Upheaval at freenode

[Posted May 19, 2021 by jake]

Several readers have alerted us to some serious problems at freenode, which runs an IRC network that is popular in the free-software world. Evidently there has been a change of control within the volunteer-run organization that has led to the resignations of multiple different volunteers, at least in part due to a concern about the personal information of freenode users under the new management. "The freenode resignation FAQ" has collected a bunch of information (and links to even more resignation letters) that may help shed some light on this mess. From the FAQ: "Freenode staff have stepped down. The network that runs at freenode.org/net/com should now be assumed to be under control of a malicious party." In the meantime, many of the volunteers who resigned have formed Libera.Chat to continue the legacy of freenode. LWN will be keeping an eye on the situation, stay tuned ...

(Log in to post comments)

Upheaval at freenode

Posted May 19, 2021 14:36 UTC (Wed) by NightMonkey (subscriber, #23051) [Link]

Ugh. I use Freenode so much, and sing its praises to fellow technologists. I hope this all turns out well in the end.

Upheaval at freenode

Posted May 19, 2021 15:20 UTC (Wed) by ccchips (subscriber, #3222) [Link]

Reminds me of the Linux Trademark mess.

Upheaval at freenode

Posted May 19, 2021 17:28 UTC (Wed) by ddevault (subscriber, #99589) [Link]

For what it's worth, I trust the staff who have moved to libera.chat, and I do not trust those left over at Freenode. I would advise everyone to move their channels over to Libera Chat. I set up a bot to guide users over to the new network, let me know (ddevault on either net) if you want me to drop it into your channel.

moving to libera

Posted May 19, 2021 17:40 UTC (Wed) by anarcat (subscriber, #66354) [Link]

It seems like a bunch of people agree:

CentOS is moving
Sourcehut as well (which I guess was implicit with the above)
KDE seems to be dithering but I bet they will move as well

Other communities like Debian or Tor were already elsewhere (OFTC, in particular) so are not affected by this, but this must be a huge blow for communities that use Freenode extensively, particularly because of the *way* this is playing out. If Freenode would have just crashed and burned, it wouldn't be so bad: restart with another name. But this is basically a DNS / server hijacking, so the network is actually still running, it's just untrusted and the admins have basically abandoned ship protest. Kind of sad, really: the largest remaining IRC network....

moving to libera

Posted May 20, 2021 1:44 UTC (Thu) by mirabilos (subscriber, #84359) [Link]

The libera.chat IRC servers differ in what SSL they accept though, so forcing people to unencrypted connections that had moderate-but-acceptable security before. (I asked a staffer-on-duty about changing this, and they’re unwilling to even consider that.)

Unfortunately OFTC does that as well nowadays (which I discovered while looking for alternatives).

There are other IRC networks around, but… there used to be benefit of having everything except Debian in one place. *sigh*

And let’s not even think about those who leave IRC behind now…

moving to libera

Posted May 20, 2021 1:47 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

What old SSL support are you looking for? Why can't the client be updated?

moving to libera

Posted May 22, 2021 2:16 UTC (Sat) by karolherbst (guest, #124995) [Link]

so there are so called "next gen firewalls", which are mitm all SSL to "improve security", but because those TLS 1.3 DH ciphers don't allow this, they either fallback to lower sec or none sec (depending on the web service).

So they weaken all connections to "improve security"

I know it sounds idiotic, but that's essentially what happens here.

moving to libera

Posted May 22, 2021 19:04 UTC (Sat) by riking (subscriber, #95706) [Link]

From my point of view, the options are either (1) management talks to the auditors and accepts the risk of communications going over the internet unsecured, (2) management finds the risk unacceptable and disables the interception for high security internet endpoints, or (3) you tunnel out to a non-compromised line in order to do your thing.

The fact that the framing of all three of these options makes the firewall vendor look rather useless is not an accident.

TLS

Posted May 23, 2021 21:38 UTC (Sun) by tialaramex (subscriber, #21167) [Link]

The only correct way to "mitm all SSL" (TLS) is explicitly spelled out in the standard and goes like this:

You build a TLS client and a TLS server, you may as well use the best available cryptography in each, and you fasten them back-to-back. Connections are captured by your interposing server, which has a certificate trusted by whichever set of clients you want to accept this nonsense, and then your client makes an entirely separate connection to the real server. You are now literally in the middle and can do whatever you want, passing data from one to the other, altering or recording it as you see fit.

If you can't get clients to trust you, you can't do this, too bad game over, either do or don't let these clients that don't trust you use your network equipment, your choice. Doing the above also costs lots of money (or, equivalently, it's incredibly slow and painful because you didn't spend enough money), but again too bad.

All the "cheap" options are inherently broken. They aren't actually delivering even the security they appear/ pretend to offer. If an organisation bought one of the many products broken in this way, it was never functional as designed, though good luck getting a refund now. TLS 1.3 didn't change the fundamentals here, it just surfaced something that was already true and you can bet bad guys knew it.

Anyway, because TLS 1.3 has working downgrade prevention, if the server and client are both capable of TLS 1.3 (Libera.chat servers I tried do speak TLS 1.3) either they get TLS 1.3 or the TLS connection simply doesn't work. There isn't any feature they can enable on their servers that will somehow allow you to get weaker guarantees despite being able to speak TLS 1.3, if this existed obviously it can be used as a downgrade attack, so it had to be prevented.

TLS

Posted May 24, 2021 6:25 UTC (Mon) by epa (subscriber, #39769) [Link]

"Working downgrade protection" in practice often means downgrading to unencrypted http.

TLS

Posted May 24, 2021 7:06 UTC (Mon) by NYKevin (subscriber, #129325) [Link]

It is entirely possible to operate an HTTPS-only (or TLS-only, for non-HTTP services) endpoint, and to simply refuse unencrypted connections altogether (or, for HTTP, 301 them to the HTTPS equivalent). When combined with HSTS preloading, it becomes entirely impossible to access the site over HTTP, even with an MitM that tries to downgrade the connection (the browser knows that www.example.com is an HTTPS-only site, and forcibly upgrades the connection to HTTPS regardless of what you type in the URL bar).

TLS

Posted May 24, 2021 17:30 UTC (Mon) by mirabilos (subscriber, #84359) [Link]

But that’s not what IRC is.

