IRC bridge to mode +r channel prevents users from joining

[mstenta]

There has been a flood of IRC spam over the past month (eg: https://freenode.net/news/spam-shake), and one of the only recommended ways of combating this seems to be setting mode +r on the channel, which restricts it to only users that have registered their username with Freenode.

If you have a Matrix.org room bridged to the IRC channel (with mode +r), Matrix.org users are prevented from joining the Matrix.org room. They get immediately kicked by @appservice-irc:matrix.org.

For example:

[example-username] joined the room.
@appservice-irc:matrix.org kicked [example-username]. Reason: IRC error on #[example-channel]: err_needreggednick

This essentially makes the Matrix.org room impossible for others to join, even when it is a public room.

I'm not sure if there is any way to solve this, though - it seems like a tricky problem. Because @appservice-irc:matrix.org needs to create new users in the IRC room, but it is not going through the whole process of registering them.

So it seems that the IRC bridge can only be used on channels that do not have mode +r. Which means lots of persistent spam.

On the bright side, it seems that the spam is only showing in the IRC room, and is not being synced over to the Matrix.org room in most cases. It was earlier this month, but doesn't seem to anymore. Still, I thought it would be good to document this limitation, in case anyone else is experiencing it and has some advice to share.

Thank you for this wonderful service! 👍 :-)

[Half-Shot]

I'm not sure if there is any way to solve this, though

You register yourself on NickServ and join the room?

[mstenta]

@Half-Shot the issue is that the @appservice-irc:matrix.org attempts to create users in the IRC room to match users that are in the Matrix.org channel. These users are created automatically, on-the-fly, by the bridge - and are not registered. The IRC channel then prevents them from joining, which @appservice-irc:matrix.org sees, and then kicks the user out of the Matrix.org room as well.

So if the IRC room has mode +r, the Matrix.org IRC bridge prevents new Matrix.org users from joining.

[makew0rld]

I am having this issue as well. It prevents me from joining and talking in IRC channels. Will this be resolved soon?

[mstenta]

@makeworld-the-better-one - I'm not an expert on how this works, but it strikes me as something that is inherently difficult to resolve.

It seems that, currently, if the IRC bridge is unable to create a user in the IRC room, then it kicks the Matrix.org user out of the Matrix.org room as well. Perhaps this logic could be changed, so that it doesn't kick the Matrix.org user... but that would mean that Matrix.org users are no longer created in IRC - which is essentially the whole point of this bridge.

One idea might be: instead of creating new users for each Matrix.org user in the IRC room, just create one (ie: just named "@appservice-irc:matrix.org") - and have that user speak on behalf of any Matrix.org users in IRC. That one user could then be registered with Freenode (and other servers), so that it is allowed to join the room.

[makew0rld]

That second solution sounds great. Any idea if it can happen?

[Mikaela]

If https://github.com/matrix-org/matrix-appservice-irc/wiki/End-user-FAQ#how-do-i-registeridentify-to-nickserv doesn't help you, I would suggest asking the channel ops to setup another solutioon against spam like.

• MODE +S requires TLS connection for joining
• MODE +be $~a *!*@gateway/shell/matrix.org/*
• MODE +q $~a & /msg ChanServ flags #channel *!*@gateway/shell/matrix.org/* +V
• MODE +m & setting a bot to autovoice everyone with some delay from joining to the channel.

I don't think IRC networks would be happy if the bridge started spamming services with random registrations without user interaction. I think the only way this could be fixed by matrix-appservice-irc would be (#329) it starting to pretend being IRC server and link to the network as a server in which case it could possibly claim everyone to be registered as some illegal account which IRC services wouldn't allow registering.

Edit: formatting fix, issue number.
Edit#2: I accidentallly swapped the cs flags command arguments and made it more universal now. Note that the V has to be capital one, v allows voicing/devoicing anyone and doesn't do it automatically while +V is automatic and only for oneself.

[mstenta]

Thanks @Mikaela ! I will research these options.

[Mikaela]

Perhaps this logic could be changed, so that it doesn't kick the Matrix.org user... but that would mean that Matrix.org users are no longer created in IRC - which is essentially the whole point of this bridge.

I think this would make at least freenode and if not more IRC users unhappy as it would be different from traditional IRC and Matrix users could be considered as spying.

One idea might be: instead of creating new users for each Matrix.org user in the IRC room, just create one (ie: just named "@appservice-irc:matrix.org") - and have that user speak on behalf of any Matrix.org users in IRC.

I think this was how a very initial version of the bridge functioned and how e.g. Gitter bridge works, but I fear it would have restrictions too such as how to ban abusive Matrix user without using Matrix and it would be easier to just ban everyone using Matrix and problem solved.

Thanks @Mikaela ! I will research these options.

You're welcome, I am thinking of typing something about them to the FAQ.

[makew0rld]

@Mikaela Thank you. I'm in the process of registering my nick, although at the moment @appservice-irc:matrix.org seems to be down, so I haven't finished. On the other hand I'm not being kicked anymore. Thanks for the help, I might report back later!

[Mikaela]

You're welcome and sorry for mass commenting, but...

• https://github.com/matrix-org/matrix-appservice-irc/wiki/End-user-FAQ#i-am-a-chanop-and-have-a-spam-problem-how-can-i-fix-it-without-affecting-matrix-users - something to maybe link the channel ops instead of this issue?
• No way to indefinitely exempt clients from +r freenode/ircd-seven#137 No way to indefinitely exempt clients from +r which is the freenode-side issue which I think would also help resolve this case.

[mstenta]

@Mikaela - I am using the first two suggestions you wrote about in the End user FAQ: MODE +S and MODE +be $~a *!*@gateway/shell/matrix.org/*

It seems like that will work well for our needs. Thanks again!

[Mikaela]

I think this could be closed?

[tgr]

You register yourself on NickServ and join the room?

That does not seem to work either (now, anyway), per #938.