:: Ideas and Suggestions

The time is now Thursday, April 7th, 2022, 12:25pm


		Forum Index :: Ideas and Suggestions :: Basic protection options :: Reply to this topic

Author
shdhat		Posted :: 1:21pm, Fri, Dec 17, 2004 Subject :: Basic protection options

(anonymous)		When more than X lines are written in Y seconds the bot should set +m automatically. X and Y should be user-defined. Also when there more than X parts,joins in Y seconds bot should set +i. --- This is more like the job for scripting but it would be nice if the bot could interact with the channel service. For example when the bot gets banned it should unban itself using channel service. Futhermore it should assume that a takeover may be happening and suspend the user that set the ban. And the ideea can be stretched to the limits of human imagination. Thanks
proton		Posted :: 1:30pm, Fri, Dec 17, 2004

Posts: 165		My thoughts have been along the way of... if a flooding rule is triggered by 1 person it checks to see if there are others, and if so, it sets +mi for say 2 minutes join/part floods needs some special logic I havent thought much about yet. X people joining in Y seconds can easily be triggered by a fluke or a netmerge. /pro
shdhat		Posted :: 2:01pm, Fri, Dec 17, 2004

(anonymous)		In order to avoid beeing kicked an attacker brings multiple bots (let's say 20). Each may not trigger flood protection but all of them are generating flood. As for cycle flood, the bot will not check for mass join since this happens frequently on netsplits. Best way to explain the cycle flood detection method is an example. Time interval for checking flood will be set by user according to his needs or by the bot (estimating from the number of users in the channel). Let's say 5 users join a channel of 20 users. If in the same interval more than 75% of them (~4) are leaving, emech will wait to see if 4 or even 3 (75%) users will join the channel again. Now the bot will temporary set +i for 2 minutes let's say.
shdhat		Posted :: 2:07pm, Fri, Dec 17, 2004

(anonymous)		Sorry , could not find the edit button. In order to avoing mistaking the cycle flood for netsplit emech should check only for part messages not signoff`s. Or at least to ignore the .net .split quit message.
proton		Posted :: 3:39pm, Fri, Dec 17, 2004

Posts: 165		actually thinking about it a bit now. its possible that ... when a user leaves for any reason he's placed in a special list, this list to be kept around 10-20 seconds. if the number of people on this list exceeds a certain number, that could be interpreted as a cycle flood. btw, this forum doesnt have any edit button yet =P /pro
shdhat		Posted :: 3:53pm, Fri, Dec 17, 2004

(anonymous)		The list ideea is ever better. I was trying to avoid that since it requires more work. I say it's better because it offers emech the possibility to kickban the 'bad' people (temporary even). I wish you good luck since you will need spend some free time in order to make this and other features work. Keep up the good work :) Thank you
proton		Posted :: 4:03pm, Fri, Dec 17, 2004

Posts: 165		actually, keeping a list of offenders is pretty damn trivial, instead of deleting each chanuser record when they part, just move them to a separate list, and when they time out from that one, then delete them entirely. this behind the scenes list can be used to keep track of offenders even after they are kicked, etc /pro