LWN: Comments on "Upheaval at freenode"

Upheaval at freenode

Nemo_bis — Tue, 15 Jun 2021 06:29:42 +0000

See https://www.devever.net/~hl/freenode_suicide

Upheaval at freenode

pabs — Tue, 15 Jun 2021 00:54:56 +0000

There are now rumours that the new freenode owners are planning to drop their user database and start from scratch with a new codebase and new owners. Also these global notices appeared:

[Global Notice 1/3] We are moving past legacy freenode to a new fork. The new freenode is launched. You will slowly be disconnected and when you reconnect, you will be on the new freenode. We patiently await to welcome you in freedom's holdout - the freenode.
[Global Notice 2/3] If you're looking to connect now, you can already /server chat.freenode.net 6697 (ssl) or 6667 (plaintext). It's a new genesis for a new era. Thank you for using freenode, and Hello World, from the future. freenode is IRC. freenode is FOSS. freenode is freedom.
[Global Notice 3/3] When you connect, register your nickname and your channel and get started. It's a new world. We're so happy to welcome you and the millions of others. We will be posting more information in the coming days on our website and twitter. Otherwise, see you on the other side!

https://paste.ubuntu.com/p/KPXwdzD9Yf/ https://www.irccloud.com/pastebin/raw/Exiq8XAu

Statistics

geert — Tue, 08 Jun 2021 10:37:43 +0000

Freenode needs 50% more servers to host one third less users than before?

Sounds like an old migrating-to-microsoft-email joke ;-)

Statistics

jengelh — Mon, 07 Jun 2021 23:49:04 +0000

Just in case I'm looking for the fancy graphs in a year's time again: https://netsplit.de/networks/top10.php

Upheaval at freenode

pabs — Wed, 02 Jun 2021 01:42:33 +0000

Ah, at some point I got overwhelmed/bored and stopped posting links, but the freenode-exodus one seemed like a good overview to have.

Upheaval at freenode

flussence — Wed, 02 Jun 2021 00:50:47 +0000

I meant all the links posted *here* :)

Upheaval at freenode

pabs — Tue, 01 Jun 2021 14:39:40 +0000

I wasn't involved in that github page at all, just saw it mentioned on IRC.

I haven't seen any mention of infra sponsors fleeing freenode, not sure if they were notified about the situation.

Upheaval at freenode

flussence — Tue, 01 Jun 2021 14:28:59 +0000

Firstly: thanks for collecting all these links. It's easy to rubberneck this whole thing but it takes presence of mind to document it for the history books.

I wonder if any of the infra sponsors providing the original server rotation (hostnames named after authors) have weighed in. According to netsplit.de a number of them are providing free lunch to freenode's new owners.

Upheaval at freenode

pabs — Tue, 01 Jun 2021 02:42:39 +0000

https://github.com/siraben/freenode-exodus

Upheaval at freenode

rickmoen — Sat, 29 May 2021 23:58:01 +0000

To further help future historians, concerning the Andrew Lee self-own of May 2021:

Hugo Landau ("hl") has now published a follow-up, detailing the (apparently fully automated) mass-seizure of (reportedly) 700+ channels, the resulting collateral damage, and the various ways in which Lee's iteration of Freenode violated its own policies and the rights of longtime users, through the way that mass-seizure got carried out.

Landau's conclusions strike me as worth quoting verbatim:

"It seems to me that the findings above at this point only hasten the urgency of evacuating Freenode. Even if a channel finds the Hotel California-style attitude that Freenode's new custodians are taking to the prospect of any channel leaving Freenode to be acceptable (and I cannot imagine why they would), since Freenode now sees fit to enforce this via automated systems based purely on heuristics, no channel is necessarily safe. Even channels which have been registered for years, which are in continuous use and which are wholly compliant Freenode policies can have their registrations seized and the channel forcibly shut if they offend an automated system's heuristic.

Privacy implications. Furthermore, it should be noted that this automated channel takeover system, in taking over some channel #x, configures a channel forward to ##x. However, it has been noted that since channels do not have +s (secret; hide from channel listings) by default, by creating ##x for every channel #x which is seized by this automated system, this reveals publicly in the channel listings the existence of channels which otherwise would have been secret and concealed from public channel listings. So the above is not only a disaster in its own terms, it also may have had the effect of revealing the existence of numerous unlisted channels and undermining their privacy. Not only that, because people attempting to join the original channel #x get automatically forwarded to the channel ##x, anyone can determine who attempts to join the original channel simply by joining ##x, allowing the members of a secret channel to be leaked."