All the IRC networks also offer unencrypted connections. Libera.chat forces users who can connect to Freenode with older but still good (unless you’re a bank) SSL but not to libera.chat so it forces them to unencrypted IRC.

IRC’s not like your typical https login. All it protects is the nickserv password. Everything else can be read at least on the servers.

TLS

Posted May 26, 2021 0:22 UTC (Wed) by tialaramex (subscriber, #21167) [Link]

> All the IRC networks also offer unencrypted connections. Libera.chat forces users who can connect to Freenode with older but still good (unless you’re a bank) SSL but not to libera.chat so it forces them to unencrypted IRC.

You still haven't offered any real insight into what constitutes "older but still good SSL" here so nobody is going to have much advice.

"Unless you're a bank" makes no sense. Banks have terrible cryptographic security and we have to constantly prod them to get them to at least stay vaguely up to minimum standards.

You might be thinking about something like PCI DSS, but that's a standard for the _customers_ the banks gave themselves an opt out, allowing them to choose much less secure options wherever they wanted if it was cheaper or more convenient, because if the bank gets knocked over they'll just pass it on to their customers, why should they care?

You shouldn't be using anything older than TLS 1.2. TLS 1.2 is more than twelve years old, if you aren't able to do security updates for over a decade it's time to admit that you do not in fact want security.

TLS

Posted May 26, 2021 7:06 UTC (Wed) by jamesh (guest, #1159) [Link]

If these gateways are broken by Diffie-Hellman key exchange, presumably they aren't running entirely independent TLS connections on either side. If they could arrange for both connections to use the same session key, it'd be possible to pass most of the traffic through without re-encrypting it. Traffic could be saved alongside the session key determined by MITMing the key exchange phase for later decryption.

It's clearly the kind of thing DH key exchange is intended to frustrate, but I can see why they might try to use it. You could handle significantly more connections on the same hardware compared to doing things the right way, and lower latency to boot.

moving to libera

Posted May 20, 2021 18:53 UTC (Thu) by anarcat (subscriber, #66354) [Link]

now Xen and wikipedia too! the exodus is massive. also: six hours ago (give or take) Libera has apparently overtaken OFTC in terms of number of users, which I find kind of amazing as well.

moving to libera

Posted May 21, 2021 14:48 UTC (Fri) by plugwash (subscriber, #29694) [Link]

I'm pretty sure this is by far the fastest rise from zero to 10K+ uses of any IRC network ever.

Looking at netsplit.de nowadays makes me sad though, back in the day there were multiple networks above 100K users, nowadays there are none, and I suspect this freenode saga will drive even more users away from IRC.

Upheaval at freenode

Posted May 26, 2021 14:11 UTC (Wed) by fuhchee (guest, #40059) [Link]

> I trust the staff who have moved to libera.chat, and I do not trust those left over at Freenode.

Excuse my bluntness but ... so what? What is the threat that staff you do not trust pose to the rest of us?

Upheaval at freenode

Posted May 28, 2021 1:39 UTC (Fri) by flussence (subscriber, #85566) [Link]

One of the new staff authored an IRC client with a remote backdoor to give him access to users' logs. Another proactively namesearches the internet and harasses people from sockpuppet accounts.

But if you're leading with “so what”, you probably need to go see for yourself what new freenode is about. I've heard the #fsf channel is nice this time of year.

Upheaval at freenode

Posted May 19, 2021 17:41 UTC (Wed) by rickmoen (subscriber, #6943) [Link]

I can confirm from public whois data that domains freenode.net/com/org now have "freenode Limited" as the Registrant of record. Gandi.net now defaults to privacy-proxying-out all other details.

Upheaval at freenode

Posted May 19, 2021 21:20 UTC (Wed) by ccchips (subscriber, #3222) [Link]

This one made it to Google's news aggregate.

Upheaval at freenode

Posted May 19, 2021 23:13 UTC (Wed) by NYKevin (subscriber, #129325) [Link]

It looks like the Wikimedia people are going to move off of Freenode in the near future, but they got bogged down in a "Libera vs. various things which are not IRC" argument.[1]

[1]: https://meta.wikimedia.org/wiki/Wikimedia_Forum#Freenode_...

Upheaval at freenode

Posted May 20, 2021 2:51 UTC (Thu) by calumapplepie (subscriber, #143655) [Link]

Wikimedia forums aren't a vote: they're a chance for everyone to express opions. The people writing there aren't the wikipedia admins or developers: they're just contributors. There's a good chance that the admins are working on implementing the move now: as you said, the majority of people seem to be arguing that Libera is the best short-term option.

Upheaval at freenode

Posted May 20, 2021 17:06 UTC (Thu) by NYKevin (subscriber, #129325) [Link]

Sure, the admins can do whatever they want. But if the community does not follow them, then it's rather pointless. You can't force people to use system X when they want to use system Y instead. The WMF already learned this the hard way with VisualEditor.

Upheaval at freenode

Posted May 21, 2021 13:10 UTC (Fri) by hkario (subscriber, #94864) [Link]

The loudest people also don't represent the community, so a solution that is least disruptive is the most likely to be acceptable to widest portion of the community.

Upheaval at freenode

Posted May 20, 2021 3:06 UTC (Thu) by pabs (subscriber, #43278) [Link]

Andrew Lee (rasengan) now appears to have control over freenode, I just got this notice:

-rasengan- [Global Notice] Hello freenode! Thank you for your patience and understanding as we get through these tough times together. We wanted to take a moment to post an update - https://freenode.net/news/freenode-is-foss - and thank you for using freenode, the home of FOSS.

