Freenode Network Hijacked, Passwords Compromised?

tmandry writes "The world's largest FOSS IRC network, FreeNode, was hijacked (for lack of a better term) by someone who somehow got a hold of the privileges of Robert Levin, AKA lilo, the head honcho of FreeNode and its parent organization, PDPC. To make matters worse, the passwords of many users may have been compromised by someone posing as NickServ, the service that most clients are configured to send a password to upon connecting, while they reconnected to the servers that hadn't been killed. Of course, if someone was able to nab lilo's password, every user password may have been ripe for the taking. The details are still unknown, but these events raise scary questions about the actual security of FreeNode and other organizations like it."

Comments

This is why I prefer the anarchy of efnet

[Anonymous Coward]

Even if someone hijacked it, who could ever tell the difference?

Re:This is why I prefer the anarchy of efnet

[kaden]

We had great fun with nickserv down. I was Jimbo Wales (jwales) for a while!

Re:This is why I prefer the anarchy of efnet

[assassinator42]

If the server was unlinked from the rest of the network, you could probably tell by the lack of people.

Re:This is why I prefer the anarchy of efnet

[weevlos]

In #bantown we have two EFnet server operators. As we sat there ruining freenet they were amazed how we had managed to get that far. On EFnet, oper blocks are for one specific host and all oper hosts are spoofed so you have to figure out the box that a given oper is on and root it before getting any further. lilo's host was bound to *@*, leaving his network ripe for our taking. EFnet, despite being what lilo calls a "normal IRC experience" is thousands of times safer and more stable than Freenode. The man should learn to run an IRC network before he asks people to pay him for it.
 
PS, lilo: I still have root on a server that's on the same switch as one of your precious Freenode servers. Next we'll be arpmitm'ing and spoofing the C/N lines to link in a hacked server. I'll let you have fun running around trying to guess which one that server is.
 
You have three days to post "I have been trolled by Bantown" on global notice.

Re:This is why I prefer the anarchy of efnet

[A beautiful mind]

I have one question.

Why are you a jackass?

Re:This is why I prefer the anarchy of efnet

[mr_stinky_britches]

EFnet now has chanfix...the days of lawlessness and channel raiding on EFnet are unfortunately things of the past :(

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Freenode .. people still use that ? 0_0

They will go down again soon too :) ;), more than nickserv was aquired lol ... they just dont know it yet

Re:This is why I prefer the anarchy of efnet

[turbofisk]

Trying to tell us how Freenode sucks, all I can see reinforces my views on EFnet...

Re:This is why I prefer the anarchy of efnet

[weevlos]

We are deputized by merit to punish the meritless. Your lack of perspective leads you to view us as wrongdoers. I assure you that the service which we provide humanity is a net positive boon. Systems without conflict or purgings become uselessly weak.

Rob Levin is a failure. He and his wife refuse to work. They are currently sucking off the teat of the federal government collecting disability for ADHD. He is a vile, disgusting example of modern American worthlessness and a sane society would expel him or put him in a work camp.

Re:This is why I prefer the anarchy of efnet

[ronz0o]

And it is the type of people like YOU that piss me off. "All hackers write viruses break stuff omgwtf." Chill out. I have found many security flaws, and reported them to the proper authorities. (Fashion Bug...ie, Charming Enterprises) Making it public like this is wrong, but it should have been done on a 1 to 1 basis. People DO listen when things like this may be compromised...

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

It must really suck to realize that your way to serve humanity turns out to be being deputized to pull petty tricks on some IRC admin.

Re:This is why I prefer the anarchy of efnet

[weevlos]

Yes, because a couple hours of work ruining a target we disliked was really the sole limit of our contribution to humanity. I'm sure as a snarky comment poster on slashdot you are perfectly capable of auditing code for 0-day vulnerabilities and then writing exploits for said vulnerabilities. Then you'd be perfectly capable of using them to root a box on the same switch as a freenode server and using ARP spoofing to play man-in-the-middle to all incoming connections. Petty tricks like these are surely not useful except for ruining Rob Levin! We should be ashamed at our lack of skill.

Re:This is why I prefer the anarchy of efnet

[IamTheRealMike]

You have three days to post "I have been trolled by Bantown" on global notice.

Or what? You'll attack FreeNode further?

Wow. Big deal. A chat service populated by geeks mostly working on open source projects, some of which I bet you use. It ain't big, it ain't clever, and about the most serious effect it'll have will be to annoy some people who will use some other method to communicate for a while. At least until either FreeNode recovers or we all migrate somewhere else.

Seriously. Of all the amazing things you could have done with your tick tick ticking time on this earth you choose to spend it kicking over sandcastles. Big waste. When the rest of us are 80 we'll look back on what we have achieved with life, the things we built, and we'll be proud. When you're 80 you'll look back on your life and think, man, that was so short! Why did I chuck my youth down the drain when I could have been getting shit done?

Re:This is why I prefer the anarchy of efnet

[IamTheRealMike]

In that case you are a hacker in the original sense of the word - a competent professional who Gets Things Done.

The OP was complaining about "hackers" in the ZOMG HOLLYWOOD!! sense of the word, usually people who want the thrill of Beating The Man without actually having to do anything dangerous, like getting off their seats.

Re:This is why I prefer the anarchy of efnet

[flacco]

ever wonder what it's like to be shot in the face?

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

I don't think your parent snarky comment poster was remarking about your skill.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

kisain, I must agree. This type of idiots are just losers.
To go and fuck up someone else's work (web site, server, IRC channel etc) or what ever and then think you are a big man... ha-ha-ha ... this is just so stupid!
How small, useless and pathetic "man" are you häckr-fuck?

You throw a stone and then you run. Get a life wanker!

Re:This is why I prefer the anarchy of efnet

[ronz0o]

Damn straight. I will always "test security" and "reporting" when I find a flaw. And to the kids who enjoy destroying / defacing...I hope you are caught. =)

Re:This is why I prefer the anarchy of efnet

[AEton]

I'm sure as a snarky comment poster on slashdot you are perfectly capable of auditing code for 0-day vulnerabilities and then writing exploits for said vulnerabilities. Then you'd be perfectly capable of using them to root a box on the same switch as a freenode server and using ARP spoofing to play man-in-the-middle to all incoming connections.

The first step is fine. The second step might even be okay.

The third step renders you essentially unemployable, should your employer find out.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

This is a dupe of "Immaturity Level Rising in Adults" http://science.slashdot.org/article.pl?sid=06/06/2 5/0456237.

Re:This is why I prefer the anarchy of efnet

[jonoid]

So, you consider yourself a hacker but you have a LiveJournal?!

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

And instead of destiny recognizing your überskills and giving you something useful to do, you're deputized by merit to merely annoy some irc users and an admin. And as if that was not hard enough, your faith is further tested by all these idiots lacking the perspective to realize that when giving Rob Levin a hard time, you are merely an impotent toy of humanity's all-encompassing purpose.

Some people really do get all the hardship. But always look at the bright side of life: maybe you can start a religion.

Re:This is why I prefer the anarchy of efnet

[Overly Critical Guy]

The OP was complaining about "hackers" in the ZOMG HOLLYWOOD!! sense of the word

No, it's "hackers" in the sense of the world that the vast majority of the world's population refers to it. Just because a tiny niche of geeks has decided that there's a difference between hacker and cracker and that hacker is the good one doesn't mean society is suddenly going to change its language just to make them feel good about calling themselves hackers.

Re:This is why I prefer the anarchy of efnet

[vertinox]

either he is a very stupid hacker or a very good troll who has nothing to do with this inccident

I mean all it would take a phone call to Livejournal to get him banned and have him turn over his IP and be tracked down to his ISP.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Oh yes, they'll track down his IP.

And do what with it?

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Rob Levin is a failure. He and his wife refuse to work. They are currently sucking off the teat of the federal government collecting disability for ADHD. He is a vile, disgusting example of modern American worthlessness and a sane society would expel him or put him in a work camp.

While petty vigilantism embodies the qualities that make our nation great. Let me guess. You just read Nietzsche for the first time, right?

Re:This is why I prefer the anarchy of efnet

[KiloByte]

No, it's idiots from Hollywood stealing our word and our name for nothing but an attempt to squash yet another penny from Joe Sixpack and soccer moms.
Bill's henchmen waging a rabid campaign against us don't help, too.

And remember: being a hacker doesn't mean you exploit security holes (for good or ill). It means that you employ a certain approach to programming/doing sysadmin tasks/solving physics problems/etc.

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

Re:This is why I prefer the anarchy of efnet

[IamTheRealMike]

I never said it wasn't .... I know what it means outside of Slashdot but as far as I know, "hacker" meant programmer first and digital attacker later.

I personally don't think of myself as a "hacker" and would never actually call myself that for the reason you mentioned, but the posters were mixing the two meanings up (no surprise as they're so close).

Re:This is why I prefer the anarchy of efnet

[Lord Ender]

Have you ever been 15? Everything is a game. Especially everything on the computer. 0wning this guy's chat server feels about the same as making a slam dunk right over a bigger defender's head, then joking about his mother. Just a game.

At that age, kids have never had responsability, and so are unable to feel empathy for those who they are harming.

I was an ornry teenager once, too. I recall sending ATH0 pings, sending OOB packets, mounting unprotected file shares, and feeling a thrill every time I one-upped these older, smarter people. The internet was just a Nintendo game to me.

This kid, like the others, is no more of a jackass than any other kid his age. He will just grow out of it with time, like everyone else.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

"We are deputized by merit to punish the meritless. Your lack of perspective leads you to view us as wrongdoers. I assure you that the service which we provide humanity is a net positive boon. Systems without conflict or purgings become uselessly weak."

I'm sure that's what the leaders of the Catholic church said when they started the Crusades.

Or what extremist muslims say prior to terrorist acts.

Before someone misinterprets what I just said, I'm going to point out that extremist muslims are in the vast minority of the muslim/islamic faith.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

So what you are saying is that if I somehow get Society to think of a Mad Scientist when someone says Scientist then the difference between Mad Scientist and Scientist will be nil?

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

At that age, kids have never had responsability, and so are unable to feel empathy for those who they are harming.

Having responsibility and being able to feel empathy are two orthogonal things (their are plenty people with lots of responsibility and little or no empathy). And the ability to feel empathy (and to act upon it to a certain degree) comes a lot earlier than the age 15 for most people.

This kid, like the others, is no more of a jackass than any other kid his age.

What kind of silly overgeneralization is this? At 15, there were quite a few kids my age who weren't such assholes, and there were also some others who were. The latter were by far a minority in my case, although of course bullies always manage to get some following among the less strong-willed. I would at least never describe this sort of behaviour as "normal".

He will just grow out of it with time, like everyone else.

Probably, but not necessarily. Some people remain assholes all their life.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

please to reporting this tested securities !

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

what morons think == ZOMG HOLLYWOOD! sense, yes.

Re:This is why I prefer the anarchy of efnet

[Zarel]

Although I agree with the majority of your post, I don't agree with this sentence:

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

Words mean whatever people say they mean. It's the very definition of 'tautology'.

Re:This is why I prefer the anarchy of efnet

[gerrysteele]

yes. many many dozens of thousands of people still use it, correct.

Re:This is why I prefer the anarchy of efnet

[gerrysteele]

quite right... if a word can be proven to have been in use for several years the Oxford English dictionary will define its meaning in terms of recent use. For instance, here in the UK, the word 'gay' has come to refer to anything that is crap or shit.

Re:This is why I prefer the anarchy of efnet

[KiloByte]

Of course, but don't forget that the same term can have completely different meanings for different parts of the society.