Upheaval at freenode

kurtseifried — Fri, 28 May 2021 17:28:02 +0000

I assigned CVE-2021-1000189 https://json.distributedweaknessfiling.org/CVE-2021-1000189 for this previously, hoping for more of a "here's a potential exposure/risk" but I've since updated it as this has clearly turned into a major problem that needs to be dealt with.

Upheaval at freenode

kurtseifried — Fri, 28 May 2021 17:27:09 +0000

Upheaval at freenode

flussence — Fri, 28 May 2021 01:39:51 +0000

One of the new staff authored an IRC client with a remote backdoor to give him access to users' logs. Another proactively namesearches the internet and harasses people from sockpuppet accounts.

But if you're leading with “so what”, you probably need to go see for yourself what new freenode is about. I've heard the #fsf channel is nice this time of year.

Upheaval at freenode

immibis — Thu, 27 May 2021 12:35:56 +0000

After 60 days it is garbage collection.

Upheaval at freenode

karkhaz — Thu, 27 May 2021 08:18:10 +0000

Sounds like you're referring to

https://ariadne.space/2021/05/20/the-whole-freenode-kerfl...

specifically the "So, why does he want to control freenode anyway?" section, which links to a post that Lee wrote on irc.com:

https://www.irc.com/lets-take-irc-further

Upheaval at freenode

mjg59 — Thu, 27 May 2021 06:54:50 +0000

I think this is due to a fundamental misconception about why people use Freenode. Andrew Lee seems to believe that people are on Freenode because they *want to be on Freenode*, not because that's just where the project channels they want to be on happen to be. From that perspective, projects migrating to other networks are actually taking away the space that Freenode users would use to discuss that project, and reclaiming the channel gives that back. But this seems fundamentally at odds with the idea that Freenode exists as a home to the FOSS community, an entity that has a reason to exist only so long as the FOSS community want to utilise it. In reality I strongly suspect that the majority of Freenode users are there because the projects they're interested in are there, not because they have any attachment to Freenode at all.

Upheaval at freenode

rickmoen — Thu, 27 May 2021 00:43:06 +0000

Today, someone altered my password for the "redrick" nick I've has since Rob "lilo" Levin created Freenode over 20 years ago. Curious. (I re-set it.)

Returning to the bigger picture: Today, Freenode admins have continued their efforts to mass-alienate channel owners, including:

Seizing #rhel (IBM / Red Hat, Inc.)

Likewise #osuosl (OSU Open Source Lab), #ubuntu, and of course many others.

Removing IBM / Red Hat as channel ops from its own #rhel channel seems particularly edgy: Perhaps someone will soon get tutored in trademark and other business tort law.

There is now a FAQ about how to optimally inform users of an established IRC channel about departure to elsewhere — but, at present, if you implement that good advice on Freenode, your work will be erased and your channel seized.

Upheaval at freenode

rickmoen — Wed, 26 May 2021 18:13:38 +0000

I suspect they can't pull themselves away from the doubling-down spiral. Although putting a name to something doesn't explain it, I would call what we're seeing a classic administration antipattern.

Admins take initial control-freak missteps that draw attention and alienate people. Those people seek to let others know what happen, start to leave, and try to let others know of their ongoing departure. The admins react by disallowing and punishing those signs of unhappiness and departure, expanding their authority to wield greater control-freakery and silence unhappiness and sounds of longtimers voting with their feet.

Although the antipattern is obviously self-defeating, when the only plan you have is a bad one and it's failing, it's natural to try it harder. Thuggery working poorly suggests applying greater thuggery.

In a few years, this will be an instructive case study in errors to avoid.

Upheaval at freenode

halla — Wed, 26 May 2021 17:54:16 +0000

Not everything, by a long chalk, that people do is informed by rational self-interest. In this case, from what I've read, the reason is plain insecurity: the person behind all of this was so afraid his safe haven, freenode, would change or taken away that they wanted to control it, and now control is slipping is getting more and more desperate. Sorry, not going to link to where I read that theory first, in all the turmoil, I cannot find the link in any case.