Upheaval at freenode

Posted May 20, 2021 3:42 UTC (Thu) by rickmoen (subscriber, #6943) [Link]

Occurrence just now noted without further comment, except that I've had ops (as "redrick") on Freenode's #svlug IRC channel for decades (and that my colleague Rob "lilo" Levin, faults notwithstanding, would have been embarrassed):

15:28 -!- Topic for #svlug: Welcome to #svlug, the Silicon Valley Linux User
Group's 24x7 meeting. Regular meeting 1st Wednesday.
http://www.svlug.org/
15:28 -!- Topic set by redrick [] [Thu Dec 8 19:10:41 2011]
15:28 [Users #svlug]
15:28 [@ChanServ] [ octorian] [ quaid] [ redrick] [ scubacuda]
15:28 -!- Irssi: #svlug: Total of 5 nicks [1 ops, 0 halfops, 0 voices, 4 normal]
15:28 -!- Home page for #svlug: http://www.svlug.org/
15:28 -!- Channel #svlug created Sat Nov 25 22:43:22 2006
15:28 -!- Irssi: Join to #svlug was synced in 8 secs
15:28 -!- mode/#svlug [+o redrick] by ChanServ
20:33 -!- redrick changed the topic of #svlug to: Welcome to #svlug, the
Silicon Valley Linux User Group's 24x7 meeting.
http://www.svlug.org/ IRC presence moved to irc.libera.chat .
20:33 -!- ChanServ changed the topic of #svlug to: Welcome to #svlug, the
Silicon Valley Linux User Group's 24x7 meeting. Regular meeting 1st
Wednesday. http://www.svlug.org/
20:33 -!- mode/#svlug [-o redrick] by ChanServ
20:33 -!- #svlug You're not a channel operator

Okay-then.

Upheaval at freenode

Posted May 20, 2021 4:33 UTC (Thu) by alison (subscriber, #63752) [Link]

> I've had ops (as "redrick") on Freenode's #svlug IRC channel for decades

Rick, svlug has had a channel for decades? Now you tell me!

Upheaval at freenode

Posted May 20, 2021 11:49 UTC (Thu) by grifferz (subscriber, #62128) [Link]

> 20:33 -!- redrick changed the topic of #svlug to: Welcome to #svlug, the Silicon Valley Linux User Group's 24x7 meeting. http://www.svlug.org/ IRC presence moved to irc.libera.chat .
> 20:33 -!- ChanServ changed the topic of #svlug to: Welcome to #svlug, the Silicon Valley Linux User Group's 24x7 meeting. Regular meeting 1st Wednesday. http://www.svlug.org/

Someone pointed out that #svlug has TOPICLOCK set on it, so isn't this just ChanServ setting the topic back to what it was locked to?

I too have been forced to remember more about IRC in the last two days than I am happy about.

Upheaval at freenode

Posted May 20, 2021 16:17 UTC (Thu) by rickmoen (subscriber, #6943) [Link]

grifferz, I notice that, but ChanServ immediately removing my nick's "o" flag after I attempted to set /topic (as shown) prevents me from taking further action. I'm not making accusations, but just note the odd coincidence of my account getting de-op'd the moment I tried to set /topic to mention a move to Libera.Chat. (Perhaps a weird anomaly, perhaps otherwise.)

My nick "redrick" has had and used +o on Freenode's #svlug channel for a very long time (reflected at the top of the transcript). Although I'm rusty at all this, I've re-queried ChanServ to confirm, and lack of an op flag in #svlug has persisted.

Upheaval at freenode

Posted May 21, 2021 1:35 UTC (Fri) by pabs (subscriber, #43278) [Link]

ChanServ says that you have access, so maybe do this:

/msg chanserv topic #svlug Moved to libera.chat

Upheaval at freenode

Posted May 21, 2021 4:57 UTC (Fri) by rickmoen (subscriber, #6943) [Link]

I would guess that a friendly admin fixed what ChanServe knew, as this happened today:

Day changed to 20 May 2021
08:07 -!- mode/#svlug [+o redrick] by ChanServ

My thanks to whoever (apparently) stepped in.

Upheaval at freenode

Posted May 23, 2021 21:39 UTC (Sun) by rickmoen (subscriber, #6943) [Link]

I'm afraid mischief on Freenode's channels continues. The last few days, I noticed that massive numbers of Devuan Project regulars were getting notices of the form

nn:nn -!- [nick] was kicked from [channel] by ChanServ [You are not authorized to be on this channel]

...for no apparent reason, usually followed by banning of the user's IP. (For context, nobody in Devuan Project has been involved even slightly in the dispute between Mr. Lee and the departed staff. ) For example, from yesterday:

05:42 -!- pepe75 was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
05:53 -!- mode/#devuan [+o DocScrutinizer05] by ChanServ
05:54 <@DocScrutinizer05> moving channel to libera, please click
                          ircs://irc.libera.chat:6697/#devuan-dev  or see
                          https://libera.chat/ and
                          https://libera.chat/guides/registration
05:54 -!- mode/#devuan [-o DocScrutinizer05] by ChanServ
06:08 -!- mode/#devuan [+b *!*@p200300e617198700021fd0fffe8178d8.dip0.t-ipconnect.de] by ChanServ
06:08 -!- noxx was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
06:08 -!- mode/#devuan [+b *!*@213.170.218.225] by ChanServ
06:08 -!- orcus-de was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
06:15 -!- mode/#devuan [+b *!*@207.148.96.120] by ChanServ
06:15 -!- m4rley was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
05:54 -!- mode/#devuan [-o DocScrutinizer05] by ChanServ
06:08 -!- mode/#devuan [+b *!*@p200300e617198700021fd0fffe8178d8.dip0.t-ipconnect.de] by ChanServ
06:08 -!- noxx was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
06:08 -!- mode/#devuan [+b *!*@213.170.218.225] by ChanServ
06:08 -!- orcus-de was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
06:15 -!- mode/#devuan [+b *!*@207.148.96.120] by ChanServ
06:15 -!- m4rley was kicked from #devuan by ChanServ [You are not authorized to be on this channel]
18:19 -!- mode/#devuan [+v infobot] by ChanServ
18:38 -!- mode/#devuan [+o Sigyn] by ChanServ
18:39 -!- mode/#devuan [+o Sigyn`] by ChanServ
18:49 -!- mode/#devuan [+o Sigyn] by ChanServ
19:43 -!- mode/#devuan [+o Sigyn] by ChanServ

This mass-exclusion reached me this afternoon:

13:06 -!- redrick was kicked from #devuan-offtopic by ChanServ [You are not authorized to be on this channel]
/join #devuan-offtopic
14:28 -!- Cannot join to channel #devuan-offtopic (You are banned)

Why? Unstated. At the time the dispute broke, a couple of days ago, I had mentioned on channel #devuan-offtopic a couple of mainstream news article URLs about it, without editorial comment — very nearly the only thing I've said there in a month or two. Am guessing that the new channel operators are reading IRC logs and kicking (and in some cases IP-banning) anyone who even mentioned the controversy in any way.

