any file? ​**14. Is every server on the same network given access to the same security measures?** For example, if #textual is hacked and someone begins kicking and banning members and staff, does that mean someone possibly exploited Freenode in some way? Or is each server’s security different, even if they’re on the same network? ---------------------------------------------------------------------- yunocchi · 2019-11-15 01:53 Always glad to help a new IRC user out! Let me know if you have any further questions. ​ **For a new user, would you recommend using a desktop client from the start?** Most certainly. I found that the best way to get acquainted with IRC is to experiment with a desktop client. I first used mIRC many years ago and have since used other clients such as HexChat, irssi, Weechat, Textual and AdiIRC, to name a few. I wouldn't discourage you from running scripts, so long as you're familiar with what they do! Some can be useful! ​ **Do you run HexChat/Textual like normal programs on your PC or do you sandbox them/use in a virtual machine?** I run them as normal applications on my Mac and PC. Of course, to each their own, if you'd prefer to sandbox the applications for security reasons! ​ **I want to use IRCCloud on my mobile devices and mIRC/Textual on my Mac/PC simultaneously.** If you use a BNC (either with a free provider or by hosting your own) then you can use any combination of clients and have them connected at the same time. Be aware that while IRCCloud is free for usage on two networks which exclude their own, a paid account is required to access password-protected servers, which is necessary to connect to a server running ZNC for example. ​ **IRC networks and IRC servers are separate, correct?** Yes, you are correct. "IRC network" is simply the name of the network in question. freenode is composed of several IRC servers, linked together to form the freenode IRC network. When you connect to their network with [irc.freenode.net](https://irc.freenode.net), you're actually connecting to one of their several servers. ​ **It's not possible to register an account on just an individual IRC server? You can only register on an IRC network?** Correct. When you're registering on freenode, you're registering to the network. Each time you reconnect, you may be connected to a different freenode server. As the #textual channel is located on freenode, you will be able to identify for your registered name regardless of which freenode server you happen to connect to. ​ **Disabling in-line images is to stop my IP being grabbed via the old remote images trick, right?** Correct. The trick is to host an image of a small size or any image on a personal server where the individual would have access to view the server logs, containing your IP address. ​ **You said it isn’t possible to disable CTCP VERSION in mIRC.** It is my understanding that you cannot disable the default VERSION reply as per their documentation, however this may have changed and the documentation may be out of date. The /remote \[on|off\] means that when off, any scripts that you have loaded will not work. ​ **Once you register an account on a network like Freenode, are those login credentials (username & password) valid for ANY server that is hosted on Freenode?** You are correct. Your account is tied to freenode itself and not to the specific channel. Some channels on freenode require that you have a registered account before you can join them. ​ **What is the purpose of the “Nickname”, “Second Choice”, etc. in HexChat/mIRC settings?** The "Nickname" in this case would be your primary choice. If you're planning to stick to one name on all networks, then your global nickname would be your permanent alias on IRC. Second choice would be an alternate nickname of your choice that you can use should your primary nickname not be available. This can occur if you've disconnected due to a latency-related (ping) timeout, or if there's a problem with your internet connection. On many IRC networks that allow account registration, you can register multiple nicknames to a single account. On freenode, you can do this with /msg NickServ GROUP, while identified to your primary nickname and while using your desired second nickname. If you need clarification on this, I'd be happy to provide. ​ **Do IRC clients store your login information for different servers once you register an account?** Credentials are not automatically stored on your client. You'll need to refer to your client documentation to set up automatic authentication when you connect to a specific network. On HexChat, it's as simple as loading the list of networks and editing the network in question. The authentication method is usually NickServ by default, however some networks support SASL (user+password) which is more secure. In your example, I know for sure that freenode and Snoonet support SASL, I'm unsure about Rizon and Dalnet. ​ **Are IRC clients capable of remember different username/password combinations for different networks?