Large IRC networks need to give up bloated, IP divulging IRCds. They are too stubbornly attached to legacy nonsense that drives people way. reddit / irc ---------------------------------------------------------------------- timeout400 · 2022-08-29 10:57 There is no excuse for publishing or leaking the IPs of users to other users. Nothing in any IRC specification \*requires\* publishing the IP of users to other users, or allowing users to access or aquire-by- special-tricks such info at any time. I confirmed this in the various IRC chats for IRC specifications. IP divulgence is a problem with the IRCds of large networks. There should not be any window between connection and services that allows user IPs to be accessed by other non-admins, even without SASL. This is trivial to implement at the IRCd level, and yet almost no one does. When you code an IRCd from scratch, it's actually \*easier\* to not let anyone access any IPs, as it takes extra coding to let users access such info in the first place. Who wants to join a chat network where everyone knows your IP and can hack it, DDOS it, track it at will? This only made sense in the early 90s when the net was a less rough-and-tumble place, and very few people were using it. Most people I talk to say they do not use IRC because they do not want to publish their IP to everyone, almost no chat services do that (I can only think of Omegle, and they likely only do such for technical reasons) If you are the maintainer or owner of a large IRC network, please consider moving to a more modern IRCd software, which does not allow the IP of users to be accessed by other non-admins at any point. There should not be huge disclaimers on IRC networks that your IP is not safe from other users, keeping it safe is trivial to implement. There is plenty of IRCd software that prevents non-admins from accessing other non-admins IP, and is free from hacks to get at the IP. ---------------------------------------------------------------------- indianapale · 2022-08-29 11:45 I don't disagree. I would.like to know the actual risk over anything else. You can be specifically targeted, I get that. As far as hacks for if you're vulnerable to script kiddies are going to find you anyway. I could see the DDOS being an issue if you puss someone off. I'd like to hear comments about the actual risks, how unique it is to just IRC (if you're not properly protected you'd have a bad time regardless, and any mitigation for the actual risks. ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 11:49 hostmasks? ---------------------------------------------------------------------- timeout400 · 2022-08-29 11:59 Slack and discord aren't great but try getting an IP of a user from there via the tech itself (ie not links). you can't. This is done for a reason, so that yea, you cannot get targeted illegally by users or tracked by whoever the fuck wants to. Nothing in IRC specs makes it easier for people to get IPs, than the tech of slack or discord. It's entirely the fault of shitty networks and shitty IRCDs that lets people grab IPs. They have every reason to say it's a feature when they are just too lazy to fix it. ---------------------------------------------------------------------- timeout400 · 2022-08-29 12:01 It actually requires (some) effort to code an IRCd that divulges IPs to users in the first place. The term "hostmask" implies that the specification by default leaks the IPs. It does not. I'm aware some networks use that term and "+H", but this is just an (exploitable) hack instead of not letting the IPs be accessed by any non-admin in the first place. An example of how to exploit the joke "masking" approach is grabbing the IP btw connect and when services kick in, for people not using SASL. Or taking advantage of IP range bans, which also should not be a thing for non-sysops. More modern, better, IRCds separate users by UUIDs or hashed IPs. And not at the service level, from connection. Heck, you could even separate users just by their index in an array of historical users. Public separation by publicly published or publicly accessible IP is the least possible user-security-respecting method of user separation. ---------------------------------------------------------------------- AdvertisingLevel · 2022-08-29 12:22 "I acknowledge you can be hacked, tracked and DDOSd, but what are the actual risks?" bro what ---------------------------------------------------------------------- indianapale · 2022-08-29 13:04 I'm not arguing to keeping them there. Just curious how worried I should be. I have a VPS that's only used to run znc and irssi so I'm not incredibly worried about attacks because I can just nuke it if I want. ---------------------------------------------------------------------- indianapale · 2022-08-29 13:05 All of this can happen anyway. And if you're network isn't secured it's definitely going to happen from people running scripts on the open internet. So besides that, and besides someone specifically targeting you, what are the other risks? ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 13:12 if u host znc on a separate network you don't need to worry ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 13:14 ive been on hacking related ircs for over 20 years and never been 'targeted' most of the irc servers use host masks that hide your ip edit: its easy to grab someones ip regardless ---------------------------------------------------------------------- princessdeathray · 2022-08-29 13:41 All the people coming here to defend lazy IRCd developers, would you also want your IP published on every forum and twitter post you make? Only reason IP's aren't effectively shielded is legacy code in IRCds from old networks that massively hamper IRCs adoption It's not IRCs fault that this issue exists as OP said, just the fault of the developers for legacy networks. And no, hostmasks at the NickServ level are not an effective solution. Just continues to move the burden to the