Upheaval at freenode

Posted May 24, 2021 0:37 UTC (Mon) by pabs (subscriber, #43278) [Link]

What you posted means the Devuan channel operators moved the channels to libera and then set the "restricted" mode on the channel, which prevents people from joining the channel and bans them when they do. It is a fairly confusing way of redirecting people to another network, but it is effective.

The Devuan website says that they have moved to Libera:

"Devuan-related channels are found on the Libera IRC network"

https://www.devuan.org/os/community

Upheaval at freenode

Posted May 24, 2021 1:31 UTC (Mon) by rickmoen (subscriber, #6943) [Link]

pabs, that's possible, thanks. I attended the Thursday Devuan planning meeting that agreed upon what to do about the dispute. FWIW, at that time there was no plan to set restricted mode on any existing channel -- to the best of my recollection.

Upheaval at freenode

Posted May 24, 2021 1:36 UTC (Mon) by pabs (subscriber, #43278) [Link]

That may have been my fault, I recommended restricted mode to DocScrutinizer05 for another channel after noting its use on another channel I was on.

I don't know if there is a less harsh but still effective way to indicate a channel has moved to another network.

Either way, it sounds like freenode policies are changing to allow them to revert any indicators that a channel has moved to another network.

Upheaval at freenode

Posted May 24, 2021 2:26 UTC (Mon) by rickmoen (subscriber, #6943) [Link]

That makes sense (and I just found the ChanServ docs explaining what SET RESTRICTED causes to happen in a channel, just as you posted that). Appreciate your help figuring it out.

Upheaval at freenode

Posted May 24, 2021 1:49 UTC (Mon) by pabs (subscriber, #43278) [Link]

FTR DocScrutinizer05 has switched #devuan-dev to moderated mode instead of restricted mode, the other channels might get the same treatment when an op is available.

Upheaval at freenode

Posted May 20, 2021 15:23 UTC (Thu) by amacater (subscriber, #790) [Link]

Having everyone except Debian ... someone made the point that Debian developers and some other Debian folks tended to hang out on OFTC while Debian _users_ tended to hang out on Freenode.

OFTC is still very much there so maybe those seeking Debian advice/assistance/company will re-coalesce there more readily.

[Disclaimer: Not speaking on behalf of the Debian Project: no particular connection with either IRC provision other than as satisfied user of OFTC for a while.]

Upheaval at freenode

Posted May 21, 2021 1:39 UTC (Fri) by pabs (subscriber, #43278) [Link]

Looks like the #debian channel is now on OFTC, freenode and libera, with the latter two having a reminder that irc.debian.org points at irc.oftc.net. There are a surprising amount of other Debian channels on freenode and libera, although most Debian channels are indeed on OFTC.

Upheaval at freenode

Posted May 20, 2021 10:05 UTC (Thu) by snajpa (subscriber, #73467) [Link]

So much drama over a plaintext protocol with no emphasis on privacy whatsoever... Like a bunch of random strangers hidden behind random nicks without faces, who've mostly never met (so called "community"), is/was something oh-so-trustworthy. I'm just not getting it, at all :(

Upheaval at freenode

Posted May 20, 2021 11:25 UTC (Thu) by jkingweb (subscriber, #113039) [Link]

The protocol isn't really the point, though it is significant that it's a mature, well-supported, decentralized, generic protocol. What people are upset about is the attempted usurpation of control over the community, regardless of the technical details.

Upheaval at freenode

Posted May 20, 2021 13:25 UTC (Thu) by gray_-_wolf (subscriber, #131074) [Link]

I guess that means that #vpsfree plans to stay on freenode?

Upheaval at freenode

Posted May 20, 2021 14:06 UTC (Thu) by snajpa (subscriber, #73467) [Link]

I guess time will tell. I'm just not convinced the reaction needs to be so swift and the opinions all around so strongly held. Especially when the core of the problem has happened in 2017 already...

Upheaval at freenode

Posted May 21, 2021 11:49 UTC (Fri) by nix (subscriber, #2304) [Link]

The (now-departed-for-Libera) ops have a reputation because they've been around for decades under the same nicks: the nicks have a reputation because of the (quite enormous) cost in time of building up a new nick with a similar reputation: nobody would burn that voluntarily. The same is true of every pseudonymous handle on the Internet, and has been since the early days of USENET, at least. The same is true of real names in the real world.

Andrew Lee / rasengan's reputation is mud.

Upheaval at freenode

Posted May 24, 2021 10:18 UTC (Mon) by SomeOtherGuy (guest, #151918) [Link]

Why are we all saying Freenode is a nice place?

I also have had nothing but bad experiences with all but 1 of the ops I've encountered.

Freenode is a bunch of servers, you can't really screw that up, but "oh a nice community"? WTF?

Then there's the tonnes of students who'll go "well actually" over every minor point - "the guy wanted a Regex, not to know the minutia of how Perl regex isn't true regex and not linear complexity"

I dislike freenode.

To be fair Wikipedia is worse, I tried to create an account because I got caught in a /16 ISP ban, the entire lot assumed bad faith, there are some nice people on freenode but the bad faith stuff is crazy

One last thing I dislike:

Let's make a channel registered only JUST IN CASE we get a few hundred bytes of an ASCII swatstica in our logs. Banning is trivial. The barrier raised does not justify it.

That also reminds me: bands handed out forever routinely to minor things or just people disliking each other - anyone ever been PMed by an op going "shut up please m8" - or treated with any kind of adult-to-adult talk?

I use it as a resource purely, I don't try and help (except maybe by PM if someone's struggling) and I don't do anything else

Upheaval at freenode

Posted May 24, 2021 10:22 UTC (Mon) by SomeOtherGuy (guest, #151918) [Link]

"Can I have a cloak please, I know it doesn't mask my IP, and I know the get-IP trick"
(you know the open secret about setting a ban on IP ranges then asking chanserv to unban a nickname, if it removes the range ban, the nickname is within the IP range)

IMMEDIATE SUSPICION

And with taking channels, that isn't a bad thing, some twerp holds the canonical name for a topic (#MachineLearning guy is mental and mainly post links to softcore porn)
We should if anything take other channels and give them to this guy - not take it away.