Re:This is why I prefer the anarchy of efnet

[shish]

No, it's "hackers" in the sense of the world that the vast majority of the world's population refers to it

By that rule, the screen is "the computer", the big box to the side is "the hard drive", and the thing you stick CDs in is "the cup holder" :-/

Re:This is why I prefer the anarchy of efnet

[TwentyLeaguesUnderLa]

I think this is an appropriate place to bring up a quote from paulgraham.com -

To the popular press, "hacker" means someone who breaks into computers. Among programmers it means a good programmer. But the two meanings are connected. To programmers, "hacker" connotes mastery in the most literal sense: someone who can make a computer do what he wants-- whether the computer wants to or not.

(And, also, whether the previous users/programmers of the computer want him to or not)

- http://paulgraham.com/gba.html

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Oh yes, they'll track down his IP.

And do what with it?

Well, if the owner of the network has anything to do with it hopefully he'll present this to the feds as a "cyber terrorism" case and get that little fucker thrown in the clink for most of his life... assuming he's a US citizen. If he's not, pursue it through Interpol or another appropriate organization and make sure this ass has an ulcer even if nothing happens to him in the end. Anybody who assists should get jail time as well.

It's just like vandalism: don't do it. Simple enough.

Re:This is why I prefer the anarchy of efnet

[Overly Critical Guy]

No, it's idiots from Hollywood stealing our word and our name for nothing but an attempt to squash yet another penny from Joe Sixpack and soccer moms.

It's not "idiots from Hollywood" taking "our" name. It's the majority of the population using the word in a certain way. You can keep painting some hijacking situation, but it's never going to stop the fact people use hacker a certain way. Hollywood didn't have much to do with it.

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

In short, yes, it does. It doesn't make people "mindless" just because they don't snap to attention and fit their language around your rigid little definition just to make you feel better. You come off as one of those angry, anti-social UNIX types who gets upset over completely trivial things like the usage of the word "hacker."

Re:This is why I prefer the anarchy of efnet

[Illbay]

"#Eliza: Hello. I am ELIZA. How can I help you?"

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Oh okay.
I translated for you: "they'll get the federal government to laugh at them because they HAVE NO PROOF. And then they'll seethe in impotent anger."

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

A punk kid getting what's coming to him in the form of thirty years in the slammer, now that's worth the three million dollars to incarcerate him. When 2036 rolls around, boy, won't he have learned his lesson.

It's a good thing we have people like you who aren't willing to make the slighest effort to do anything and prefer to throw money that doesn't belong to you at any problem that comes your way. And what a great solution it is: prison really works!

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

All work and no play makes the real mike sad and gay.

Re:This is why I prefer the anarchy of efnet

[stonecypher]

Because they're not smart enough to be productive. Same reason GNAA has always trolled. Same reason DarkFader writes viruses

I've have one question. Why are you still surprised?

Re:This is why I prefer the anarchy of efnet

[pele_smk]

You mean to tell me my password could have been compromised? Oh, boy; My IRC password was the "one". I need to change all of my passwords now, it's gonna be a long night at the server farm.

Re:This is why I prefer the anarchy of efnet

[Lord Ender]

"Having responsibility and being able to feel empathy are two orthogonal things"

Bullshit. If you have never had the responsibility of building and maintaining a heavily-used server (or doing something similar), you won't realize how hurtful it is to mess it up like this. To a kid, time is FREE, and what he is doing is costing the admin only time. He can empathize in general, but not in this situation because he can't appreciate the cost of an adult's time.

And you were either a really lame kid or you have a terrible memory. I never thought I was being an asshole when I did stuff like this that took up an adult's time. Hell, my quest in life was to find something to do with all the time. I was doing them a favor by wasting their time! Every kid I know did stuff like that sometimes, though it was usually in meatspace. Did you ever play a practical joke? No.. you were perfect when you were a young AC.

Re:This is why I prefer the anarchy of efnet

[SanityInAnarchy]

It's not "idiots from Hollywood" taking "our" name. It's the majority of the population using the word in a certain way.

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

In short, yes, it does.

I agree. But, some parts of the language are always in flux: "LOL" becomes "roflmfao" or "zomg rofl", "elite hacker" becomes "leet hax0r" becomes "31337 h4x0rz", "Own" -> "0wn" -> "p0wn3d", "crap" -> "gay" -> "ghey", the list goes on. You know this stuff is always going to be in flux, because it's mostly people from the younger generation who use language alone to make them sound cool.

In general, I acknowledge that both "convoluted cogitations" and "r0x0r your b0x0rs" are as correct as the English I'm using.

But, there are a few evoutions (bastardizations) of English that bother me a lot. One is misuse of apostrophies. It's not that hard -- "it's" means "it is". If you can replace "it's" with "it is", use an apostrophie. If you can replace "its" with "your" and have the sentence still make sense, don't use an apostrophie.

Another is the misuse of the word "hacker". Most of the time, when language evolves, the original meaning is not lost -- for instance, it's ok to use "shredder" to refer to a snowboarder, because most people won't be confused when you talk about the "shredder" that sits over a trash can and destroys documents. The problem is that while people haven't forgotten that "to hack" can also mean "to chop", people who know about the Hollywood Hacker will have completely forgotten about the MIT hacker and the Perl hacker. And we don't really have a better word for either of those.

Really. Replacing the MIT hacker with the word "prankster" is akin to replacing the Perl hacker with the word "coder". It doesn't do justice -- hackers are fundamentally different than most "programmers" or "coders". Hackers are neither software engineers nor codemonkies, though they may act as one for work.

I don't think nearly as much is lost when you replace "hacked in" with "broke in", or "hacker" with "cracker".

I don't often evangelize, as much as I love Mac/Linux. I realize that even if I'm 100% right and Windows is utter crap, nothing I say beyond explaining what Linux is (to those who don't know what an OS is) will make them switch. But the Hollywood Hacker is something I take personal offense at. I frequently call myself a hacker and clarify the term shortly after -- "What you call a 'hacker' is really a 'cracker'. The word 'hacker' has to do with a specific kind of clever programmer, and how the same cleverness can apply to other things."

Its as much a true mistake of language as the first word of this sentence.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Well, if the owner of the network has anything to do with it hopefully he'll present this to the feds as a "cyber terrorism" case and get that little fucker thrown in the clink for most of his life... assuming he's a US citizen.

Sure, because compromising an IRC server is just as bad as killing thousands of people.

Dickwad.

Re:This is why I prefer the anarchy of efnet

[stonecypher]

No, it's "hackers" in the sense of the world that the vast majority of the world's population refers to it.

Mmm hmm. Fusion bombs aren't nuclear because most people are too stupid to know the difference. Irony isn't cruel happenstance because most people are too stupid to know the difference. Translucent doesn't mean partially transparent just because most people are too stupid to know the difference.

This word doesn't change because of popular dumb either. Descriptivists are apologists who don't understand the difference between a mistake and progress. Don't fall for their trap; common usage just doesn't shift that fast. Believe it or not, reporters can be mistaken. Note for example that the word "alleged" has a critical and specific meaning in law, that someone has been convicted of a crime. Now, pay attention to your local news, who will call someone who is held under suspicion or awaiting trial "alleged."

If a whole bunch of people start calling your wife a boat, is that suddenly a new legitimate usage for the word "boat?"

Re:This is why I prefer the anarchy of efnet

[KiloByte]

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

In short, yes, it does. It doesn't make people "mindless" just because they don't snap to attention and fit their language around your rigid little definition just to make you feel better.

Only if you assume that the language-using society is a homogenous pool. You see, when our beloved GWB says "science", he has something completely different on mind than you and me. When I say "differential", you and me understand this as a term with a certain meaning, useful in a wide range of tasks; many people understand it as something restricted to "maths" only, while for the vast majority it's just unnatural mumbo jumbo.
But, now I sound like a megalomaniac, using "you and me" as "superior beings"; this is true only to a degree. A gardener knows a lot more about gardening than us, and he is superior in that regard. Also, note that the gardener will use a number of terms which, in his mind, mean something completely different from what we think they do. And, just because people who have no idea what a certain gardening term means, does this imply that the word changed its sense to what laymen think?

You come off as one of those angry, anti-social UNIX types

Uhm, because I am? :P

Re:This is why I prefer the anarchy of efnet

[stonecypher]

Words mean whatever people say they mean. It's the very definition of 'tautology'.

This is simply false. Words have an important historical usage context which is not discarded simply because one generation makes the mistake of listening to one badly educated entertainer. I'm not sure where this myth comes from, exactly, but I know not one single linguist who falls short of disgust for the legion of armchair quarterbacks professing this supposed deep understanding of the nature of the lexicon without ever having taken a linguistics class.

Grandparent is, in fact, correct. Words do not change simply because 1/4 of the population is a bunch of douchebags who don't know how to crack a book. When you're 50 and you watch these mistakes melt away in favor of the next generation's crop of errors, and begin to realize that these "changes" are impermanent, because they're merely errors, perhaps you'll begin to understand.

Linguistics is a science with a statistical and mathematical underpinning. Please do not further comment on its nature until you have at least a passing familiarity therewith, thank you.

Re:This is why I prefer the anarchy of efnet

[stonecypher]

In the context as I understood it, a hacker was simply someone who took a novel approach (typically a bizarre and often a shoddy job in the name of time or available materials) to a cerebral problem; thus, for example, one hacks out a schedule for next week until the full plans are set up, or sees a hackish repair job on an engine intended to carry it only as far as a mechanic. The term does, you'll remember, come originally from furniture manufacture.

That notwithstanding, thank you for being one of the few people who hasn't grafted into the "zomg my friends made the error too so now it's magically correct" sheep herd. I laud you your ability to stand up for common sense.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

And you were either a really lame kid or you have a terrible memory.

I guess I was a really lame kid, and that you were like the bullies I hated (declaring everyone not wanting to join their fun as "lame").

Did you ever play a practical joke?

Very seldom. I very well understood the "don't do to others what you don't want them to do to you" principle, as I've been enough on the receiving end. Maybe being often on the receiving end teaches you a lot about empathy on an early age. OTOH, by the age of 15 there were few bullies left, and even fewer with real influence.

Could be because of the science/maths classes I was taking though, as my brother (who studying mechanics) did encounter them until much later. Fortunately he's quite a bit tougher than I am.

No.. you were perfect when you were a young AC.

Not by a long shot.

Re:This is why I prefer the anarchy of efnet

[Ilgaz]

Even if he globally announces, FreeNode regulars won't see it.

Don't ask why ;)

PS: Have fun in jail since FreeNode isn't only about "lilo", there are many different kinds of people in some channels. I bet there are even Livejournal admin level guys who got effected by this lame thing. If you are trolling... Well, you shouldn't. ;)

Re:This is why I prefer the anarchy of efnet

[Ilgaz]

I bet there are non 15 years old people who can bring down Freenode to its knees in 5 minutes of time. I bet they hate lilo too.

Thing is they WON'T do such a thing since Freenode is home of many open source projects including stuff Slashdot runs on.

It is more like locking down a ER department for fun.

Re:This is why I prefer the anarchy of efnet

[Random832]

There are plenty of mistakes that _did_ become permanent, though. Time will tell, of course, whether "hacker" will become one of them, but see internecine. hacker may also be instructive.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

Is this the same weevlos?

I hope so!

Hilarious.

http://www2.flickr.com/photos/weevlos/

Re:This is why I prefer the anarchy of efnet

[whoop]

Words mean whatever people say they mean.

Ah, so that explains all my newer spam that reads like "Dictionary picture believes box nuts orange throws family..." actually was selling me some penis enlargers. I get it now.

Re:This is why I prefer the anarchy of efnet

[Tweekster]

Honestly, who gives a shit what soccer moms and joe six pack think ? they dont matter

Re:This is why I prefer the anarchy of efnet

[pclminion]

The original sense of the word "hacker" included the concept of "professional?" Are you flipping NUTS?