user. There should be absolutely no way or hack to get at the IP. ---------------------------------------------------------------------- princessdeathray · 2022-08-29 13:43 "its easy to grab someones ip regardless" not if the ratbox software developers and the like stopped letting users grab IPs in the first place Also why are you touting NickServ level masks when you yourself they are inneffective most of the time? ---------------------------------------------------------------------- princessdeathray · 2022-08-29 13:48 "because it's never happened to me" is a piss poor reason to defend bad code ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 13:48 they are effective grabbing someones ip doesnt involve irc ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 13:50 25+ y/o code that is still used by millions doesn't constitute bad code ... its just part of the protocol ... you do know what ip addresses are used for? ---------------------------------------------------------------------- AdvertisingLevel · 2022-08-29 13:51 No, there is no way for a fellow \*IRC\* user to get at your IP sans links if the software is a modern IRCd that hashes IPs or implements UUIDs from connect or something similar ---------------------------------------------------------------------- AdvertisingLevel · 2022-08-29 13:53 It's not part of the protocol to require any way for users to know the IPs of other users, by any method. Ask in any of the IRC spec channels, they'll all tell you the same thing, that it's an IRCd issue, not a protocol issue. ---------------------------------------------------------------------- justjanne · 2022-08-29 14:03 Isn't that wrong? If you enter a voice or video chat with a user in any modern chat app that's going P2P and giving them your IP. ---------------------------------------------------------------------- indianapale · 2022-08-29 14:08 Cool thanks. Pretty much why I got one. They can be had for under $10 a year so I figured why not. ---------------------------------------------------------------------- indianapale · 2022-08-29 14:23 I don't see a lot of people defending "lazy IRCd developers". For my part I was just asking what the actual risks are that aren't already present being connected to the internet. ---------------------------------------------------------------------- AdvertisingLevel · 2022-08-29 14:59 pls explain how to get someone's IP from discord voice or video chat ---------------------------------------------------------------------- taofullstack · 2022-08-29 15:33 I've actually setup quite a few ircds going back 10-15+ years, and at least for unrealircd and inspircd, you do have to setup and configure a "services" system like Anope and configure it to have masked hosts. Right out of the box they definitely do show full IPs of each user. ---------------------------------------------------------------------- caffeinedrinker · 2022-08-29 16:12 i didnt say it was ---------------------------------------------------------------------- Paradox · 2022-08-29 16:16 There's a reason we set the umode that hid IPs on snoonet from very early on ---------------------------------------------------------------------- TingPing2 · 2022-08-29 16:49 That only obfuscates it, the information is still exposed by services. ---------------------------------------------------------------------- TingPing2 · 2022-08-29 16:50 I very much agree this should be a thing of the past but I do believe it requires a server that *requires* user accounts. Otherwise its hard to moderate when a users IP isn't exposed and new nicks are instant. ---------------------------------------------------------------------- Greedy_Result_2699 · 2022-08-29 17:23 On undernet Username registration and then //mode $me +ix added to the auto perform... my info shows up as my [nick.users.undernet.org](https://nick.users.undernet.org). Has worked for years but not sure on others. ---------------------------------------------------------------------- rockymarine · 2022-08-29 18:13 Do you want Reddit to show your IP address after your user name? ---------------------------------------------------------------------- indianapale · 2022-08-29 19:25 What I want is someone to answer my question. ---------------------------------------------------------------------- MrZimothy · 2022-08-29 19:57 Former large network staff here. Here is the thing: most larger irc networks require significant bandwidth to handle the stress and disaster recovery as well as human support from organizations to sponsor their servers. IRC servers are among the most ddos-targeted systems on the internet for 25 years running. They generally do not accept cloud instances as server applications at all. They want traditional network owners/operators (like it's your data center, your 200gbit aggregate bandwidth, your bgp blend/announcements, and you're the director of network engineering/irc admin) and these days, they are mostly universities and small or medium sized ISPs. It has been trivial for a long time to hide a user's IP address via the server code or options. The part everyone seems to be missing is that when that user is an asshole, the *server* gets ddos instead of 1 user. Over and over and over. The users all piss in their own sandbox while insisting the steadily dwindling servers act as their personal firewall for free and eat 100gbit/s+ attacks, until the network dies. And when irc.example.com doesn't go down because it has ddos mitigation somehow, they hit mail. And www. And ns1. And so on until something "hurts" and the irc server goes dark for a while. Over the years, seasoned staff realized it was a lot easier for users to change their broadband IP and/or suffer the consequences of their own actions at their own doorstep instead of volunteer the sponsored server for a much shorter lifespan for everyone who uses it. ---------------------------------------------------------------------- tedivm · 2022-08-29 21:54 That's not true, in most cases