Upheaval at freenode

Posted May 24, 2021 10:27 UTC (Mon) by SomeOtherGuy (guest, #151918) [Link]

Why did I want the cloak?

Because I'm pretty sure the guy who keeps saying "goodnight" then synflooding me doesn't know the trick I just described or can't be bothered to automate it.

But no. I could somehow use it for nefarious means

So yeah "did a good job" - did they? They just had to keep the servers connected and deal with spam attacks, which IRC already has the tools for, I honestly don't think the staff did a good job - except one guy as I said who wasn't suspicious of everything.

What would a bad job actually look like?

And with this will freenode suddenly stop working? I doubt it. Names being transferred? That'd be really bad privacy wise if they did. Open to counter-arguments :)

Upheaval at freenode

Posted May 25, 2021 7:38 UTC (Tue) by flussence (subscriber, #85566) [Link]

The tl;dr I'm getting here is that you made this throwaway account just to complain at length here about being banned from a FOSS developers' IRC network for posting ascii art swastikas and doubling down after being given a private chance to save face.

Upheaval at freenode

Posted May 25, 2021 16:10 UTC (Tue) by SomeOtherGuy (guest, #151918) [Link]

This account isn't throwaway I just coudn't think of a name.

It took a while before I felt strongly enough to do more than lurk.

Don't confuse anger for bitterness. I'm angry that freenode is so bad when it could be something else, I use it as I said and I wont risk doing anything to cut off that use (by doing more than asking questions) - I think a system that encourages this is awful.

Think of it this way:

If I try and help someone there's a small but non-zero chance that someone else gets involved, is wrong and then takes being corrected badly, or doesn't take a respectful "go read here" respectfully.
A grudge is born, they may even be an op without ops, or a close friend of one

Or a channel pet (someone who is there and has been for years, but is like a perpetual first year undergraduate)

There's no strike system, and there's no proportionate response, there's no PM going "careful man", there's bans and suddenly I can't ask questions any more.

I've seen this happen so much that I don't try.

With the staff, they are deliberately hands off and let people control channels simply because they were first 20 years ago. There's no guidelines on what abuse of that would be and often the names are "canonical" (eg Posix or Linux as channel names - "LinuxChatOverHere" will never take off, so it cannot be forked because of the canonical name)

So that absolves the staff of being blamed for that

What else do they do? They keep it running and to an extent protect it, but the cure is worse than the disease here - who cares about a few hundred bytes of an ASCII swatstica in their logs? If there was a SPAM message which was so convincing it turned me onto a cause,then I'm not sure an argument should be hushed up.

If they fail to keep it running they're staff of nothing. During the mass PM spams they just put +R on by default, and often use "we're volunteers what do you want us to do?"

That doesn't earn them many points in my book

So this new guy, what are his evil ends? THIS COULD BE GOOD!

Upheaval at freenode

Posted May 21, 2021 0:57 UTC (Fri) by Rudd-O (guest, #61155) [Link]

It's Matrix time.

Upheaval at freenode

Posted May 21, 2021 12:42 UTC (Fri) by ptman (subscriber, #57271) [Link]

Indeed. IRC has served for a long time, but maybe it's time to switch to some other protocol. IRC usage has been declining for a long while (years certainly, decades?). Matrix would be a very good alternative. It's an open federation, so a takeover like this (with a closed federation) shouldn't be possible.

Upheaval at freenode

Posted May 22, 2021 2:32 UTC (Sat) by idra (guest, #36289) [Link]

Matirx is nice, but try to find volunteer servers that require 10x CPU/RAM and 1000x disk for the same number of users...

Resource usage of Matrix servers

Posted May 22, 2021 18:47 UTC (Sat) by tim_small (guest, #35401) [Link]

The Conduit Matrix server (although not yet feature complete) is about 100x lighter on CPU than the server that runs matrix.org.

The developer is now being funded to work on it full time. It's usable for private non-federated servers already (federation is not advised currently, because it is unearthing spec non-compliance issues in various other Matrix servers and clients), which have not yet been fixed.

Upheaval at freenode

Posted May 22, 2021 19:12 UTC (Sat) by riking (subscriber, #95706) [Link]

Matrix has next to no moderation capabilities; it's literally worse than IRC.

Homeservers are obligated to replicate a complete log of all channel activities. You can't ban a channel from transiting your server without breaking the protocol. A channel that was started on a homeserver doesn't give any moderation or access recovery abilities to the homeserver, which means you can't go back and fix mistakes.

Try this fun exercise: create a new throwaway account, have it join a channel, grant it chanop, remove all other chanops, destroy the account login key. You now have a permanently opless channel, and there's no way to recover because the server doesn't actually have the authority to do that.

(*Note: much of this is secondhand interpretation, I have only briefly used Matrix before I decided it was not fit for purpose.)

Moderation in Matrix

Posted May 23, 2021 9:25 UTC (Sun) by tim_small (guest, #35401) [Link]

I don't claim to know a lot about Matrix (beyond moderating a couple of rooms myself), but my impression is that shortcomings in the spec are gradually being addressed. In general I've found the developers responsive.

https://matrix.org/docs/guides/moderation

Upheaval at freenode

Posted May 21, 2021 3:21 UTC (Fri) by pabs (subscriber, #43278) [Link]

Gentoo statement:

https://www.gentoo.org/news/2021/05/20/Freenode.html

Upheaval at freenode

Posted May 24, 2021 12:25 UTC (Mon) by pabs (subscriber, #43278) [Link]

https://www.gentoo.org/news/2021/05/23/Moving-to-Libera.html

Upheaval at freenode

Posted May 26, 2021 16:50 UTC (Wed) by rickmoen (subscriber, #6943) [Link]

Newer statement:

"Gentoo Freenode channels have been hijacked

May 26, 2021

Today (2021-05-26) a large number of Gentoo channels have been hijacked by Freenode staff, including channels that were not yet migrated to Libera.chat. We cannot perceive this otherwise than as an open act of hostility and we have effectively left Freenode.

Please note that at this point the only official Gentoo IRC channels, as well as developer accounts, can be found on Libera Chat."