Re:This is why I prefer the anarchy of efnet

[Random832]

Heh. My password that I was (still) using for nickserv was _already_ compromised from a break-in at purdue over a year ago.

Re:This is why I prefer the anarchy of efnet

[Random832]

Note for example that the word "alleged" has a critical and specific meaning in law, that someone has been convicted of a crime.

You fail.

It's _leaving out_ "alleged" that requires that there have been a conviction (or some other sort of thing, depending on what the allegation is actually of).

Now, if a complaint hasn't actually been filed against the person in question, it's possible that there has not technically been an allegation. But you don't know that, since you've been operating under the assumption "If they're not convicted, it's not 'alleged'"

Re:This is why I prefer the anarchy of efnet

[crotherm]

"Having responsibility and being able to feel empathy are two orthogonal things"

Bullshit. If you have never had the responsibility of building and maintaining a heavily-used server (or doing something similar), you won't realize how hurtful it is to mess it up like this.

No.. I call BS on that. Emapthy is not something learned via building servers, it is something learned by building relationships. If you actually care about other people, then you will have the ability to extrapolate that caring to others. Not everyones learns this, however.

If this weevlos character is on the level, then he is just like anyother bully. The only solution is either maturity, or a good old fashioned ass whooping.

Of course, YMMV.

Re:This is why I prefer the anarchy of efnet

[Cruxus]

Tweekster (949766) wrote:

Honestly, who gives a shit what soccer moms and joe six pack think ? they dont matter

They vote, don't they? Well, some of them do anyway.

By the way, for those not linguistically inclined, the meanings of word often change over time. Sure, some purists may decree it's all in error, but we wouldn't be speaking English if it didn't happen. Hacker and hacking are hardly the first words this has happened to, and this isn't exclusive to English. Ever wonder why the Latin word for horse is equus (as in equestrianism), but we call the mounted division of an army (now tanks) the cavalry? In Late (Vulgar) Latin, the word for horse became caballus (originally meaning a pack-horse), and this is the generic word for horse that made it to French, Spanish, Italian, etc. Another example is the French word tête, which comes from Late Latin testa, slang for skull and later generalized to head. Of course, classicists know the word caput means head.

Re:This is why I prefer the anarchy of efnet

[Tweekster]

According to the last election where soccer moms were gonna be the big target, they dont.

The only thing computer related that even comes close to an issue of importance for those voters is MySpace, and even that hasnt really mattered yet. Hackers are barely on the rader of your average person. They know they exist, they know they sometimes do this and that. Other than that, any victims are "somebody" else, and its not there concern.

and I agree with your lesson on the evolution of language. People have this desire to keep words the same, when they simply will evolve and take on new meanings, there is no fighting it. Piracy means copyright infringement, it is a fact of life now. People try to say it only means stealing on the high seas, but they are wrong now.

Re:This is why I prefer the anarchy of efnet

[stonecypher]

And now for a lesson: referring to Wikipedia to settle issues of common misconception is an exercise in folly. When debating popular error, do not refer to the populace.

Re:This is why I prefer the anarchy of efnet

[Random832]

But the problem is, he has the meaning exactly backwards.

http://dictionary.reference.com/browse/allegation
http://www.answers.com/allegation

His belief about the meaning didn't even pass the laugh test, so I didn't feel the need to cite a better source than Wikipedia.

And I don't see why "one cannot allege a murderer" - sure, that particular construction is grammatically laughable, but one can allege that someone is a murderer, they would then be "the alleged murderer."

The idea that a crime is not "alleged" until someone has been convicted of it is so ridiculous that, even if I'm wrong, he's not right.

Re:This is why I prefer the anarchy of efnet

[Anonymous Coward]

LOL @ therewith.

Oh no!

[Rendo]

Not my fake password I use for insecure places all over the internet! What ever will I do!

Re:Oh no!

[Ash Vince]

Start changing it everywhere.

I'll see you back here next month when your finished.

Password on IRC and you're worried?

[garcia]

Ok, seriously, who here uses an important password on Freenode (or any IRC network) for NickServ? I certainly don't. Hell, my Slashdot password is more important than the one I use on IRC and the one I use here isn't even that secure...

I have no sympathy for someone that has an "at risk" password on IRC.

Re:Password on IRC and you're worried?

[Anonymous Coward]

your password is garcia123 isnt it?

Re:Password on IRC and you're worried?

[Anonymous Coward]

I bet you're glad you didn't "loose" your time learning English either.

Re:Password on IRC and you're worried?

[Anonymous Coward]

Oh how I wish I had an interesting of life as you. If only frequenting geek websites so I could call the people geeks were my passion.

Oh well, I guess I'll just have to go on living my non-life as a geek.

Re:Password on IRC and you're worried?

[Anonymous Coward]

Agreed 100%. Anyone using an "at risk" password which is sent in plaintext over the TCP/IP ether isn't thinking very hard. Does anyone really think that "/msg nickserv ident foo" is encrypted?

Re:Password on IRC and you're worried?

[_Sprocket_]

Amazing! I have the exact same password on my online storage account!

Re:Password on IRC and you're worried?

[thePowerOfGrayskull]

All that aside, the possibility that CS was compromised was only speculation; nothing so far has indicated that this has happened.

Re:Password on IRC and you're worried?

[Anonymous Coward]

Certainly not.  But I would recommend for extra security, using:
/quote nickserv identify foo

...instead, if your IRC server supports it.  It reduces the risk of an imposter snagging your password if Services should crash.

Re:Password on IRC and you're worried?

[hackstraw]

Hell, my Slashdot password is more important than the one I use on IRC and the one I use here isn't even that secure...

How secure is any password transmitted over the wire in plaintext?

Re:Password on IRC and you're worried?

[mboverload]

> How secure is any password transmitted over the wire in plaintext?

Unless the government is tapping the wire, just as secure as one sent encrypted.

Re:Password on IRC and you're worried?

[Random832]

except a lot more people could be tapping the wire than just the government.

Re:Password on IRC and you're worried?

[gmack]

You can do better than that.. On freenode the server password gets sent to nickserv so you can just put it in your connection settings. But your right.. anyone who does a /msg nickserv these days is an idiot. A lot seems wrong with this story... I don't see any info to collaberate what happened and what few details there are fly in the face of what I remember from my server donation days.

Re:Password on IRC and you're worried?

[Breakfast Pants]

I hope you aren't in a dorm room.

Re:Password on IRC and you're worried?

[Silver Gryphon]

Not anymore :)

Re:Password on IRC and you're worried?

[chkMINUS]

The Freenode admins certainly didn't.

Re:Password on IRC and you're worried?

[Anonymous Coward]

Ok, seriously, who here uses an important password on Freenode (or any IRC network) for NickServ? I certainly don't. Hell, my Slashdot password is more important than the one I use on IRC and the one I use here isn't even that secure...

Damn right its not that secure... been around here long enough to remember the "Whoops our db got 0wned and we saved all your passwords in cleartext fiasco"? Ah yes, /. and me an anonymous coward... makes sense don't it ;-).

Re:Password on IRC and you're worried?

[ultranova]

> How secure is any password transmitted over the wire in plaintext?

Unless the government is tapping the wire, just as secure as one sent encrypted.

Ethereal is a nice program that let's you monitor network traffick. It has helped me solve many network problems by letting me see what the machines are actually saying to each other; it does this by capturing all the packets (optionally filtered) in the network segment the machine running it is located in.

So, here's the correct form: "Plaintext is as secure as encrypted, unless the government or any other entity that has control over any machine in any network segment the packets travel through is tapping the wire." That's an unkown (but large) number of unkown variables that can break your security.

And of course you're talking about the government, but there's several governments that might gain access to the packets. It isn't enough to be able to trust your own, you have to be able to trust every government on the planet - and none of them seem particularly trustworthy to me.

So use the encryption, Luke, or you shall meet your destiny.

Re:Password on IRC and you're worried?

[joeljkp]

"But your right.. anyone who does a /msg nickserv these days is an idiot."

Hmm? The opening message when you connect to Freenode tells you to do just that.

What's the best way, and what's the risk of not doing it that way?

Re:Password on IRC and you're worried?

[gmack]

The servers have a /Nickserv command if your irc client doesn't support that then you can create an alias and it's something like /quote nickserv or /raw nickserv depending on your client. For sending the password you can enter it in with your server settings but that only works on some irc nets (freenode etc).

The main risk of not doing it that way is that if there is a netsplit and for some reason a server doesn't have it's nick quarantine lines setup correctly someone can pretend to be nickserv and just log all ident requests.

Re:Password on IRC and you're worried?

[Anonymous Coward]

> The servers have a /Nickserv command

Golly, yet another kludge hacked onto IRC and not documented.

What a surprise.

Maybe the real problem is that we continue to use IRC. Are they even securing the inter-server links anymore? Is IRC still enforcing a tree topography because the design is still too stupid to create a spanning tree on top of an arbitrary node graph?

There's so many things wrong with IRC it's easier to just mention what it does right. And I'm not sure what those are, because the RFC sure as hell doesn't match reality anymore.

yeah well

[scenestar]

*Don't auto ident during connect
*Don't use multiple passwords
*Change password after someone got ahold of it
*Realise that it's just a goddamn nickname

Re:yeah well

[MrShaggy]

*Realise that it's just a goddamn nickname. Now see.. you could be 'formerly known as scenestar'

Re:yeah well

[A.K.A_Magnet]

*Don't auto ident during connect

And if you auto-identify in your perform, do something like : /identify *pass* which is a server-side macro for "PRIVMSG NickServ@<services-fakeserver-hostname> :password".

The IRC protocol allows to send messages to Nick@server (means "send a message to 'Nick' if and only if he's on 'server'"), so you can do the same with services. Then if the Nickserv nickname is hijacked, it won't matter, because the services "fake server" cannot be hijacked without knowledge of hub configuration (C/N lines) and if ever it happens, IRC admins/opers will notice (that's not something you can't miss).

So either choose the macro (/identify) or the whole command. Or identify manually :)

Re:yeah well

[aymanh]

*Don't use multiple passwords

I suppose you mean "use different passwords for different levels of access"? The current story is an example of why do so, if someone uses the same password for their IRC nick and email or banking info, then their data is now at risk, they should assume that their other accounts are also compromised, and take the appropriate measures (change passwords).

Re:yeah well

[FooAtWFU]

The preferred method to identify is to send your password in the "IRC server password" field when you connect. This method is a lot more "out of band" than the rest of your transactions in the IRC protocol and cannot be hijacked short of replacing the IRCD process itself.

Re:yeah well

[A.K.A_Magnet]

Yeah, then the IRCd is made so it forwards the password field to the IRC services, using the method described above.

Re:yeah well

[Anonymous Coward]

nicknames are often linked to channel rights, to your cloack, to op status, etc. they could even get private information when identifying as you.
that's valid for most linux devs .. this is not quakenet.

Re:yeah well

[sbennett]

Unfortunately this won't work. The way Hyperion, Freenode's IRCD, is designed, server passwords not used as such get passed directly on to whoever happens to be using the nickname defined in the config as the 'identify service'. In Freenode's case, this just causes a PRIVMSG to be sent from your nick to NickServ, whichever server he happens to be using, with the identify command and password. It's no harder to hijack than a regular /msg. The same goes for the 'raw' nickserv commands, which are similarly translated to PRIVMSG.

This is compounded by the fact that due to the way Hyperion's server-hide works, it is in theory impossible for normal users to know which server another client is using, so '/msg NickServ@services.' doesn't work either.

ircd's and security

[proudhawk]

I am more that familiar with ircd and security
(having run a server network for better than 5 years).

Rule #1, the admin password is NEVER stored in nickserv.
anyone who does this deserves whatever it is they get!

its better to mod the conf file and do a command rehash
from the cli.

Re:ircd's and security

[Ash-Fox]

(having run a server network for better than 5 years)

The time you've ran a server network (A one server IRC network?) doesn't mean you automatically get experience.