Upheaval at freenode

rahulsundaram — Wed, 26 May 2021 17:37:09 +0000

> I hope these guys understand that Hell will freeze over before anyone ever trusts them again.

I am puzzled by this. Typically a move like this can atleast be explained as serving some sort of self interest. I don't see the gain here. This is nearly universally going to drive all users away from freenode to other IRC places or matrix and what not and freenode will be left with a largely empty shell. Is that worth something?

Upheaval at freenode

rickmoen — Wed, 26 May 2021 17:14:59 +0000

Unsurprisingly, Silicon Valley Linux User Group's Freenode channel #svlug has now been hijacked by Mr. Lee's staff along with the hundreds of others, and I was de-op'd and de-voice'd.

03:24 -!- ServerMode/#svlug [+o ChanServ] by tepper.freenode.net
20:04 -!- mode/#svlug [+o freenodecom] by OperServ, freenodecom
20:04 -!- freenodecom changed the topic of #svlug to: This channel has moved to
          ##svlug. The topic is in violation of freenode policy:
          https://freenode.net/policies
20:04 &t;@freenodecom> This channel has been reopened with respect to the
                     communities and new users. The topic is in violation of
                     freenode policy: https://freenode.net/policies
20:04 -!- mode/#svlug [-ov redrick redrick] by freenodecom
20:04 &t;@freenodecom> The new channel is ##svlug
20:04 -!- mode/#svlug [+impscf ##svlug] by ChanServ
Day changed to 26 May 2021

I hope these guys understand that Hell will freeze over before anyone ever trusts them again.

Upheaval at freenode

rickmoen — Wed, 26 May 2021 16:50:15 +0000

Newer statement:

"Gentoo Freenode channels have been hijacked

May 26, 2021

Today (2021-05-26) a large number of Gentoo channels have been hijacked by Freenode staff, including channels that were not yet migrated to Libera.chat. We cannot perceive this otherwise than as an open act of hostility and we have effectively left Freenode.

Please note that at this point the only official Gentoo IRC channels, as well as developer accounts, can be found on Libera Chat."

Upheaval at freenode

jandrusk — Wed, 26 May 2021 14:27:09 +0000

So are they claiming the fact that the topic is moving to Libera in violation of their policy? What a joke.

Upheaval at freenode

fuhchee — Wed, 26 May 2021 14:11:28 +0000

> I trust the staff who have moved to libera.chat, and I do not trust those left over at Freenode.

Excuse my bluntness but ... so what? What is the threat that staff you do not trust pose to the rest of us?

Upheaval at freenode

fuhchee — Wed, 26 May 2021 14:09:52 +0000

That's not hijacking, that's garbage collection.

Upheaval at freenode

pabs — Wed, 26 May 2021 08:39:33 +0000

https://www.gentoo.org/news/2021/05/26/gentoo-freenode-ch...

Upheaval at freenode

jamesh — Wed, 26 May 2021 07:14:17 +0000

They don't seem to be using abandonment as the excuse for today's channel hijackings. The "inappropriate advertising" language was in the policies before the recent changes, but I don't think anyone would have interpreted them to allow this kind of thing.

TLS

jamesh — Wed, 26 May 2021 07:06:50 +0000

If these gateways are broken by Diffie-Hellman key exchange, presumably they aren't running entirely independent TLS connections on either side. If they could arrange for both connections to use the same session key, it'd be possible to pass most of the traffic through without re-encrypting it. Traffic could be saved alongside the session key determined by MITMing the key exchange phase for later decryption.

It's clearly the kind of thing DH key exchange is intended to frustrate, but I can see why they might try to use it. You could handle significantly more connections on the same hardware compared to doing things the right way, and lower latency to boot.

Upheaval at freenode

pabs — Wed, 26 May 2021 06:40:22 +0000

https://fridge.ubuntu.com/2021/05/26/announcing-ubuntus-m...

Upheaval at freenode

flussence — Wed, 26 May 2021 06:36:40 +0000

It should be clarified here that the policies document was rewritten in a hurry *after* Lee's power trip began, to retroactively justify it. The original version clearly stated abandoned channels would remain untouched for 60 days after last activity before releasing them. i.e. the sort of responsible behaviour you'd expect on a FOSS IRC network.