Upheaval at freenode

Posted May 21, 2021 8:08 UTC (Fri) by pabs (subscriber, #43278) [Link]

https://ariadne.space/2021/05/20/the-whole-freenode-kerfl...
https://twitter.com/ariadneconill/status/1395347865271246853

Upheaval at freenode

Posted May 23, 2021 1:47 UTC (Sun) by pabs (subscriber, #43278) [Link]

https://www.devever.net/~hl/freenode_abuse

Upheaval at freenode

Posted May 23, 2021 6:46 UTC (Sun) by flussence (subscriber, #85566) [Link]

I was fully expecting this stuff to fizzle out after the initial day or two, but it seems to be heading in the opposite direction…

Upheaval at freenode

Posted May 23, 2021 17:34 UTC (Sun) by guillemj (subscriber, #49706) [Link]

Due to timezones I'm not entirely clear whether this is post-hoc or not, but no matter what it still looks extremely shady…

Upheaval at freenode

Posted May 23, 2021 21:53 UTC (Sun) by rickmoen (subscriber, #6943) [Link]

Hugo Landau ("hl") described in detail, yesterday what he claims is widespread questionable behaviour by the new Freenode admins against users and longtime channel operaters, including himself — according to him, removing him as operator of channel ##hntop he founded long ago to autoreport stories that have hit Hacker News's Top 30.

Mr. Landau says:

Conclusions. In other words, it appears that a Freenode services admin, presumably rasengan,

forcibly dropped the channel and reregistered it so as to put themselves in control of it, and render me no longer in control of it;
clearly did this with the express purpose of frustrating an attempt by that channel's founder (me) to relocate it to another IRC network; and
cover up the fact that I had sought to do so.

There's presumably room for this to get uglier, but not a lot, as Mr. Lee ("rasengan") and his helpers are likely to end up very soon owning, at most, a trademark, a corporate entity, and three Internet domains, but hardly any IRC usage to go with that.

Upheaval at freenode

Posted May 25, 2021 1:39 UTC (Tue) by pabs (subscriber, #43278) [Link]

https://gist.github.com/prawnsalad/4ca20da6c2295ddb06c164...
https://news.ycombinator.com/item?id=27267733

Upheaval at freenode

Posted May 25, 2021 3:22 UTC (Tue) by pabs (subscriber, #43278) [Link]

https://archlinux.org/news/move-of-official-irc-channels-...

Upheaval at freenode

Posted May 25, 2021 3:26 UTC (Tue) by pabs (subscriber, #43278) [Link]

https://anarc.at/blog/2021-05-24-leaving-freenode/

Upheaval at freenode

Posted May 26, 2021 2:04 UTC (Wed) by pabs (subscriber, #43278) [Link]

http://www.fsf.org/events/community-meeting-on-the-future...

Upheaval at freenode

Posted May 26, 2021 3:24 UTC (Wed) by pabs (subscriber, #43278) [Link]

Freenode are now routinely hijacking channels that indicate they moved to Libera. When they do it looks somewhat like this:

<-- ChanServ (ChanServ@services.) has left #foo
--> freenodecom (freenode-placehol from ~com@freenode/staff) has joined #foo
* OperServ gives channel operator status to freenodecom
* freenodecom gives channel operator status to freenodecom
* freenodecom has changed the topic to: This channel has moved to ##foo. The topic is in violation of freenode policy: https://freenode.net/policies
<freenodecom> This channel has been reopened with respect to the communities and new users. The topic is in violation of freenode policy: https://freenode.net/policies
* freenodecom removes channel operator status from foo-chan-op
* freenodecom removes voice from foo-chan-op
* ChanServ sets mode +i on #foo
* ChanServ sets mode +m on #foo
* ChanServ sets mode +p on #foo
* ChanServ sets mode +c on #foo
* ChanServ sets mode +f on #foo ##foo
* ChanServ removes ban on ...
* ChanServ removes ban on ...
<freenodecom> The new channel is ##foo
<-- freenodecom (~com@freenode/staff) has left #foo

The new channels just have ChanServ and one freenode staff member in them.

Upheaval at freenode

Posted May 26, 2021 3:55 UTC (Wed) by jamesh (guest, #1159) [Link]

Among many others, this has happened to the #wikipedia and #ubuntu channels.

Upheaval at freenode

Posted May 26, 2021 4:16 UTC (Wed) by pabs (subscriber, #43278) [Link]

A related global notice:

-rasengan- [Global Notice] In the recent policy enforcement, some channels were erroneously included. We greatly apologize for the inconvenience. Please contact us in #freenode-services or contact-us@freenode.net. Thanks for your patience and choosing freenode!

Upheaval at freenode

Posted May 26, 2021 4:17 UTC (Wed) by laf0rge (subscriber, #6469) [Link]

we just had that happen to #osmocom, too.

I think that kind of action now really disqualifies what is left of freeonde.

I dout it is a violation of their poilicy to begin with.

Even if there was a related policy, it would obviously be highly questionable. Anyone is free to move their channels / meeting points / ... anywhere, and informing their users about such a move (using factual language without any accusations, defamations, ...) is nothing but a service to the users / members of that community.

Upheaval at freenode

Posted May 26, 2021 5:27 UTC (Wed) by jamesh (guest, #1159) [Link]

They're claiming that these notices in channel topics were spam. There is a mention in the policies document that "inappropriate advertising" is off-topic, so presumably that's their justification.

Upheaval at freenode

Posted May 26, 2021 6:36 UTC (Wed) by flussence (subscriber, #85566) [Link]

It should be clarified here that the policies document was rewritten in a hurry *after* Lee's power trip began, to retroactively justify it. The original version clearly stated abandoned channels would remain untouched for 60 days after last activity before releasing them. i.e. the sort of responsible behaviour you'd expect on a FOSS IRC network.

Worth reading the github diffs for that; the new version has some telling omissions besides that one.

Upheaval at freenode

Posted May 26, 2021 7:14 UTC (Wed) by jamesh (guest, #1159) [Link]

They don't seem to be using abandonment as the excuse for today's channel hijackings. The "inappropriate advertising" language was in the policies before the recent changes, but I don't think anyone would have interpreted them to allow this kind of thing.