Re:ircd's and security

[Krunch]

Why would you store any password anyway ?

Re:ircd's and security

[jZnat]

Rule #2: any important administrative tasks should be done via SSH in the first place, even for IRC.

Re:ircd's and security

[Anonymous Coward]

Unfortunately, the number or on-line chat tools with absolutely pitiful security models is quite scary. Most authors of such tools seem to rattle off the first 2 obvious features, and the 2 biggest annoying aspects of whatever they used before, write those in their new tool, and think they're done. In the process, they ignore the hard-won lessons of previous authors. Unfortunately, security is one of those hard-won lessons that they entirely ignore, and correcting it later is extremely painful.

come to think of it, much of that happens with software building tools, too. It's why there is a new crop of both types of tools every year, and why people keep falling back to older tools after they run into the same booby traps and can't be bothered to actually fix them.

Re:ircd's and security

[Ash-Fox]

Rule #2: any important administrative tasks should be done via SSH in the first place, even for IRC.

Some points to be made:

• A IRC connection in a SSH tunnel wouldn't of helped this.
• There are no tools I'm aware of that you can use to set global akills, modify services databases in real time, or do much of any IRCd/services modifications in real time like you can on IRC, from a bash prompt.
• If SSH was used, the guy would of accessed SSH instead (since he 'guessed' the password), which is worse, compromising the entire machine.

Re:ircd's and security

[Anonymous Coward]

All irc clients support SSL, it is networks not enabling it. I tell you one more thing. I think they should NOT allow plain connections even.

We all know IRC is an excellent target for tapping.

I wonder if some large networks thought about allowing SSL only clients and get "warned" by some guys not to do it.

Re:ircd's and security

[cortana]

I think the most important point to be made is that IRC is shite, and we should all have moved to Jabber years ago. :)

Re:ircd's and security

[graemecoates]

If SSH was used, the guy would of accessed SSH instead (since he 'guessed' the password), which is worse, compromising the entire machine.

Another good reason for using key-only based ssh authentication. At least the key (and passphrase) would need to be stolen to gain access over ssh.

Re:ircd's and security

[Ash-Fox]

Another good reason for using key-only based ssh authentication. At least the key (and passphrase) would need to be stolen to gain access over ssh.

The guy didn't even restrict his O-line to himself. I doubt he would of setup key-only authentication in SSH. This wouldn't of happened anyway if he had setup his O-lines 'properly'.

Re:ircd's and security

[Ash-Fox]

I think the most important point to be made is that IRC is shite, and we should all have moved to Jabber years ago. :)

• Jabber is a Instant Messaging protocol.
• When you're on a ISP that makes you pay per KB you send (often the case when you're on GPRS), you're better off using IRC as it's far less bandwith intensive.
• Administration on Jabber systems is a lot harder for most than on IRC.
• I'm also not aware of any Jabber clients which will automatically join 'conferences rooms'.

Re:ircd's and security

[Ash-Fox]

All irc clients support SSL

The clients on my mobiles, PDAs, do not.

it is networks not enabling it.

Very few people use it anyway when enabled. IRC networks don't use the standard port 994 for SIRC.

I tell you one more thing. I think they should NOT allow plain connections even.

Because nobody will think once their connections are being rejected on 6667 that the server must be in SSL mode only!

We all know IRC is an excellent target for tapping.

So is e-mail, aim, icq, msn, jabber, HTTP, ftp...

I wonder if some large networks thought about allowing SSL only clients and get "warned" by some guys not to do it.

The end conclusion was that the encryption gave too heavy loads on large IRC networks. Which is why it's often seen only on smaller IRC networks.

SIRC still wouldn't of stopped someone getting into a weak O-line.

Re:ircd's and security

[cortana]

Fine, fine, XMPP rather than Japper. You might want to clear your pedantry bit, it seems to be stuck high. :)

I don't buy that it's harder to adminstrate XMPP servers. I do it myself. IRC seems like a mass of horrible complexity to me. I suspect it is merely different.

You know...

[demongeek]

There will probably be a wave of two major camps -- those who say "oh this is nothing! Look at what happens to closed-source leakages from banks, etc, ad nauseum!!1"; there will also be a wave of people who say "this is a major break and someone should be shot..." While I understand both camps' thoughts and opinions, I have a single comment: is there really an expectation (whether FOSS or Closed Source) that it should be secure?

Granted, that person/company is probably relying on the money from ads or what have you so he hopes that things are secure. Really, though, if you don't think the service is secure, go to another one or start your own!

Re:You know...

[TheoMurpse]

is there really an expectation (whether FOSS or Closed Source) that it should be secure?

You missed the point entirely. Freenode is an IRC server FOR FOSS software which runs on the same server software as nearly all other major IRC servers. The summary is misleading, making readers think that Freenode is the only IRC server running on FOSS software, when really it's the largest server which focuses on supporting FOSS software (channels include #firefox, #python, #php, #linux, #gentoo, #ubuntu, #geoshell, etc.).

Explaining the jargon...

[kaden]

FOSS = Free and Open Source Software, in case anyone was wondering...

Re:Explaining the jargon...

[leenks]

You seriously felt the need to post that on Slashdot? :o

Re:Explaining the jargon...

[Anonymous Coward]

TY. (That means 'thank you.') Since this is posted in the IT section of /. (that's slashdot, in case you were wondering), I figured I'd explain what IT stands for. It is an abbreviation of 'Information Technology,' a field that is concerned with managing network and data infrastructure within organizations.

Re:Explaining the jargon...

[kaden]

YMMV, but IMHO, using possibly obscure acronyms ATT is a PITA, IYKWIM!!! Just write out the freaking acryonyms if you're writing (or "editing") a story thousands of people will read. After all, we aren't smarter-than-thou elitists at Slashdot, are we?

Re:Explaining the jargon...

[capiCrimm]

Slashdot is a popular technology-news website that can be found at slashdot.org. Just incase anyone was wondering.

Re:Explaining the jargon...

[Anonymous Coward]

Thank you. While I have been using open source for many years now, I tend to ignore what acronyms stand for. I'm usually just skimming an article, and don't really want to take the time to stop and think about "FOSS" or what other acronyms actually mean. I have better things to do with my time and memory than memorize every acronym that comes along.

Re:Explaining the jargon...

[Achra]

IANAL, but I play one on TV. I've been told to RTFM and STFU FTW.

OMGWTFBBQ.

Re:Explaining the jargon...

[A.K.A_Magnet]

After all, we aren't smarter-than-thou elitists at Slashdot, are we?

Yes we are! :) And proud of it. I understand there was some irony in your comment, but it makes me think of something else.

Something I hate on Digg is how in each thread of discussion someone feels obliged to explain everything (and how lame stories like "a super set of icons", "learning to program", etc. are posted). And why that?

The cost of joining Digg is null. You join, you digg, you reply. That's how 14 years old are now ruling Digg (while it was originally populated with slashdotters and other tech-oriented websites readers). That's Digg so-called "democracy" (except, in democracy, one is supposed [only supposed] to be mature before voting, that's why there's a minimal age, which unfortunately cannot be implemented on Digg; something great would be "you can choose up to 20 domains of expertise, can change only one every two weeks or month, and you can vote only on stories regarding your level of expertise". Plus some incentive to only have one (1) account).

Joining Slashdot is free, but there's a cost when you join: you're eaten alive by grammar and spelling nazis if you don't post correctly, you're eaten alive by an "expert" if you say something technically wrong, you receive negative mod points and get ignored, etc. That's why there are so many accounts and so few posters. And that's how Slashdot has been able to remain readable. I was no newbie when I first start reading Slashdot, but not being a newbie I already knew that you have to understand the subculture and the community first before participating (the same goes for IRC). So I actually registered and became myself a slashdotter years later. Most Diggers are newbies. That's why Digg is good for fresh news and lame for comments, while Slashdot is good for comments (but lame for fresh news). Because we're smarter-than-thou elitists.

Re:Explaining the jargon...

[EnsilZah]

This really should have been moded informative, people need to work on their sense of meta-humour. =\

Re:Explaining the jargon...

[dorkygeek]

Very well spoken, bro.

Re:Explaining the jargon...

[dorkygeek]

Yes, we are. Now head back to your cave on Digg Avenue, troll.

Re:Explaining the jargon...

[Anonymous Coward]

Foss = (Origin Cornish British) The entrenchment, moat, or ditch. Fos, Danish, a waterfall, cataract.

Source: An Etymological Dictionary of Family and Christian Names With an Essay on their Derivation and Import; Arthur, William, M.A.; New York, NY: Sheldon, Blake, Bleeker & CO., 1857.

Re:Explaining the jargon...

[Anonymous Coward]

There is a debian program that translates common computer acronyms...I just can't remember what its called.

Re:Explaining the jargon...

[insertwackynamehere]

this reminds me of when I first got into internet communities, the first messageboard I ever joined was doomworld.com. That is one of the most strict, tight-assed boards out there probably, and I'm glad thats the first one I joined now, because although I didnt realize it then, better to learn tough then to join some board where everyone has 500x500 avatars and every post is just a smiley. Doomworld doesnt even have smileys! We just have ASCII characters that stay that way when you post! haha anyways I think I see where you're coming from. also i should note that on Doomworld I'm one of the top 50 posters and probably pust thier limits to the max out of any other top poster on the board. So heh, I'm far from perfect in thier eyes but I'm a helluva lot better than I'd be somewhere else.

Re:Explaining the jargon...

[jZnat]

Well, for one, your average /.er is in his or her twenties typically, so there's almost always a guaranteed leap in maturity between [pre-]pubescence and adulthood.

Re:Explaining the jargon...

[MynockGuano]

wtf

Re:Explaining the jargon...

[QRDeNameland]

And here I was thinking all this time that all these FOSS references related to the American composer Lukas Foss.

Then again, I spent several years under the assumption that the Internet was inhabited by disproportionately large numbers of Lol Coxhill fans, so maybe I'm just a little slow on the uptake.

Re:Explaining the jargon...

[Anonymous Coward]

TY. (That means 'thank you.')

Don't be so fucking condescending.

(Condescending is when you talk down to somebody.)

Re:Explaining the jargon...

[ems2]

I.e. my parent post. In case any was wondering...

Re:Explaining the jargon...

[vertinox]

but there's a cost when you join: you're eaten alive by grammar and spelling nazis if you don't post correctly, you're eaten alive by an "expert" if you say something technically wrong, you receive negative mod points and get ignored, etc.

Really? I was under the impression it was the other way around? Or rather... One of the reasons we have meta-moderation systems because Mods were doing the opposite of what you are saying.

Re:Explaining the jargon...

[jkonrad]

Some of us are glad he did... saved me the effort of looking it up.

Re:Explaining the jargon...

[Kristoffer Lunden]

Informative is a moderation that can be applied to posts deemed to contain useful information.

Re:Explaining the jargon...

[bcat24]

Mods, ever heard of sarcasm?

Re:Explaining the jargon...

[WilliamSChips]

Metahumor is humor that references some other humor.

Re:Explaining the jargon...

[vonsneerderhooten]

What a glorious waste of mod points this is.

LOL

Re:Explaining the jargon...

[Anonymous Coward]

Well, not all of us on Slashdot are expert programmer/sysadmins like all of you. Maybe there are people out there like me who appreciate helpful hints (especially on acronyms). :D

Re:Explaining the jargon...

[Anonymous Coward]

LOL is the appropriate reaction that is to be given with respect to any attempt to prove the existence of vonneerderhooten's intellect or even sentience.

Re:Explaining the jargon...

[stonecypher]

After all, we aren't smarter-than-thou elitists at Slashdot, are we?

Yes we are! :) And proud of it. I understand there was some irony in your comment, but it makes me think of something else.