** Some are capable of this, HexChat specifically being one. When you edit the network in question, you have the option to "Use global user information" which means using your default nickname/second choice/username (ident) & real name (gecos). This will do what you want. If you use a bouncer such as ZNC, remember that nickname management would be done by ZNC itself, so the username you enter in your client would be irrelevant. ​ **Does a DCC connection bypass a VPN and expose your IP address as its a direct connection from your IRC client to another user’s client?** As far as I'm aware, when you're connecting to the internet while using a VPN, your real IP address wouldn't be exposed when connecting with another user using DCC. I personally do not use DCC at all. If you need to share a file with someone, there are many free services available like Google Drive or Dropbox that allow you to quickly upload a file and generate a link that you can share with other people. ​ **Can someone target another user and remotely activate a malicious script or run a bad executable on their system without the victim doing or accepting anything or any file?** Unless your IRC client of choice had a vulnerability that may allow remote code execution, you're safe. There was at one point a bug in mIRC that allowed remote users to crash your client by running the command "DCC SEND STARTKEYLOGGER 0 0 0". This has thankfully been long since fixed. Another was a rendering bug in which a certain character would cause specific clients running on either macOS or iOS to crash (sometimes becoming bricked), but this wasn't IRC specific (rather, it was specific to Apple products), but was widely exploited through IRC. That said, if you do happen to run a script of dubious origin designed to do something malicious in nature, that's on you. Unless the user was able to place the file on your machine in a location readable by your client and load it, you don't have to worry. ​ **Is every server on the same network given access to the same security measures?** I should hope so. In your example, this actually happened some time ago in #znc on freenode. The account password for one of their operators was compromised and the malicious user kicked everyone out of the channel. freenode itself was not compromised in this incident, but if a malicious user were able to find some exploit to gain access to freenode infrastructure, it is certainly possible for them to cause damage to the network. Please understand that not all networks are run the same, like freenode. More traditional IRC networks like Efnet and IRCnet have servers which are run by the community or by companies, which supply their own IRC operators/staff. They are linked together to form the particular IRC network, but specific servers may have different policies in place (such as no bots, no proxies, etc.) ---------------------------------------------------------------------- needhelpwithirc · 2019-11-15 03:18 Woah! You’ve answered all of those questions and even gave extra information. I’m truly grateful, friend! I just have a few questions left: **1. Can a paid IRCCloud account be used as a BNC that would allow a user to use multiple devices simultaneously to connect to a channel/network?** **2. What would happen if you DIDN’T use a BNC at all - if you simply jumped from one device to the next?** Say I’m connected to a Freenode channel on my Mac with a **registered** Freenode account. I leave my Mac (while still connected to the channel via Textual) and hop on over to my desktop PC and connect to that same Freenode channel via mIRC. I **never disconnect** from that same channel on my PC (or Mac). Later that day, I hop on my mobile device, load up my IRC app, and connect to that same Freenode channel again with the same Freenode account. I’m now on that same channel with the same account on three different devices at the **same time**. I know messages sent while disconnected or switching to another device wouldn’t be saved. But aside from that, would you still be able to connect like this? Will the messages people send in the channel appear on all three devices since they’re all technically connected, even though I’m only using one device at a time? Or, do you get kicked off your previous device when connecting from a new one without a BNC? **3. Does registering an account on a network only reserve the name but not the email or password?** Does each channel on that network need a separate email and password? Of course you can re-use the email and password (not advisable). Or is the entire account (nickname AND password) usable across the whole network? **4. A BNC is a type of ZNC, correct? What did you mean by a paid IRCCloud account being necessary to access a server running a ZNC?** ZNCs can run on entire servers? If a server is running its own ZNC, you can’t connect to it unless you’re also running a BNC/ZNC like IRCCloud? **5. The mIRC exploit you mentioned contained “DCC” and “Keylogger” in the command.** If a user disabled their IRC client’s DCC completely using Lock dialog, the exploit would have failed? Did the command install a keylogger too or just crash the client? **6. You said each time one reconnects to Freenode (or any network), they may get reconnected to ANOTHER channel than their last.** If I’m on #textual and my internet drops, I might randomly wind up in another channel other than #textual once the internet is back up? **7. Disconnecting from a channel vs disconnecting from an entire network are two separate things?