Upheaval at freenode

Posted May 26, 2021 5:05 UTC (Wed) by pabs (subscriber, #43278) [Link]

Some folks are going to challenge the hijacking:

https://twitter.com/laurenceb/status/1397409061348331521

Upheaval at freenode

Posted May 26, 2021 6:10 UTC (Wed) by pabs (subscriber, #43278) [Link]

"just seized over 700 channels on freenode because they mentioned libera.chat in their topic."

https://mastodon.sdf.org/@kline/106299403921451814 https://news.ycombinator.com/item?id=27286628

Upheaval at freenode

Posted May 26, 2021 6:24 UTC (Wed) by flussence (subscriber, #85566) [Link]

The network is walking dead. I don't think I've ever seen someone destroy internet infrastructure out of petty greed with such sheer bandwidth, and that includes everything Yahoo ever did.

Without a hint of irony: I encountered script kiddies (actual kids at that) in the early 00s that had much higher competence and maturity than Lee is displaying. He obviously didn't gain the riches he used to buy this name through legitimate means because he clearly has no clue what he's doing, has no people skills whatsoever, and isn't even a convincing liar.

I'll just be over here hoarding popcorn for the coming day when they get vaporized in court (the holding company's under UK jurisdiction, this is *all kinds* of Computer Misuse, and Lee is practically assaulting hornet nests with a cricket bat at this point).

Upheaval at freenode

Posted May 26, 2021 14:09 UTC (Wed) by fuhchee (guest, #40059) [Link]

That's not hijacking, that's garbage collection.

Upheaval at freenode

Posted May 27, 2021 12:35 UTC (Thu) by immibis (subscriber, #105511) [Link]

After 60 days it is garbage collection.

Upheaval at freenode

Posted May 26, 2021 14:27 UTC (Wed) by jandrusk (guest, #152440) [Link]

So are they claiming the fact that the topic is moving to Libera in violation of their policy? What a joke.

Upheaval at freenode

Posted May 28, 2021 17:27 UTC (Fri) by kurtseifried (guest, #57307) [Link]

I assigned CVE-2021-1000189 https://json.distributedweaknessfiling.org/CVE-2021-1000189 for this previously, hoping for more of a "here's a potential exposure/risk" but I've since updated it as this has clearly turned into a major problem that needs to be dealt with.

Upheaval at freenode

Posted May 26, 2021 3:40 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://freenode.net/news/for-foss

Upheaval at freenode

Posted May 26, 2021 4:15 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://fsfe.org/news/2021/news-20210525-01.en.html

Upheaval at freenode

Posted May 26, 2021 6:40 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://fridge.ubuntu.com/2021/05/26/announcing-ubuntus-m...

Upheaval at freenode

Posted May 26, 2021 8:39 UTC (Wed) by pabs (subscriber, #43278) [Link]

https://www.gentoo.org/news/2021/05/26/gentoo-freenode-ch...

Upheaval at freenode

Posted May 26, 2021 17:14 UTC (Wed) by rickmoen (subscriber, #6943) [Link]

Unsurprisingly, Silicon Valley Linux User Group's Freenode channel #svlug has now been hijacked by Mr. Lee's staff along with the hundreds of others, and I was de-op'd and de-voice'd.

03:24 -!- ServerMode/#svlug [+o ChanServ] by tepper.freenode.net
20:04 -!- mode/#svlug [+o freenodecom] by OperServ, freenodecom
20:04 -!- freenodecom changed the topic of #svlug to: This channel has moved to
          ##svlug. The topic is in violation of freenode policy:
          https://freenode.net/policies
20:04 &t;@freenodecom> This channel has been reopened with respect to the
                     communities and new users. The topic is in violation of
                     freenode policy: https://freenode.net/policies
20:04 -!- mode/#svlug [-ov redrick redrick] by freenodecom
20:04 &t;@freenodecom> The new channel is ##svlug
20:04 -!- mode/#svlug [+impscf ##svlug] by ChanServ
Day changed to 26 May 2021

I hope these guys understand that Hell will freeze over before anyone ever trusts them again.

Upheaval at freenode

Posted May 26, 2021 17:37 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link]

> I hope these guys understand that Hell will freeze over before anyone ever trusts them again.

I am puzzled by this. Typically a move like this can atleast be explained as serving some sort of self interest. I don't see the gain here. This is nearly universally going to drive all users away from freenode to other IRC places or matrix and what not and freenode will be left with a largely empty shell. Is that worth something?

Upheaval at freenode

Posted May 26, 2021 17:54 UTC (Wed) by halla (subscriber, #14185) [Link]

Not everything, by a long chalk, that people do is informed by rational self-interest. In this case, from what I've read, the reason is plain insecurity: the person behind all of this was so afraid his safe haven, freenode, would change or taken away that they wanted to control it, and now control is slipping is getting more and more desperate. Sorry, not going to link to where I read that theory first, in all the turmoil, I cannot find the link in any case.

Upheaval at freenode

Posted May 27, 2021 8:18 UTC (Thu) by karkhaz (subscriber, #99844) [Link]

Sounds like you're referring to

https://ariadne.space/2021/05/20/the-whole-freenode-kerfl...

specifically the "So, why does he want to control freenode anyway?" section, which links to a post that Lee wrote on irc.com:

https://www.irc.com/lets-take-irc-further

Upheaval at freenode

Posted May 26, 2021 18:13 UTC (Wed) by rickmoen (subscriber, #6943) [Link]

I suspect they can't pull themselves away from the doubling-down spiral. Although putting a name to something doesn't explain it, I would call what we're seeing a classic administration antipattern.

Admins take initial control-freak missteps that draw attention and alienate people. Those people seek to let others know what happen, start to leave, and try to let others know of their ongoing departure. The admins react by disallowing and punishing those signs of unhappiness and departure, expanding their authority to wield greater control-freakery and silence unhappiness and sounds of longtimers voting with their feet.

Although the antipattern is obviously self-defeating, when the only plan you have is a bad one and it's failing, it's natural to try it harder. Thuggery working poorly suggests applying greater thuggery.

In a few years, this will be an instructive case study in errors to avoid.