*sniffle* It's moments like these that make me think my endless hours bitching about what irony actually means are worth it. Thank you for making a geezer happy.

Re:Explaining the jargon...

[David E. Smith]

I always thought IT stood for "Internet Technique," until Chiyo-chan corrected me.

Re:Explaining the jargon...

[vonsneerderhooten]

...existence of vonneerderhooten's intellect...

Whew! I thought you were talking about me for a sec there.

Touche!

Re:Explaining the jargon...

[kiddygrinder]

Nah, there is only age limits on voting, not maturity limits. That is why digg has such a low signal to noise ratio, it's a more pure democracy.

spam

[Punto]

o noes, If someone got a hold of lilo's password, they could start spamming the users with useless server-wide notices nobody cares about!!1!

Re:spam

[Anonymous Coward]

Uhhh. How would this make freenode any different to normal, exactly? :P

Re:spam

[peterfa]

Funny you should say...

-ratbert- DCC SEND YOUAREALLJUDENLOL

Re:spam

[rogerramrod]

So what do you do when your network gets "cracked"?
That's right, you beg for more money to support your incompetent ass!

-lilo(i=levin@freenode/staff/pdpc.levin)- [Global Notice] Hi all. As you may be aware, freenode has experienced a crack attack
and we're working on tracking down the details. At this point, we cannot guarantee that more problems will not
occur.
-lilo(i=levin@freenode/staff/pdpc.levin)- [Global Notice] Once again I want to take the opportunity to mention that freenode
could use more of its own hardware resources and more server hosting resources. If you'd like to help, please email
staff@pdpc.us .... Thanks.

Re:spam

[Earered]

I have a different message

(00:30:43) lilo: (notice) [Global Notice] Hi all. As you are aware, we experienced an episode some hours ago in which a staff password was sniffed or cracked. It would be prudent for you to change your nickserv and chanserv passwords at this point. We're continuing to investigate what happened. Thanks for your patience.

Re:spam

[Eil]

And maybe even override their boot sector!

Re:spam

[hixie]

People actually see lilo's spam? Wow, I figured everyone had him on /ignore by now. Isn't that the first thing one does when connecting to freenode?

Re:spam

[Baloo Ursidae]

Actually, they really did spam everybody about it last night...

Re:spam

[stonecypher]

Cue the poker and penis enlargement ads in about (looks at watch) now.

Re:spam

[makomk]

Jun 25 06:07:46 -lilo- [Global Notice] Hi all. As you may be aware, freenode has experienced a crack attack and we're working on tracking down the details. At this point, we cannot guarantee that more problems will not occur.
Jun 25 06:09:18 -lilo- [Global Notice] Once again I want to take the opportunity to mention that freenode could use more of its own hardware resources and more server hosting resources. If you'd like to help, please email staff@pdpc.us .... Thanks.
...
Jun 25 23:30:19 -lilo- [Global Notice] Hi all. As you are aware, we experienced an episode some hours ago in which a staff password was sniffed or cracked. It would be prudent for you to change your nickserv and chanserv passwords at this point. We're continuing to investigate what happened. Thanks for your patience.

I assume you just weren't online to see the first two messages.

Re:spam

[cortana]

What are these messages everyone complains about? I have never recieved one.

Re:spam

[Earered]

I was, though I was in Europe, and I never received those two messages. The precedent message from lilo was a problem with some server and the connection between Europe and the U.S.
I guess that it was part of the "fun"

Oh noes! Got my password?!

[kjart]

Now somebody else will be able to idle as sk8trgrl69!!!!11111one

You know... a parental troll

[Anonymous Coward]

You are quite a bit off base. The reason freenode was hijacked wasn't because it was OpneSource. I hate it when useless drivel like this gets modded. Thank you and try trolling again on another article.

So Levin is just another "peer"?

[Baldrson]

You've reached freenode, a service of Peer-Directed Projects Center (PDPC).

But some "peers" are more "peer" than others, like Mr. Levin.

Welcome to Animal Farm.

Re:So Levin is just another "peer"?

[ZoFreX]

You may not know how right you are, I've been calling Freenode "Animal Farm" for weeks - Patrick McFarland (a.k.a. Diablo-D3) has been highlighting some of what's wrong with freenode and in doing so has become their "snowball" - he is literally blamed for everything that goes wrong on freenode, including the recent torbot attacks and no doubt this most recent one as well.

Re:So Levin is just another "peer"?

[Emmettfish]

Except that both lilo *and* Diablo-D3 are both utterly and completely useless. Lilo 'runs' an IRC network that totally sucks, and Diablo-D3 hits people up for money for his 'game' that has never, ever seen the light of day. I've managed a game project before, and it died (though people recently have indicated interest in bringing it back), but you don't see me spamming for money for it. You would also never see me spamming for money for a project that produces nothing.

When I was running Xiph.Org, both lilo and Diablo-D3 were spamming people for money. It's why Xiph (at least temporarily) left Freenode. Diablo-D3 waged a campaign against LinuxFund for their donations to Xiph which (did, and still does) created free and useful code for the community.

Matter of fact, back when Freenode had 'Freenode Radio,' I had given them a ton of original music to use. They played it for a while, and then took it off the air 'under mutual agreement with the artist,' which was simply a lie -- My music is public domain. The folks that made this claim were eventually caught, fessed up and apologized for lying to me and people that listened to the station. They sucked at this, too; They played my music long after they claimed to 'take it off the air,' they were just too dumb to look at the ID tags of the files.

Bob and Patrick are in the same boat. They're both useless, they're both stupid, they're both utterly ineffectual.

Don't know what to tell you, really. I don't have time for IRC anymore, but if I did, I wouldn't truck with *either* of those cats. Freenode is a black hole of idiocy, and if you really want to dive into it, go ahead -- Just don't expect logic, reason or honesty to win out over egotistical mania and deception. This may be true of *all* IRC networks, but Freenode is the only one where I've seen this kind of shit go down time and time again.

Freenode may be 'Animal Farm,' though without the Orwellian context. Lilo's just too damn stupid to play Napoleon. It's like a normal farm. Backward Farmer Bob Levin and his flock of sheep.

Re:So Levin is just another "peer"?

[FooAtWFU]

When I was running Xiph.Org, both lilo and Diablo-D3 were spamming people for money.

OMG. Freenode sends server notices a couple times a day during fundraising season. Gasp.

Freenode is a black hole of idiocy, and if you really want to dive into it, go ahead -- Just don't expect logic, reason or honesty to win out over egotistical mania and deception. ... Freenode may be 'Animal Farm,' though without the Orwellian context.

Your calm, reflective tone reassures me of your cool and level-headed rationality.

Now get a grip.

But I Thought Information WANTED to Be Free?

[RobotRunAmok]

D00d...?

I say we strip the DRM from all passwords! Down With Evil Password IP!!

Who's with me?

OK, compromise: Everytime we use your password, we promise to give you credit and link to your blog. Deal?

Face it, until people start making passwords available for a fair price in all nations everywhere, this kind of piracy will be rampant...

Re:But I Thought Information WANTED to Be Free?

[Anonymous Coward]

I'll go ahead and state the obvious.

I don't think many people broadcast their passwords on the radio for all to hear and record.

Re:But I Thought Information WANTED to Be Free?

[Thing 1]

D00d...?

So, is that 1337-speak for "Is that you in the closet with a knife?"

The IRCD could have helped with some of that...

[SailorFrag]

As an admin on another IRC network, I'm actually quite surprised that the ircd would let someone take the nick nickserv... or at least, if it's permitted to happen, that there isn't some alternate authentication mechanism that guarantees it only goes to a legitimate recipient (i.e. /nickserv or /msg nickserv@services.ircnetwork.net or whatever). Fortunately, my password on there is intentionally weak.

On the other hand, I understand what it's like to have compromised servers on the IRC network. I wish them the best in their efforts to get things working smoothly again. Tracking down the culprits can be exceedingly hard and time intensive, and reloading rooted servers is never fun.

Re:The IRCD could have helped with some of that...

[SailorFrag]

OK, I suck for not RTFA first. But still, relying on jupes is fairly weak for that very reason -- if one server has it taken off, you lose all the protection.

Re:The IRCD could have helped with some of that...

[epiphani]

Assuming their nickserv handling on the server side is run the same way Bahamut does theirs...

*serv nicknames are generally reserved through Qlines. Qlines can be used to restrict all kinds of pattern-matched nicknames, however they still allow opers to use them - this is quite intentional. If the compromised server allowed people to set up opers, it would have been trivial to oper up, remove the real services from the network, and change your nickname to *serv.

I'm not sure how many networks have picked up on the /nickserv or /msg service@services, but bahamut uses that, and does not accept messages in any other method for services. Bahamut is generally built specifically to handle these types of things.

If freenode was using Bahamut, I'd be interested in talking to them about this. If a freenode admin sees this, drop me an email.

Re:The IRCD could have helped with some of that...

[Draelen]

What you refer to is called a Q:Line, which prevents non opers or non U:Lined services from using specified nicknames. If the attacker had lilo's oper pass, then the attacker could easilly then change their nick to "NickServ", thus facilitating the compromise.

Re:The IRCD could have helped with some of that...

[FooAtWFU]

Freenode uses Hyperion. The preferred authentication technique at the moment, FYI, is to send your nick's password in the IRC server password field when you connected; this will serve to authenticate you to that nick, bypassing Nickserv or /nickserv or /quote nickserv or /msg nickserv@services. - and is probably the most secure option available, and one of the easiest to set up.

Re:The IRCD could have helped with some of that...

[SailorFrag]

I'm used to ircu, where the juped nicks are in U lines and not even opers can /nick to them, so you'd have to edit a server's config file and rehash to free up the nick. Ah well, I guess such things vary.

Re:The IRCD could have helped with some of that...

[Anonymous Coward]

Won't really be difficult to track down the culprits since they've posted their comments here already, not only fessing up to being the ones who did it, but explaining how they did it.

Re:The IRCD could have helped with some of that...

[petermgreen]

however they still allow opers to use them - this is quite intentional
intentional: maybe
bad idea: definately

with a sane ircd you should need at least config level access to steal a services nickname preferablly more, though few ircds seem to limit services nicknames to coming from a server with the services servers name (and taking an arbitary servername on a properly run large network should require config level access to a hub)

Re:The IRCD could have helped with some of that...

[Breakfast Pants]

Internally the server just sends a message to nickserv when you do this, so it wouldn't have helped.

Re:The IRCD could have helped with some of that...

[Anonymous Coward]

unless your ircd uses an authentication scheme which is completely
bot-free (there is no NickServ in the first place).

check out http://www.psyced.org/ for sane identities and safer ircing.

uhh

[joshetc]

Since when does any administrator have actual access to anyones password? I can see them having the ability to change their password to something else.. but comon. Shouldn't / wouldn't these be encrypted and only accessable remotely?

I was there.

[Avillia]

Mass delinking.
Mass throttling.
Mass glining and killing.
Mass notices of DCC SEND.
GNAA denying fault.
Bantown claiming fault.
The hilarity of not being auto-removed from #wikipedia thanks to a lack of ChanServ.
Having up to 20 variations of one persons name.
Lilo being killed off with a hilarious message.
And the topic wars...

Good times.

Re:I was there.

[Threni]

Hehe...sounds more entertaining than IRC's ever been when I've been online! What's the problem?

Re:I was there.

[stonecypher]

And, this got modded interesting why, exactly?

Good Riddance

[Doc Ruby]

The largest FOSS IRC network stores all its user passwords in plaintext, not a hash against which incoming passwords can be checked? Its superuser could look at any password they wanted?

It's a good think that firetrap finally collapsed publicly. It should have happened much earlier, before its loss damaged so many people.