** If I manually disconnect from #textual and Freenode one day, and then re-connect to Freenode the next day, will Freenode push me into a random channel or back in #textual? Since that was the last channel I was in before disconnecting? What happens if I disconnect from #textual and it’s the only channel on Freenode I was connected to at the time? Will Freenode go “*Woah! Looks like you closed every one of my channels. Guess you wanna leave me.*” and kick me from the entire network? Or will I be connected back to Freenode without being in any channels? **8. What is the correct way to shut down your all of your IRC commmunications so nobody can send you anything, PING you, etc? How do you go back to being in the state you were in BEFORE connecting to any channels or networks?** Do you first disconnect from the channel, then disconnect from the server, then shut down the IRC client? Like this: disconnect from #textual -> then disconnect from Freenode -> then Quit/Close Textual/mIRC itself? **9. I was told that when you do /nick “MyUsername” to log on as a specific registered account on a network, some IRC clients will throw a pop-up box for you to enter the password in.** Is this normal behavior? If my IRC client randomly opened up a chat box or a text field and asked for a password, I would be extremely alarmed. Also, I thought since you do /nick “MyUsername” to enter the nickname, then entering the password should be something like this: /nick “MyPassword” right? **10. Is it true that some malicious admins can crash your IRC client through sneaky script techniques?** Example: An admin who uses a script that forces you into a specific room or channel, then immediately kicks you, then forces you back in, then kicks you, and so on until your client freaks out and crashes from this abnormal behavior. Is this still unpatched? Can something be done to stop it from happening? **11. Can channel snoop through your private messages?** If I join #textual and send someone a PM, can the Admins and channel ops read that PM just because I used their channel to send it? Even if it was directly sent to that user and NOT sent anywhere in the channel itself? If so, how is one supposed to privately PM anyone? — You’ve given me a lot of interesting topics to research into. I’m gonna be up all night reading up on this stuff! :) Also, if you don’t mind, is it OK for me to send you a PM if I hit a research wall or need clarification on something? Thanks again and enjoy the gold! ---------------------------------------------------------------------- ProgVal · 2019-11-15 12:15 > If I join #textual and send someone a PM, can the Admins and ircops read that PM just because I used their channel to send it? Sending PMs is unrelated to joining the channel. The channel's ops cannot read your PMs at all, and admins (aka the people with technical access to the infrastructure) always can. It's the same way on Discord: "server" "admins" can't read your private messages (because they are more moderators than actual admins), but Discord's real admins (ie. the ones with technical access to the infrastructure) can. (I'm using quotes on "server" and "admin" because Discord gives these terms different meanings than other Internet services do) > If so, how is one supposed to privately PM anyone? Encryption, like OTR ---------------------------------------------------------------------- petacanblowme · 2019-11-15 14:34 > 3. Is it possible to completely disable another user from “pinging” (don’t really know the actual term; is it WHOIS?) your device? > >I read somewhere that people can ping to figure out your OS, IRC client version, and even your IP address. I don’t mean to hide this information from admins/staff on a server - just from regular users. No you can't stop them from pinging you. No you can't stop them from sending CTCP VERSION requests. No you absolutely cannot stop them from issuing a /WHOIS command. 1. All a "ping" is going to do is measure the time it takes for a packet to get from their computer to yours. I've been on IRC a long time. I've rarely seen this misused. At least in the last decade. If somebody is going to try to ping-flood you, they will do it from their operating system command line, not from the ping inside their IRC client. 2. If somebody sends you a VERSION request they can tell what client you're running, which to some extent will tell them your operating system. If you're really hellbent out of shape on this issue I recommend you find a script for your chosen client that will allow you to spoof the version requests. It's not hard to do, but it varies from client to client. 