it gets routed through a central service. This allows for much better performance- if you were connected to five people and had to upload video or voice for each of them it could easily clog your upstream connection (which is typically much smaller than the downstream one). ---------------------------------------------------------------------- timeout400 · 2022-08-29 23:03 thanks for the explanation from a staff perspective "user are too entitled for expecting servers to act as their personal firewall" I think this is backwards. It takes coding effort to allow IPs to be accessed by other users in the first place. The default is what almost all web services do: not publish user IPs and keep them in an array in memory or a database without external access. You have to code \*something additional\* to let people access those IPs. So it's not about "masking" anything like a firewall, but simply not coding functions to allow that data to be accessed. So just keeping a lock box instead of drilling a hole into it, as an analogy. Lots of web services operate on shoestring budgets and have to deal with DDOS attacks. They either scale back or hire a company to mitigate DDOS for them, raising funds from the users if they need to. They never think "hey lets just put the users on the hook so we can brag about how big our forum/network etc is". There's a lot of reasons to not want your IP address known beyond just "behave like an asshole". IPs were initially shared in the 90s because it didn't matter then and they were like street addresses. Rather than adapt with the rest of the internet, seems IRC networks decided to give users a bad time for bragging rights. ---------------------------------------------------------------------- timeout400 · 2022-08-29 23:55 my point is the developers of those software had to put in special functions to allow the IPs to be accessed at all. It's not in the IRC specification to share IPs, and when you do a TCP connection to a computer, you aren't by default exposed to the IPs of any other TCP connection, unless such a thing is explicitly coded ---------------------------------------------------------------------- rockymarine · 2022-08-30 00:43 The IP address is a kind of privacy. I do feel uncomfortable when I enter an IRC channel with the IP address. I don't know what is the benefit of showing that to everyone. What we want is just to give cloak to users by default. BTW, Apple is providing the "Private Relay". Do you think it's good or bad? ---------------------------------------------------------------------- zackyd665 · 2022-08-30 01:01 Isn't that what multicast is for? ---------------------------------------------------------------------- calzoneman · 2022-08-30 01:22 > I think this is backwards. It takes coding effort to allow IPs to be accessed by other users in the first place. [...] You have to code *something additional* to let people access those IPs I think you're overblowing this point somewhat. It's not really **additional** effort; you have to choose *something* to be in that field, the IP address is a trivial thing to put into it because you probably have a connection object at that point in the code, and it's even referred to as a host in the RFC (and cross-references the RFC for internet names). That's not to say it would be difficult to put something else there instead if you began your implementation with the requirement that it not be an IP address, but rather that claiming people are out there going to additional trouble to do it is probably not an accurate reasoning for why it's done that way. I'd guess that backwards compatibility and habit probably have far more to do with it. I don't maintain an IRC network, but I do maintain and have mantained several legacy network applications. Changing things is difficult. Gracefully cutting over to new behavior in a distributed system takes coordinated effort. Changing core data structures introduces bugs. Clients will depend on behavior that wasn't technically dictated by the specification and complain when your changes break them. Nobody will appreciate the work that you did because from their perspective it worked just fine until you came in and tried to change it. If you feel strongly about this, consider hosting your own network which does it the way you prefer; if users really care then they will have incentive to move to your network. ---------------------------------------------------------------------- bongo_kip · 2022-08-30 01:29 Well, every site you use has your IP anyway, if you're worried about security just configure better your firewall ---------------------------------------------------------------------- indianapale · 2022-08-30 01:32 I don't know what apple is doing. I also feel uncomfortable with my IP tagged to me. I bought a VPS to run IRC 24x7. I still want to know the actual risks that aren't already a risk by just being on the internet. ---------------------------------------------------------------------- never_trust_snmp · 2022-08-30 03:25 Just install an IRC bouncer on a free EC2 instance. It’s super easy. ---------------------------------------------------------------------- justjanne · 2022-08-30 03:42 For group calls, that's right, but there's still plenty of 1 to 1 calls. ---------------------------------------------------------------------- tedivm · 2022-08-30 03:47 You can't really do that over the public internet in a way that actually works. It's really only useful for pushing data around on a single network. You do see a lot of CDNs use this to push data to their own edge nodes, but that's still on a network they control (although it is exceedingly useful). Outside of that you basically need a client to connect to edgenodes, which brings back the central service and kills off the peer to peer thing being discussed. ---------------------------------------------------------------------- [deleted] · 2022-08-30 05:25 [deleted] ---------------------------------------------------------------------- ferrybig · 2022-08-30 07:21 With discord or slack, it is trivial to get someones ip by just calling them and looking at your network with wireshark to see where it uploads/downloads from. Systems like Slack or Discord are free because they implemented peer to peer connections, instead of letting the connections flow over the server ---------------------------------------------------------------------- timeout400 · 2022-08-30 13:52 have you tried this and does it work? thanks for the info if it does ---------------------------------------------------------------------- timeout400 · 2022-08-30 13:53 would you want reddit to publish your IP aside each post? that's what the discussion is about, user-user divulgence people ignoring this is an issue seems dishonest as I'm sure almost no one here wants their IP posted alongside their posts anywhere else on the net ---------------------------------------------------------------------- timeout400 · 2022-08-30 14:04 The IRC spec people are insisting that this is entirely an IRCd issue and that listing a hostname is not in the RFC you are saying the RFC lists "hostname" for that field in which case that spec needs to changed I have a feeling the entire IRC space would love to pass this around like a hot potato The entire rest of the internet adapted and stopped divulging IPs. Old webservers sometimes kept a public log of all their visitors and when they joined. Then, to be responsible, to account for the fact that security was now something everyone had to take seriously, they took that away. For now though, if you are right about the RFC (and I suspect you are as the IRC spec people were way worse than you), i'd urge users to only join networks that hash the IP from connect or put in a UUID or an index or literally anything else than your literal home IP lol ---------------------------------------------------------------------- calzoneman · 2022-08-30 15:30 Well, there is no single spec for IRC, there are multiple revisions to the original RFC, several extensions (such as IRCv3) people have developed unofficially, etc. So it's entirely possible that newer documents have reworded or replaced this concept, while older implementations were written according to RFC 1459 or 2812. It comes down to who you're targeting: for new development there's a lot of room to try new ideas and challenge old habits, but if this is about old software, I listed some reasons above for why migrating might be challenging. To be clear, I don't disagree with your privacy concerns. ---------------------------------------------------------------------- bongo_kip · 2022-08-31 08:07 I wouldnt really care, its a PUBLIC ip after all, and i know my firewall is good enough to block malicious traffic ---------------------------------------------------------------------- joesmith0789 · 2022-08-31 21:38 >They generally do not accept cloud instances as server applications at all. They want traditional network owners/operators (like it's your data center, your 200gbit aggregate bandwidth, your bgp blend/announcements, and you're the director of network engineering/irc admin) and these days, they are mostly universities and small or medium sized ISPs. Why? Why not harness the DDoS mitigations offered by cloud providers if the issue of DoS and DDoS is so very rampant? ---------------------------------------------------------------------- skizzerz1 · 2022-09-01 05:05 Every ircd these days supports IP masking. There are reasons it might not be enabled by default (or available at all), mostly surrounding abuse mitigation. IP range bans are a very powerful tool at channel op disposal, and taking that away from them would shift the burden of policing ban evasions across channels on the opers, who have much better things to do with their time than babysit every channel. I'm not quite sure I buy the DDoS argument given by another poster. Idiots will DDoS the network regardless of whether or not user IPs are exposed. Incidents that actually manage to impact large networks are thankfully pretty rare nowadays. Masking doesn't solve the issue entirely. There are ways to obtain the IP address of an IRC user by e.g. simply linking them to a site you control and grabbing the IP from your webserver's access logs. But, a non-perfect solution is imo still better than no solution at all. On the large network I am staff for, it is something that a handful of us recognize internally and eventually I'd like to see something put into place so that IPs are masked by default. But, it needs to be in a fashion that the masking algorithm is amenable to range bans, to avoid taking away that power from channel ops and making it harder for them to moderate their channels. ---------------------------------------------------------------------- l0de · 2022-09-05 10:51 "Who wants to join a chat network where everyone knows your IP and can hack it, DDOS it, track it at will? " Me. The dynamic, chaotic nature of a server with no services is 100% why I am on EFnet, the greatest IRC network. It is a wonderful place seething with excitement and drama. Please avail yourself of the many networks that do mask your IP if you are unwilling or unable to secure your own connection. I would suggest a free IRCclown trial if you want to experience EFnet on training wheels. You can also try something like Discord. When someone else is responsible for your security, you will always pay a price. (Discord mods banning you for trivial nonsense, corrupt Liberia operators bilking and abusing their users, etc). Rather than complaining to others to fix your problems, seek your own solutions. Godspeed. ---------------------------------------------------------------------- EnterprisePaulaBeans · 2022-09-06 23:30 Just to clarify: you're saying if the server doesn't show user IPs, then a bad actor wanting to DDOS a user will instead DDOS the server? I admit I'm skeptical about how often that happens these days, but I'm not the network staffer.