Worth reading the github diffs for that; the new version has some telling omissions besides that one.

Upheaval at freenode

flussence — Wed, 26 May 2021 06:24:59 +0000

The network is walking dead. I don't think I've ever seen someone destroy internet infrastructure out of petty greed with such sheer bandwidth, and that includes everything Yahoo ever did.

Without a hint of irony: I encountered script kiddies (actual kids at that) in the early 00s that had much higher competence and maturity than Lee is displaying. He obviously didn't gain the riches he used to buy this name through legitimate means because he clearly has no clue what he's doing, has no people skills whatsoever, and isn't even a convincing liar.

I'll just be over here hoarding popcorn for the coming day when they get vaporized in court (the holding company's under UK jurisdiction, this is *all kinds* of Computer Misuse, and Lee is practically assaulting hornet nests with a cricket bat at this point).

Upheaval at freenode

pabs — Wed, 26 May 2021 06:10:17 +0000

"just seized over 700 channels on freenode because they mentioned libera.chat in their topic."

https://mastodon.sdf.org/@kline/106299403921451814 https://news.ycombinator.com/item?id=27286628

Upheaval at freenode

jamesh — Wed, 26 May 2021 05:27:55 +0000

They're claiming that these notices in channel topics were spam. There is a mention in the policies document that "inappropriate advertising" is off-topic, so presumably that's their justification.

Upheaval at freenode

pabs — Wed, 26 May 2021 05:05:58 +0000

Some folks are going to challenge the hijacking:

https://twitter.com/laurenceb/status/1397409061348331521

Upheaval at freenode

laf0rge — Wed, 26 May 2021 04:17:30 +0000

we just had that happen to #osmocom, too.

I think that kind of action now really disqualifies what is left of freeonde.

I dout it is a violation of their poilicy to begin with.

Even if there was a related policy, it would obviously be highly questionable. Anyone is free to move their channels / meeting points / ... anywhere, and informing their users about such a move (using factual language without any accusations, defamations, ...) is nothing but a service to the users / members of that community.

Upheaval at freenode

pabs — Wed, 26 May 2021 04:16:34 +0000

A related global notice:

-rasengan- [Global Notice] In the recent policy enforcement, some channels were erroneously included. We greatly apologize for the inconvenience. Please contact us in #freenode-services or contact-us@freenode.net. Thanks for your patience and choosing freenode!

Upheaval at freenode

pabs — Wed, 26 May 2021 04:15:30 +0000

https://fsfe.org/news/2021/news-20210525-01.en.html

Upheaval at freenode

jamesh — Wed, 26 May 2021 03:55:00 +0000

Among many others, this has happened to the #wikipedia and #ubuntu channels.

Upheaval at freenode

pabs — Wed, 26 May 2021 03:40:17 +0000

https://freenode.net/news/for-foss

Upheaval at freenode

pabs — Wed, 26 May 2021 03:24:25 +0000

Freenode are now routinely hijacking channels that indicate they moved to Libera. When they do it looks somewhat like this:

<-- ChanServ (ChanServ@services.) has left #foo
--> freenodecom (freenode-placehol from ~com@freenode/staff) has joined #foo
* OperServ gives channel operator status to freenodecom
* freenodecom gives channel operator status to freenodecom
* freenodecom has changed the topic to: This channel has moved to ##foo. The topic is in violation of freenode policy: https://freenode.net/policies
<freenodecom> This channel has been reopened with respect to the communities and new users. The topic is in violation of freenode policy: https://freenode.net/policies
* freenodecom removes channel operator status from foo-chan-op
* freenodecom removes voice from foo-chan-op
* ChanServ sets mode +i on #foo
* ChanServ sets mode +m on #foo
* ChanServ sets mode +p on #foo
* ChanServ sets mode +c on #foo
* ChanServ sets mode +f on #foo ##foo
* ChanServ removes ban on ...
* ChanServ removes ban on ...
<freenodecom> The new channel is ##foo
<-- freenodecom (~com@freenode/staff) has left #foo

The new channels just have ChanServ and one freenode staff member in them.