3. The /whois is potentially the most damaging of your three questions, but it depends on what network you connect to and it depends on what countermeasures you employ. In a "classic" IRC environment (like EFnet) a /whois can potentially show your internet address or IP. This *can* be a problem. But honestly I just haven't seen the malevolent activity in the last few years that I saw back in the days of the EFnet bot wars. Also because of the naming conventions that some internet providers use, this can be "somewhat" revealing of your location, but generally only narrowed down as far as a city. There are ways around this. Some networks mask some or all of the address segments in the /whois to protect user privacy and security. So the moral of this story is, if you're worried about this stuff (and really... unless you piss someone off you shouldn't be) just be choosy about what networks you connect to, and employ the services that your network offers to mask your identity. You can message me if you have specific questions about specific networks. ---------------------------------------------------------------------- [deleted] · 2019-11-16 00:27 [removed] ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:00 I didn’t know “manning up” meant not taking one’s security seriously. I guess that’s why identity theft, malware, and loss of privacy is on the rise. Thanks for your input though. I appreciate you taking the time to write an answer. ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:01 I’ve heard of IRCCloud but I wanted to see if there was any way I could stick to a desktop client with some settings tweaks. I’ll look into it the service though, thanks for the input! ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:01 I’ve heard of that service before; thanks for the advice! ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:03 Very insightful response. I’m less concerned with IP address disclosure and more about exploits or code that would allow someone to penetrate people’s home networks/devices. It seems like that kind of stuff is a rarity now. I read a lot of mIRC horror stories but they were years old. Something about a “$decode.” Thank you for your taking the time to share! I really appreciate it. ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:05 So an admin of the entire Freenode network can read PMs but not an ircop of a specific channel on Freenode? That makes sense - thanks for the clarification! ---------------------------------------------------------------------- petacanblowme · 2019-11-16 18:06 Any decent anti virus should stop that kind of stuff in its tracks. Any communities where this stuff still exists are likely closed door and not visible to the public anyway. And as I said before, network choice factors greatly. ---------------------------------------------------------------------- needhelpwithirc · 2019-11-16 18:11 Right. So the channels on a network reflect the kind of network it is? For example, malicious IRC channels and communties generally operate on specific bad networks that protect and host them? They usually wouldn’t be found on a network like Freenode, DALnet, EFnet, Snoonet, Rizon, etc.? ---------------------------------------------------------------------- ProgVal · 2019-11-17 05:10 you meant "an op of a specific channel", but yeah. "ircop" is mostly synonymous with "admin". ---------------------------------------------------------------------- ircgenius · 2019-11-17 10:50 Has OP lied about giving out Gold? I've seen people answering all the questions rightfully and yet... no gold to be seen. ---------------------------------------------------------------------- needhelpwithirc · 2019-11-17 20:30 Not at all, feel free to check. I was just waiting for the dead-line (near the bottom of the post) to pass before handing out gold (and silver) - it now has. Thanks for the concern though! ---------------------------------------------------------------------- needhelpwithirc · 2019-11-17 21:17 Thank you. Gifted silver for the quick clarification! ---------------------------------------------------------------------- Kirtaner-420chan · 2019-11-19 19:16 As to your first question, personally I use irssi on a remote Linux shell in a tmux session. My client stays online 24/7 and can be used from any device with an SSH terminal. ---------------------------------------------------------------------- IBNash · 2019-12-21 03:11 Security? Stop running Windows or an IRC client on Windows. I'd suggest running [weechat](https://weechat.org/) no a shell in the cloud or via Cygwin for Windows, it has many [relay clients](https://weechat.org/about/interfaces/) including Android and iOS. It allows you to (store) encrypt your password and other personal information on the machine it runs and has been developed for about 19 years now. For example, disabling DCC, see [https://weechat.org/files/doc/stable/ weechat\_faq.en.html#security](https://weechat.org/files/doc/stable/we echat_faq.en.html#security) Because it runs in a terminal, you could run a tiny VM in Google Free Tier or the smallest VM you want. If you run it inside tmux, you can connect to your cloud VM's tmux session and have an always on IRC client that isn't running on your machine/network. You won't need ZNC. It has a ton of scripts to do almost anything you can think of on IRC - [https://weechat.org/scripts/](https://weechat.org/scripts/) You can configure it to appear any which way you choose - [https://gis t.github.com/pascalpoitras/8406501](https://gist.github.com/pascalpoit ras/8406501) It's actively developed and more configurable than any IRC client with documentation to boot. tldr, Run IRC in the cloud and connect to it via SSH or use a commercial service like irccloud. Most IRC networks today will cloak your IP, if you don't want your cloud host IP shown. Get on IRC, it can be a wonderful place.