Re:Good Riddance

[SailorFrag]

I was going to suggest something along those lines, but if you think about it... if the services database were compromised, even if there's hashing, then everyone's passwords might get out anyway. I don't think anything actually implied that they're stored plaintext.

I hope not, at least.

Re:Good Riddance

[Sinbios]

I'm pretty sure the idea is that they replaced NickServ with something else that intercepts the passwords when users tried to identify.

Re:Good Riddance

[Anonymous Coward]

The largest FOSS IRC network stores all its user passwords in plaintext, not a hash against which incoming passwords can be checked?
Probably not, they most likely hash the passwords.

Its superuser could look at any password they wanted?
No, but the super user could sniff it easily since it is sent in clear text from the IRC clients.

It's a good think that firetrap finally collapsed publicly. It should have happened much earlier, before its loss damaged so many people.
Idiot.

Re:Good Riddance

[Doc Ruby]

What kind of auth protocol sends passwords in plaintext across the network, rather than hashing them at the client for comparison at the server? Especially among a complex 3-party auth?

There might be a technical difference in the topology, but the insecure design is just as bad, if not worse.

Why should NickServ have access to the clear passwords? What happens if FreeNode switches to another auth service, especially if a result of a dispute? That system is really too insecure to trust at all.

Re:Good Riddance

[Pink Tinkletini]

At the very least, people who happen to use the same password would all know each others' passwords. Unless the database admins were smart enough to salt the hashes, which Wikipedia's weren't.

Re:Good Riddance

[Doc Ruby]

It doesn't matter if the passwords are stored in plaintext or transferrred in plaintext. In fact, transferring in plaintext is worse, as it doesn't take filesystem privileges to sniff the network.

So it's good that this thing went down in public, though it's bad that its loss damaged so many people. Rather than just get "fixed" secretly, without people revising their trust of it.

As I said. Which you would understand, if you weren't just yet another Anonymous idiot Coward.

Re:Good Riddance

[weevlos]

Just FYI: the services database wasn't compromised. Rob wasn't connecting via SSL and his oper password was sniffed off the wire.

Re:Good Riddance

[Nimey]

Can you give a link to that?

Re:Good Riddance

[SillyNickName4me]

Why should NickServ have access to the clear passwords? What happens if FreeNode switches to another auth service, especially if a result of a dispute? That system is really too insecure to trust at all.

Of course your technical comments are right on the spot, but there is something you don't mention, and that many people tend to forget with regards to nick/channelserv and similar services on IRC networks.

None of those services is intended to provide security, and more generally, IRC does not have any form of security.

Such services are there to make live easier (specifically, to make running a channel and knowing who is who easier), it does not replace good channel operators or such. Networks that want something more should really look for some more robust solution first.

Re:Good Riddance

[achurch]

As others have pointed out, it's only a nickname (setting aside the obvious danger of users using the same password on IRC and elsewhere). In fact, when I first added password encryption to IRC Services, I recall having gotten several comments to the effect of "what good is it if admins can't tell users their passwords?" This is, of course, entirely an issue of conditioning (think bots with plaintext datafiles), but what can you do? It's hard enough trying to convince people they don't really want a BotServ...

Re:Good Riddance

[Sinbios]

Passwords on IRC are sent via plain messsages to NickServ, which acts just like any other client. I assume regularly NickServ does not log these messages, but if the server is hijacked these messages are probably easily viewable.

Re:Good Riddance

[weevlos]

Oh yes, I'll just give you a link to some IRC logs that incriminate my friends.

Re:Good Riddance

[Doc Ruby]

Most IRC users don't realize that their passwords don't protect them - passwords generally do protect users, when the user uses them correctly. That creates a "reasonable service expectation" that was not met by this popular system.

That's why I said it was good that this crack was exposed publicly: now people know better than to trust it. Or at least know better than they did before.

Re:Good Riddance

[Doc Ruby]

Usually passwords protect the service, even if IRC is an exception, so most people expect them to do so. Responsible sysadmins would include the warning when users register that their passwords aren't secure, that the IDs of people on the site aren't necessarily authentic, if the passwords are compromised. Your security is helpful in getting the system to reflect how users use it, even if admins want to use it insecurely.

This public exposure at FreeNode does something to help educate users, but only momentarily.

Re:Good Riddance

[Doc Ruby]

In that case there's no need to replace NickServ to get the passwords. I'd assume that cracking FreeNode to point it at a trap instead of NickServ is harder than just sniffing the network for these passwords, but not necessarily. Sniff the FreeNode superuser's password on the network, login to FreeNode, reconfig it to point at the trap, collect the rest of the passwords. The only problem is that you can't tell correct passwords from typos or just wrong ones, so you let everyone login. But at that point there's little difference, especially if the cracker is posting brags to the log, and kicking the real superuser.

Re:Good Riddance

[at_slashdot]

The point is that if your password is plain-text when is transmitted over the Internet is just as well as you published your password. So, if you already "published" your password you won't mind of somebody gets hold of it through other means, right?

Re:Good Riddance

[Doc Ruby]

There's obviously a lot wrong with IRC security. As I said in my original post, the public exposure of this insecurity is a welcome development, to immunize people against trusting it too much.

But there's no reason to remember the hash. The "identify" function should take "apple" as its argument, hash it, and send the hash to the server. That's what software is for. If you use the same hash every time for the same "password", then the hash has become a cleartext password, which can be sniffed on the network etc.

This is basic security. IRC lacking it makes IRC a joke - which we already knew, but too many people have to learn for the first time every day, because IRC looks like actually secure password-protected systems to beginners.

Re:Good Riddance

[Anonymous Coward]

You have great friends, ass-wipe. Go pick a zit and masturbate.

Re:Good Riddance

[Doc Ruby]

If they stored only the hash, how does a password get exposed? That's the whole point of a "one way" hash.

If the password is sent in the clear across the network, that's even worse, and doesn't need the DB to be compromised.

Re:Good Riddance

[Fulkkari]

Hashing a password and sending it over an unencrypted connection is completely stupid and provides no extra security. A hacker can use the hash just like he would use a password right now. What you really need is a challenge-response authentication like CRAM-MD5.

Re:Good Riddance

[zerus]

Not encrypting the password hashes seems more like an ethical question for a sysadmin. First off, why even put yourself in the position to potentially have access to your user's personal info? I say this will full knowledge that there are people out there who use the same password for every single site they use thinking it's secure (no, I don't mean you mom). So even if a sysadmin doesn't do this with unethical intentions, he's still leaving his users info out in the open should a more unscrupulous fellow gain access to the system. At least hash with something as a deterrant. Best case scenario the person who breaks in will have to waste time cracking with john. Say myspace or facebook did this and the entire userbase had their passwords taken. How many college students probably use the same password on there that they do everywhere else? It would be a nightmare for some and a wet dream for spammers, carders, and others. There's just no reason that with all the hashing API's and OSS projects out there, that a sysadmin would be lazy enough not to encrypt the password list/database.

Re:Good Riddance

[MP3Chuck]

"If they stored only the hash, how does a password get exposed?"

I'm pretty sure there are rather large PW->Hash dictionaries out there. While that doesn't guarantee exposure either, it's entirely possible that a large number could still have been compromised.

Re:Good Riddance

[Doc Ruby]

Which is why good hash functions generate different hashes for every transaction from the same plaintext. Like including a timestamp.

Hashes are proven deterrents to attacks that raise the cost of attacks much higher than their returns. Of course they have to be used correctly. That's how security works: you can't protect your house by taping a lock to the welcome mat.

Re:Good Riddance

[SillyNickName4me]

That's why I said it was good that this crack was exposed publicly: now people know better than to trust it. Or at least know better than they did before.

Agreed.

Re:Good Riddance

[Doc Ruby]

Secure systems generate a new hash for each transaction to protect from replay attacks.

Re:Good Riddance

[Fulkkari]

The term for this is challenge-response authentication. The server generates a random challenge and the client combines this with the password (hash) creating the reponse, which then will be checked at the server. The challenge is new each time, resulting a new response each time. Isn't this what you mean with "new hash for each transaction"?

Re:Good Riddance

[Doc Ruby]

Challenge-response is one kind of protocol using "one-time hashes". So I'm agreeing with you, while referring to the more general case.

Re:Good Riddance

[Anonymous Coward]

A naive challenge based protocol requires that the password be stored in plaintext.

Client (wire): user joe wants to connect
Server (wire): before I believe you are joe give me an md5 of 'happypuppy' and your password.
Client (wire): send (md5 ('happypuppy', password))
Server (internal): compare (recvdata, md5('happypuppy', password))

So password has to be stored in plaintext on the server, this also requires that the challenge never be repeated - if it were then anyone who ever saw a challenge response to a particular challenge could replay it. It's also not perfect in that if an attacker can view the challenge and challenge response then they can simply generate md5s (or whatever hashing function is used) for the challenge until they get something that matches the challenge response.

If you are really serious about password security then you need one time passwords and ssh, or at the very least ssh.

Re:Good Riddance

[Doc Ruby]

True enough. Though I like the idea of replacing a server registry of "used" challenges not to reuse with random challenges selected from a very large keyspace. No security system is perfect, and using "GUID" style random challenges has a lot better cost:benefit than the registry, which could be cracked, among other vulnerabilities.

And you don't need ssh itself, just a secure transmission protocol. Any (working) SSL, or others.

But the most important part is that the security be built in, from the beginning, instead of relying on users to do anything extra. If faced with a problem that prohibits necessary access in the secure mode, then a procedure for getting insecure access - with insecurity clearly advertised - might be necessary. But "secure" should be the default, even when "insecure" is an option.

Re:Good Riddance

[Pink Tinkletini]

Like this.

Re:Good Riddance

[Lord Ender]

The super user always could have captured any passwords of active users.

But, if what you are saying is right, the software engineers who wrote this failed Secure Authentication 101.

Re:Good Riddance

[Cramer]

Such methods generally require the authenticating server to have the plaintext of your password. That means your password is insecure on the server (which is easier to lock down than the internet), but reasonablly secure across the network.

Re:Good Riddance

[stonecypher]

Which is why good hash functions generate different hashes for every transaction from the same plaintext. Like including a timestamp.

Bit new to security, are we? You can't salt a password with a timestamp if you expect to store it and cannot expect the client to store the time at which the stamp was initially concocted. The scheme you're describing is for transitory security, not long-term security.

Re:Good Riddance

[stonecypher]

The largest FOSS IRC network stores all its user passwords in plaintext, not a hash against which incoming passwords can be checked?

No, it stores them as salted MD5 hashes. That doesn't help when the user sends the password to the nickserv imitator in plaintext. It's a flaw in the IRC protocol, not in Freenode.

It's a good think that firetrap finally collapsed publicly.

Drama much? The hole was open for less than five minutes, and server population has gone down a whopping 0.6% .

Re:Good Riddance

[stonecypher]

What kind of auth protocol sends passwords in plaintext across the network, rather than hashing them at the client for comparison at the server?

IRC doesn't have an auth protocol. That's the whole problem. The flaw isn't Freenode at all.

Why should NickServ have access to the clear passwords?

It doesn't. People just tried to use the impostor, and thereby divulged their passwords. That's why it affected less than 25 people.

Re:Good Riddance

[Anonymous Coward]

All passwords are salted hashes.

Re:Good Riddance

[Doc Ruby]

New to security? I studied _Applied Cryptography_ over a decade ago. I spent the early 1980s working with timeshare access controls, on ARPANet. I've worked for more banks than you've visited ATMs. You've gone ahead and salted "we" with your own lack of experience, not mine.

As someone else in this subthread noted, Challenge/Response offers just one way to include a timestamp with a password hash.

Try learning about "one-time passwords" before you show how little you know about either security or talking to people.

Re:Good Riddance

[Doc Ruby]

Defensive much?