Upheaval at freenode

Posted May 27, 2021 6:54 UTC (Thu) by mjg59 (subscriber, #23239) [Link]

I think this is due to a fundamental misconception about why people use Freenode. Andrew Lee seems to believe that people are on Freenode because they *want to be on Freenode*, not because that's just where the project channels they want to be on happen to be. From that perspective, projects migrating to other networks are actually taking away the space that Freenode users would use to discuss that project, and reclaiming the channel gives that back. But this seems fundamentally at odds with the idea that Freenode exists as a home to the FOSS community, an entity that has a reason to exist only so long as the FOSS community want to utilise it. In reality I strongly suspect that the majority of Freenode users are there because the projects they're interested in are there, not because they have any attachment to Freenode at all.

Upheaval at freenode

Posted May 27, 2021 0:43 UTC (Thu) by rickmoen (subscriber, #6943) [Link]

Today, someone altered my password for the "redrick" nick I've has since Rob "lilo" Levin created Freenode over 20 years ago. Curious. (I re-set it.)

Returning to the bigger picture: Today, Freenode admins have continued their efforts to mass-alienate channel owners, including:

Seizing #rhel (IBM / Red Hat, Inc.)

Likewise #osuosl (OSU Open Source Lab), #ubuntu, and of course many others.

Removing IBM / Red Hat as channel ops from its own #rhel channel seems particularly edgy: Perhaps someone will soon get tutored in trademark and other business tort law.

There is now a FAQ about how to optimally inform users of an established IRC channel about departure to elsewhere — but, at present, if you implement that good advice on Freenode, your work will be erased and your channel seized.

Upheaval at freenode

Posted May 28, 2021 17:28 UTC (Fri) by kurtseifried (guest, #57307) [Link]

Upheaval at freenode

Posted May 29, 2021 23:58 UTC (Sat) by rickmoen (subscriber, #6943) [Link]

To further help future historians, concerning the Andrew Lee self-own of May 2021:

Hugo Landau ("hl") has now published a follow-up, detailing the (apparently fully automated) mass-seizure of (reportedly) 700+ channels, the resulting collateral damage, and the various ways in which Lee's iteration of Freenode violated its own policies and the rights of longtime users, through the way that mass-seizure got carried out.

Landau's conclusions strike me as worth quoting verbatim:

"It seems to me that the findings above at this point only hasten the urgency of evacuating Freenode. Even if a channel finds the Hotel California-style attitude that Freenode's new custodians are taking to the prospect of any channel leaving Freenode to be acceptable (and I cannot imagine why they would), since Freenode now sees fit to enforce this via automated systems based purely on heuristics, no channel is necessarily safe. Even channels which have been registered for years, which are in continuous use and which are wholly compliant Freenode policies can have their registrations seized and the channel forcibly shut if they offend an automated system's heuristic.

Privacy implications. Furthermore, it should be noted that this automated channel takeover system, in taking over some channel #x, configures a channel forward to ##x. However, it has been noted that since channels do not have +s (secret; hide from channel listings) by default, by creating ##x for every channel #x which is seized by this automated system, this reveals publicly in the channel listings the existence of channels which otherwise would have been secret and concealed from public channel listings. So the above is not only a disaster in its own terms, it also may have had the effect of revealing the existence of numerous unlisted channels and undermining their privacy. Not only that, because people attempting to join the original channel #x get automatically forwarded to the channel ##x, anyone can determine who attempts to join the original channel simply by joining ##x, allowing the members of a secret channel to be leaked."

Upheaval at freenode

Posted Jun 1, 2021 2:42 UTC (Tue) by pabs (subscriber, #43278) [Link]

https://github.com/siraben/freenode-exodus

Upheaval at freenode

Posted Jun 1, 2021 14:28 UTC (Tue) by flussence (subscriber, #85566) [Link]

Firstly: thanks for collecting all these links. It's easy to rubberneck this whole thing but it takes presence of mind to document it for the history books.

I wonder if any of the infra sponsors providing the original server rotation (hostnames named after authors) have weighed in. According to netsplit.de a number of them are providing free lunch to freenode's new owners.

Upheaval at freenode

Posted Jun 1, 2021 14:39 UTC (Tue) by pabs (subscriber, #43278) [Link]

I wasn't involved in that github page at all, just saw it mentioned on IRC.

I haven't seen any mention of infra sponsors fleeing freenode, not sure if they were notified about the situation.

Upheaval at freenode

Posted Jun 2, 2021 0:50 UTC (Wed) by flussence (subscriber, #85566) [Link]

I meant all the links posted *here* :)

Upheaval at freenode

Posted Jun 2, 2021 1:42 UTC (Wed) by pabs (subscriber, #43278) [Link]

Ah, at some point I got overwhelmed/bored and stopped posting links, but the freenode-exodus one seemed like a good overview to have.

Statistics

Posted Jun 7, 2021 23:49 UTC (Mon) by jengelh (subscriber, #33263) [Link]

Just in case I'm looking for the fancy graphs in a year's time again: https://netsplit.de/networks/top10.php

Statistics

Posted Jun 8, 2021 10:37 UTC (Tue) by geert (subscriber, #98403) [Link]

Freenode needs 50% more servers to host one third less users than before?

Sounds like an old migrating-to-microsoft-email joke ;-)

Upheaval at freenode

Posted Jun 15, 2021 0:54 UTC (Tue) by pabs (subscriber, #43278) [Link]

There are now rumours that the new freenode owners are planning to drop their user database and start from scratch with a new codebase and new owners. Also these global notices appeared:

[Global Notice 1/3] We are moving past legacy freenode to a new fork. The new freenode is launched. You will slowly be disconnected and when you reconnect, you will be on the new freenode. We patiently await to welcome you in freedom's holdout - the freenode.
[Global Notice 2/3] If you're looking to connect now, you can already /server chat.freenode.net 6697 (ssl) or 6667 (plaintext). It's a new genesis for a new era. Thank you for using freenode, and Hello World, from the future. freenode is IRC. freenode is FOSS. freenode is freedom.
[Global Notice 3/3] When you connect, register your nickname and your channel and get started. It's a new world. We're so happy to welcome you and the millions of others. We will be posting more information in the coming days on our website and twitter. Otherwise, see you on the other side!

https://paste.ubuntu.com/p/KPXwdzD9Yf/ https://www.irccloud.com/pastebin/raw/Exiq8XAu

Upheaval at freenode

Posted Jun 15, 2021 6:29 UTC (Tue) by Nemo_bis (guest, #88187) [Link]

See https://www.devever.net/~hl/freenode_suicide