Hacker News Reader

Comment by sdflhasjd | Hacker News Reader

This is the very immaturity I'm concerned about when people suggest moving our IRC groups to Matrix.

Because the same behaviour never exists on IRC?

All things considered, I can't say that the Matrix.org team responded slower than I've seen any IRCops respond. The main difference is you don't tend to see news about this happening on IRC as much anymore because IRC has had spam problems for decades, and there's hardly as many people who are out and about making it news.

Plus, for what its worth, most of us who run our own homeservers never encountered this issue at all, because public registration isn't open in the first place. It seems awfully dismissive to wave off Matrix for purely this one incident as it being "immature" as a protocol / platform.

As a person who maintains a moderately sized irc network (700 users when I last checked) one of the things that had put me off matrix a couple of years ago was the lack of powerful moderation tools.

IRCs are absolutely archaic, for sure. Inspircd’s modules are awkward to use, single characters have special meaning… there’s g/k/u-lines and don’t get them mixed up!

But, they’re very powerful and absurdly flexible. We’ve been able to mitigate absolutely huge spam attacks with quite complex logic, and you have strong moderation tools at every level- from the channels with quite rich permissions (voiced, half-ops, ops, admins, founders) and the network level (the aforementioned lines).

Maybe matrix has caught up- but it’s hard for me to run a public network without such rich moderation tools.

Even if those tools are clunky and awkward.

Moderation tools are slowly improving, but definitely still don't fit all use cases, and it's very unfortunate they don't come natively with synapse. I'm the lead admin of a Matrix ' Space', and our main room now has over 6,000 users (80%+ are inactive or barely active). We use mjolnir(https://github.com/matrix-org/mjolnir) to ban and redact users/servers/messages across all of our rooms, which has been a godsend since I used to have to redact all the racist/gore myself message-by-message. It's still reactive instead of proactive, but I'm hoping these tools will mature in time.

fwiw https://matrix.org/docs/guides/moderation/ enumerates the current moderation approaches in Matrix, which are relatively comprehensive. there's still stuff we can do though (e.g. ability to set rooms to text-only)

I meant immature literally, this is a growing pain that will make Matrix a stronger network/protocol. IRC has been around for decades and Matrix hasn't, that's all.

But this will be one of many _novel_ attacks on what is a more complicated network.

When clients and servers need to be updated to fix these issue, it becomes a drag.

Hasn't spam traditionally been a huge issue on IRC? Perhaps it's a bit less now as IRC usage has fallen and/or better systems to stop it have been put in to place, but back in the day when I still used IRC I remember random bots/people spamming ASCII dicks or just offensive text like repeating "nigger" over and over again, and similar "hilarious" stuff.

Actually, the only time a server under my management was hacked (CEO installed some random WordPress plugin with RCE, sigh) was to run an IRC spambot to send out exactly this sort of abuse. Hurray for firewalls also blocking outgoing traffic by the way: as far as we could tell this was all just dropped and never impacted anyone.

Either way, this doesn't sound like a "Matrix problem".

There's a small difference in that IRC generally is a message passing network whereas Matrix more like a log synchronizer.

So spam becomes a part of the log, which means that it'll consume far more resources than just network resources.

I was on IRC in 93/94 (mainly IRCNet), a couple of years after it all started, and especially in those days it was a total shitfight. Technology around the platform moved at a rapid pace and there was this constant race going on between network admins and malware writers. At that time IRC clients supported a lot of scripting and much of that was used for abusive stuff. Like auto ban/kick, forcing netsplits in order to become admin by abusing protocol issues etc. The problem was bigger than spam alone. It was so bad it put me off IRC for almost a decade before I got back into it.

Since then IRC has actually evolved into a more mature userbase but its inherent lack of protection to this and the ease of writing a bot makes a few idiots capable of spamming the entire IRC world.

Nevertheless like I said in another post I think this is just a tradeoff we have to learn to live with. Being fully open is great, but comes with drawbacks and implied trust. I still prefer it as it is.

This is what makes the recent Freenode takeover so sad - it was a more mature version of IRC that was hijacked by a gang of people with "old IRC" ideals.

I haven't used IRC in a long time, and never used Matrix, so I could be way off, please correct me if I am. I think the main difference between matrix and IRC in regards to spam is the federated nature of matrix. In IRC, each organization[1] only has to worry about it's own users. So they can add any kind of verification, bans, filters, etc to manage spam. With matrix, you have to rely on every other organization to police it's own users. Kind of like email, which has way worse of a spam problem than IRC.

[1] I said organization, but what is the right word here? Group? Domain? Do IRC and Matrix have their own terms for these things? I wanted to say server at first, but surely there is more than one server.

I think the terminology you're looking for is "homeserver." Homeservers are tied to a single hostname / domain, but may be a collective of servers running the different services that comprise the protocol itself.

That said, you _do_ have to worry about spam from other homeservers, but that only matters if you have users from that other homeserver in your room. You can choose to federate / not-federate on a room-by-room basis, or just not federate at all ever.

Needless to say, you're right that it is a bit different than IRC in that regard (IRC can just kline hosts / IP ranges from the whole service if you're spamming). However, in practice there's a lot less instances of random spam such as in the article than you would think.

For myself, I never noticed any of these spammers at all (anectodal, so mileage may vary). I do have my own homeserver through Element Matrix Services, but I am part of a good number of rooms that exist purely on the Matrix.org server. Certainly I have to "police my users," but that's pretty easy since I run a small homeserver for ~5 users, and we just federate with the greater network when needed.

I guess I agree with you in general that there's different failure modes, but I don't think it's as simple as dismissing matrix because it "has the same spam problem as email" compared to IRC. In practice at least, it doesn't seem to be as much of a problem despite how much larger than IRC Matrix has become.

Thank you for the insight. To be clear I'm not dismissing Matrix, just trying to explain/understand it. I would say that federation is the main reason that email has been so successful for so long, even if it is the same thing that makes spam so hard to control.

Ah yes, the part in my comment about dismissing matrix was in reference to the thread parent. Apologies if you thought that was directed at you.

Not sure why sibling comment downvoted: these are problems IRC and others haven't solved without being called "immature".

Is the sibling comment dead because of the explicit mention of the n word? The points raised in that comment seem valid.

What's pathetic here is that a bot spam wave can cause performance problems in the network.

Most of the network was fine, it only affected the main Matrix server and anyone who federated with the spammed rooms. If you weren't in a room being attacked or left it you were fine.

Reply on news.ycombinator.com