Storing passwords as hashes is useless when the auth protocol sends them across the network in plaintext. FreeNode's auth protocol that includes NickServ is part of FreeNode, therefore a flaw in FreeNode.

It's a good thing the firetrap finally collapsed publicly, because now so many people know that IDs are not trustworthy.

You are a tech fanboy, who can't see the ugly facts because you love IRC so much. You've got a lot to learn. Try going outside to play some more.

Re:Good Riddance

[Doc Ruby]

Decrypt this: bullshit.

Re:Good Riddance

[Doc Ruby]

It's got an auth protocol: a useless one that sends plaintext passwords. It's not even the minimal "identify" implementation that wouldn't take a password. It tells users that it takes a password, implying security, then passes the password insecurely across the network among various independent parties.

In another post in this subthread where you're also getting this wrong, you admit NickServ (or its imitator) is receiving the passwords in plaintext. You can't then claim that NickServ doesn't have access to the clear passwords. It does.

And you can't claim that FreeNode's dependence on insecure auth isn't a flaw in FreeNode. It is.

This debacle has affected thousands of people, by educating them how insecure is FreeNode. As I made clear in my first post. Stop posting your illogic all over this thread. It's annoying to have to follow you around with a shovel.

Re:Good Riddance

[stonecypher]

You are a tech fanboy, who can't see the ugly facts because you love IRC so much.

I actually don't much like IRC, but thanks for attempting to hide your mistake behind some ad hominem.

Re:Good Riddance

[Doc Ruby]

After you start with the nonsense ad hominem "drama much"?

So then you have no excuse for being totally wrong, and a jerk.

Re:Good Riddance

[stonecypher]

I've never seen an enemy list as long as yours. I'd say the same about your friend list, but it appears to be mostly floods from other enemies.

Call me a jerk and wrong all you like, but your arguments are hollow, your information is false, and your list of relationships speaks for itself. I'd contend that you're essentially confusing yourself for me.

But, be sure to get the last word in. I won't be wasting my time on you again after this. I've been on slashdot for eight years, I have six people in my foe list, and I'm sure you'll still tell yourself you're not the jerk in the equation, then go back to your city of unadmirers.

The worst thing about people like you is that you're so unable to see your own problems that you'll never repair them. You're just stuck like that. I genuinely feel bad for you.

Re:Good Riddance

[stonecypher]

And you can't claim that FreeNode's dependence on insecure auth isn't a flaw in FreeNode. It is.

Yes, I most certainly can claim that a correct implementation of a protocol with a flaw is the fault of the protocol, not the implementation. That's why FTP servers' insecurities aren't their faults. This is a basic principle of network security.

Re:Puts MS hat on

[rmsmith]

Nah, man. That's FLOSS*. * Free Libre Open Source Software

My password for everything is password who cares

[bxbaser]

Most just isnt that important

from the hope-your-password-wasn't-important dept?

[Anonymous Coward]

Please somebody alert the who-gives-a-shit dept.

The much more stoid moment that will be used to summarize the gravity of the matter came when our beloved lilo was taken down:
* lilo has quit (Killed by ratbert (die ))

Let's all have a moments silence.

Woah! If someone did manage to gather people's NickServ passwords, it could mean major trouble, for the victims themselves and possibly for FreeNode as well.

Woah! I fear a deluge of angst-ridden blogs are about to swamp cyberspace.
/me runs away

What questions?

[supabeast!]

"The details are still unknown, but these events raise scary questions about the actual security of FreeNode and other organizations like it."

I don't think that there have been any questions about the security of anything involving IRC for a long time. Everyone with half a brain knows that IRC is a cesspool of hackers, phreakers, crackers, and script-kiddies just looking to stir up shit.

Re:What questions?

[LoadWB]

Pretty much why I quit IRC a number of years back. Not to be mistaken, IRC has many valuable functions and features -- beyond downloading warez and moviez -- but not for casual chat. If you know the specific channel to go to, you are most likely fine. But for the casual chatter, browse around open channels and you will invariably end up with mass invites, notices, spam, DOS, MSG/CTCP/DCC floods, and my favorite, the mIRC scripts sent via DCC.

I only used mIRC briefly in my IRC career. It had little to no built-in protection at the time and I went back to AmIRC (Amiga.) Using WildIRC and Kuang11, AmIRC could not be beat. Later scripts for mIRC became much more solid and advanced, and I am sure the program is much better today?

Brings back some memories, actually. Back around 1997 we used to use a simple ICMP ECHO (ping) packet with a payload of "+++ATH0". Anyone with a modem which did not follow the Hayes specification for the escape sequence (+++ followed by two seconds of "silence") would immediately hang up as the TCP/IP stack sent an ICMP ECHO RESPONSE with the same payload. Was great fun for two or three times.

Re:What questions?

[Anonymous Coward]

Wow, so let's see, you're rambling about being inconvenienced and compromised by script kiddies but then admit to being one yourself.

Fucktard.

Re:What questions?

[Bri3D]

IRC is great for casual chat. It's like your local bar. You'll go down there, hook up with a few friends, and sit down with a beer. The occasional drunken guy/girl will hit on you (no matter what gender you are), you'll laugh and shake it off and as the night goes on you might get into a fight or two. If things escalate too far, you might even get thrown out!

And occasionally, the neighborhood biker gang will walk in and rough things up and the bouncer'll get scared and can't do anything.

What's wrong with that?

IRC's a great way to hang out with some friends who you generally don't have to stress over too much (you've never actually met them anyway) and chill and have some fun. It's very similar to your local bar, but worldwide and online.

Re:What questions?

[Baloo Ursidae]

Brings back some memories, actually. Back around 1997 we used to use a simple ICMP ECHO (ping) packet with a payload of "+++ATH0". Anyone with a modem which did not follow the Hayes specification for the escape sequence (+++ followed by two seconds of "silence") would immediately hang up as the TCP/IP stack sent an ICMP ECHO RESPONSE with the same payload. Was great fun for two or three times

I'm pretty sure you never actually did that, but are trying to crudely update the old BBS trick of getting noobs to type +++ and wait a few seconds without typing anything else. +++ATH0 by itself doesn't work. You have to have a pause until the modem says OK first before you can ATH0. By that point, ATH0 isn't necessariy, noobs dumb enough to fall for it are now in command mode with no idea how to get out or hang up...

Re:What questions?

[LoadWB]

Thanks, Troll. Actually, the attempts were PoC on two friends who knew it was coming. It was neat, but not a cunning attack. Rather it is a prety cowardly approach. Kind of like your post as an AC. Who's the fucktard now?

Re:What questions?

[LoadWB]

Agreed, and pretty much my point. In your regular channel (bar) you have good ops (bartenders/bouncers) that work to keep out the riff-raff (script kiddie assholes.) Browsing around unfamiliar channels (bars) and you are likely to run into those bikers. Not always, but you are likely to.

Well, that and idlers. I love a channel of 150 idlers. heheheh

Re:What questions?

[LoadWB]

Actually it does work. I have tried it more than once -- twice in IRC with two willing participants, and several times beyond that with my system admin when I worked for an ISP.

In fact, the first time I tried it I dropped myself, as my Motorola 28.8 was "Hayes dumb." Not all modems properly implement(ed) the Hayes protocol. To correct this, I changed the escape character (I do not remember the S-register, but I had it set as my configuration string in Miami TCP) to code 127 since it was unlikely, and proved never, to have three 127's in a row going outbound.

I want to say that all but my Emerson and Wang 2400 modems (well, and true Hayes modems) were vulnerable to this. But I cannot remember now if I ever tested the 14.4 modem I had.

Re:What questions?

[stonecypher]

Brings back some memories, actually. Back around 1997 we used to use a simple ICMP ECHO (ping) packet with a payload of "+++ATH0". Anyone with a modem which did not follow the Hayes specification for the escape sequence (+++ followed by two seconds of "silence") would immediately hang up as the TCP/IP stack sent an ICMP ECHO RESPONSE with the same payload. Was great fun for two or three times.

The reason you shouldn't try to tell other people's stories is that people who actually understand what you're talking about laugh at you when you get it wrong. The AT standard required a half second pause between each plus, and there was no known modem which got that wrong. TCP is a packet-delivery system with allowed buffering; you cannot inject those pauses, and the headers for the packets prevent you from sending one plus every half second to any effect. The specific reason for the half second pause was to allow any binary data to be transmitted without accidentally triggering a hangup.

ICMP by definition cannot trigger the +++ effect in a remote host, ever, under any circumstances, nor can any technology run over IP, without exclusion. You, sir, are lying through your teeth.

Re:What questions?

[Anonymous Coward]

The problem was that Hayes had a patent on that delay stuff. So clone manufacturers who did not want to pay license fees implemented less sophisticated (or totally dumb) ways of detecting the +++

Re:What questions?

[juhaz]

The reason you shouldn't try to tell other people's stories is that people who actually understand what you're talking about laugh at you when you get it wrong.

You got that right. Too bad you didn't follow your own advice, which is why everyone is now laughing on you, even harder for doing it while being a smartass.

The AT standard required a half second pause between each plus, and there was no known modem which got that wrong.

There are plenty of known modems which got that wrong and had no delay at all. It's quite well documented, see for example http://www.securityspace.com/smysecure/catid.html? ctype=cve&id=CAN-1999-1228, or justfuckinggoogleit.

And next time, check your "facts" before you accuse people of lying.

Re:What questions?

[Ilgaz]

That "pause" was patented and some companies didn't buy that patent rights so the modem didn't have such security measure as far as I remember.

So, modem "sees" +++ATH0, it hangs up.

Good modem "waits" 3 secs after +++ and grants the command after that pause.

Re:What questions?

[jez9999]

I, on the other hand, have been helped enormously by IRC. Nothing like going on IRC to get a quick answer (usually even useful!) when you're having trouble with Linux, programming, HTML/CSS, etc. People always seem to think I know lots about computers, but I'm not that intelligent, really. I just harvest the power of IRCers. :-)

Re:What questions?

[LoadWB]

You, sir, are lying through your teeth.

Sorry... that is not a lie, that is the meat from your ass stuck in my teeth.

Re:My password for everything is password who care

[bxbaser]

HAHAHAHA it is what a dork.

the cracker /nick'd to "nickserv"

[ailaG]

if you can pose as nickserv, some people will send you their password, thinking you're the real nickserv bot. the original identification command is to PM nickserv your password, assuming that nickserv is a nice bot that won't tell anyone. now, if someone poses as our nice little bot..

I'm with the 'who cares' camp

[alex_vegas]

My freenode password only exists because of channels that strive to keep out spambots, and it's 'password'. If someone is lame enough that they have nothing better to do than impersonate me on freenode, that is in itself punishment for the crime... It might be fun to impersonate twkm and give icy answers to the entire western worlds obscure C questions, but in order to do that one would have to know as much obscure C crap as twkm does...

Re:I'm with the 'who cares' camp

[akeyes]

hmm...

/msg nickserv ghost twkm password

Nothing new here, move along...

[Shoten]

I don't understand why there would be any greater implications from this event than any other. All kinds of organizations have been compromised; this is far from news, and just another example of why most security experts recommend a "multi-tiered" password scheme for users. A set of passwords, of varying importance...for the most critical things, a longer and stronger password, another middle-level password to use at other sites of lesser importance (like webmail) and a throwaway password for things that don't matter to you so much. Best of all, use unique passwords for the high-importance site, if you use something like Password Safe for Windows, KeePass for Linux, or Keyring for PalmOS to keep track of them securely.

Mod parent the FUCK up insightful

[James A. V. Joyce]

Seriously, the only thing differentiating lilo from any other freelode luser is that he spams "DONATE NOW" notices every half hour. Maybe he should get a real job and then he'll be able to afford all that pizza.

Mod parent up, grandparent down.

[FooAtWFU]

-- because the parent seems to have at least RTFS, unlike the grandparent.

Re:Mod parent up, grandparent down.

[Doc Ruby]

There's no way to tell from the article or the summary where the plaintext passwords are being intercepted. Guessing that NickServ has been cracked is a good guess, but it doesn't matter.

Try getting a grip on the problem before shooting off your mouth about moderation demands. You might learn something.

Re:Mod parent up, grandparent down.

[TheRaven64]

The only thing that surprised me here was that people still used IRC. I had assumed everyone had switched to SILC. Mind you, I know some people who only just switched for SSH, so maybe it's not too surprising...

Not Sure

[Ajehals]

I am not really bothered at the prospect of my freenode nick or password being available to someone else. Mainly as its hardly going to do any lasting damage to me other than potentially being a little annoying. The only problem I see is that someone could theoretically impersonate me and make me look like a bit of a git, but that should be easily remedied over a short amount of time. Plus unless these username / password combinations are posted publicly and no one changes their passwords its unlikely to happen given the number of users... Oh and anyone using an important password with their freenode account probably needs a wakeup call anyway

It might be a bigger problem if this happened here on slashdot (someone gathering email addresses or similar would have a decent mailing list to sell - with a fairly specific target audience... but then I use a public mail address here anyway so it might actually imporve the quality of spam I get...) and it would be a catastrophe if it would have been a finance related system or similar.

On the other hand it sounds from the summary and the blog thats linked that the break of a single username / password combo from remote was the root cause of this breach. If I am accurate in my understanding and that is really the case then we need to take a long hard look at how we can change that. You should not be able to compromise a system from remote with a single set of credentials regardless of how non-sensitive (insensitive?) the system is.

But then I'd like to see more details about what happened, when it happened (if it really happened?) what was exposed (or could have been exposed) during the attack before I take too hard a line either way.

Re:Not Sure

[tres3]

I'm a little worried as I have ops in a few channels. And the security is going to change. I know that one of the staffers is going to push for host based O-line privs for all staffers as that seems to have been the way in. There are many channels and many ops in those channels so even if freenode staffers have recovered all their access rights that doesn't mean that some others with ops in some channels haven't been taken to be used later.

Nickserv passwords.

[me22]

It says "the passwords of many users may have been compromised by someone posing as NickServ".

This doesn't mean that someone found a plaintext list of all the passwords. If you want to find out if there even is one, then download the source code for hyperion and look for yourself.

What it does suggest is that someone /nick'ed to NickServ and consequently could see all the passwords of people joining then they were /msd'ed.

Re:Nickserv passwords.

[ziggythehamster]

THANK YOU for this. These idiotic posts by people who think they know what they're talking about are pissing me off.

Re:Nickserv passwords.

[Anonymous Coward]

The version of hyperion used isn't (or until very recently at least wasn't) a complete version. Some code had been added to prevent spambot attacks which hit the network a few months back. These weren't added to the code base in version control. You sure the version you downloaded is the same as the ones installed.

Re:Nickserv passwords.

[me22]

I did not personally look at any source code.

However, the floowing was said in #freenode-moderated :
(23:29:33) @HedgeMage> Passwords are stored as hashes

Use a different password on every site!

[dmd]

Nobody should be using the same password on ANY two sites. You have no control over what the remote side is doing with your password.

Use something like http://www.hashapass.com/ to generate your passwords instead, and you only have to remember one thing, but your password is different on every site.

Re:Use a different password on every site!

[Anonymous Coward]

Yikes! Why would you want to trust a website to generate passwords for you?

It's a good idea but surely it would be much more secure to do it on your local machine, e.g. 'echo [password] [parameter] | md5sum'.

Re:Use a different password on every site!

[Anonymous Coward]

until http://www.hashapass.com/ starts logging requests.

Re:Use a different password on every site!

[db32]

So...I give them my master password...and then I give them where I want to use this password...and they generate my password? Uhm...seems like you are kinda giving the owners of hashapass the keys to the kingdom with that one. Not only do they have your password, but they know where to use each password they created for you. "You have no control over what the remote side is doing with your password" and then suggesting "let these guys create all of your passwords for you" seem to be VERY counter productive. Using a utility like this on a privately owned machine that doesn't have net access is a neat idea, but doing it from a website is about as bad as you can possibly get.

Re:Use a different password on every site!

[dmd]

Look at the source to the page. Your password is never sent over the network, even if you use it as hashapass.com. There is no form being submitted. Everything is done in javascript in your own computer.

Next time try actually reading a little before you snark.

Re:Use a different password on every site!

[forlornhope]

A secure version for use on any unix compatible system:

echo "password:hotmail" | md5sum | cut -c1-8

Of course that would be placed into your history file, but my bash is setup so that I just put a space in front and it doesn't get stored. Nifty isn't it?

Re:Use a different password on every site!

[geminidomino]

Man, that's just screaming for a firefox extension...

Re:Use a different password on every site!

[stonecypher]

Yes, let's trust some random site to create all of our passwords for us.

Or, better yet, let's do it locally, which is safe:

<?php if (isset($_POST['salt'])) {
  echo md5($_GET['salt'] . $_GET['pass']);
} else {
  echo "<html><head /><body><form action="makepass.php"><input value="Put URL here" name="salt"><input value="Put any non-empty passphrase here"><input type="submit"></form></body></html>";
}
?>

Re:Use a different password on every site!

[Anonymous Coward]

Here you go:
http://passwordmaker.org/

Re:Use a different password on every site!

[geminidomino]

AND it uses the URL as the parameter, just what I was thinking.

It won't help your karma or your post, but help yourself to a +5 warm fuzzy. :) Thank you.

That's what you get with open source software -

[Anonymous Coward]

That's what you get with open source software - anyone can easily exploit it. Come on kids! Use software that wasn't done by a pimple-faced basement dweller.

Re:That's what you get with open source software -

[WilliamSChips]

And anyone can easily fix it. I trust pimple-faced basement dwellers over suit-and-tie execs who would sell you to Hitler for a quick buck.

Re:That's what you get with open source software -

[Sigg3.net]

Use software that wasn't done by a pimple-faced basement dweller.

Uhm, I don't really think there is any.

Re:Explaining the jargon... That 70' Show style

[nstlgc]

Parent reminded me of a specific scene from That 70's Show, if anyone used to watch that (yea, it's crap now):

[some executive announces the start of a Q&A round]
"Just so we're clear, the 'Q' stands for Questions and the 'A' for Answers."

Trust No One

[ObsessiveMathsFreak]

"A trusted component is one which can break the security policy."

A truely secure system should have no trusted components. A Client's faith should never be placed in anyone expect themselves, and even then, only reluctantly. Freenode had a trusted component; namely, Robert Levin's privilages. This should never have been present in the system and was simlpy a disaster waiting to happen.

If you really want security you've got to accept three things. Trust No One. The Enemy Knows the System. The System Can Be Broken. If you think otherwise, you haven't got security, you've just got a fancy codec.

Re:Trust No One

[FooAtWFU]

Freenode had a trusted component; namely, Robert Levin's privilages. This should never have been present in the system and was simlpy a disaster waiting to happen.

My web server has a trusted component too, it's my root login. Obviously this should never have been present in the system and is simply a disaster waiting to happen. Only one problem: If I remove it, how am I supposed to administer my computer?

I mean, SOMEBODY needs to have the permissions to administer the darned network, or the network isn't going to get administered.

Re:Trust No One

[stonecypher]

A truely secure system should have no trusted components.

There is no such thing as a truly secure system. Acting in any fashion which does not expect compromise begets compromise in the long run.

clear text passwords?

[maraist]

I'm not a big browser of IRC's, but do we honestly still use clear text passwords anywhere? I mean unless IRC is such an old service that it can't make use of any of the dozen some odd technologies that have been standardized on in the past 20 years.. come on!!

Re:clear text passwords?

[Anonymous Coward]

IRC lacks lots of potentially useful things, like automagic charset negotiation, too. It's not that these things can't be implemented, it's that no one seem to care that much. It's just IRC. *shrug*

Re:clear text passwords?

[FooAtWFU]

It is, and it can't.

Well, if you'd read the fine summary (maybe if you'd UNDERSTOOD the fine summary, I guess you read it) you'd know that it does not store the passwords in the clear but that someone logged on to impersonate the authentication service, which recieves passwords sent in the clear. But there's really not too much you can do about that, even when you have a secure connection. It's like someone who replaces the CGI script on your log-in page to capture everyone's <input type="password"> submissions. Which are also recieved in the clear, whether or not they are sent via SSL.

Yeah, we have things like public key authentication. No, there's no real good way to use them on IRC. It is an old protocol. Sorry.

Re:clear text passwords?

[maraist]

I hadn't read the article, so I missed the fact that it was a man in the middle attack. But that doesn't obviate the need for securing the authentication process to facilitate public trust. Again, I recognize that IRC is limited to what it can support in terms of authentication (similar to telnet).. But I did want to mention that you don't need public key authentication.. HTTP and IMAP (and I assume POP), for example supports client digested passwords (e.g. they are never transmitted). I believe the protocol they support would use the same salt for every login attempt (login + realm + password), so a man-in-the-middle could capture and replay the digested result as easily as for clear-text.. The difference being, you could only use the captured results for the same user + realm + password combination (which presumably is semi-unique across the internet, at least as far as useful attacks go). So now you have digested passwords stored on disk, and digested passwords transmitted across the network (SSL'd or not) and only the login user knows his password.

Again, something like telnet is incredibly limited, but IRC has a specific client, so one would imagine that over the years digested authentication would have been added to the protocol.

My main beef is that I know for a fact that way too many highly sensitive institutions still store passwords in clear text (and encrypting them is as bad as clear-text). I know this is the case because if you go to any web site's "forgot password" section.. If it asks you for your mother's maiden name, the site has two strikes against it.. One is identity-theft (almost as bad as asking for your SSN), and the other is the fact that it seems to care about who you are because it's obviously about to disclose sensitive information to you.. A correct design doesn't HAVE any sensitive information.. A simple "I'll send a message to your cell phone, email, physical-mailing address, transfer money TO your established bank account/credit-card (as does paypal or conversely for USPS)".. Anything where a previously established external form of trust exists. And most importantly the message is a reset of a password, not the original (as that would prove that a clear-text password exists)

Re:clear text passwords?

[Ailin]

Other IRC networks use challenge auth mechanisms for services authentiication without problems...

WTF

[Anonymous Coward]

If this had happened to a Microsoft Server the comments would be off the wall about how this PROVES BEYOND DOUBT THAT WINDOWS REALLY SUCKS. (Bold characters intended to fool moderation drones). The hypocrisy on Slashdot is incredible.

Re:WTF

[WilliamSChips]

If freenode ran on Windows it would have crashed long ago...

Re:WTF

[Anonymous Coward]

All crowds are hypocrites.

Re:WTF

[hyfe]

Bah, I except better from professionally run services than volunteer-based ones.. not that it's necessairly deserved, but I still do.

And the MSN-network isn't getting nearly as much as flac as it deserves. The service is, atleast in my experience, way too flaky and if I could get my friends to switch I'd do it in an instant.

Re:WTF

[Anonymous Coward]

I'm sorry, but FOSS services claim to be better than professionally run services, especially since their code is open to auditing, patching, and improvement by the masses.

Your low expectations mean nothing when the community cannot live up to its own claims.

Re:WTF

[Anonymous Coward]

And you would have been right there to bitch at us for "MS bashing". Please, you're not as special as you think you are just because you come to Slashdot and don't hate Microsoft. Lots of us agree on that, and we can deal with the varying opinions like adults. The difference with you is that you think it makes you better than the rest. What do you want, a fucking prize? Wow, look how counter-culture you are! Where do I paypal the money?

Re:WTF

[Anonymous Coward]

You are right, this does prove beyond doubt that windows really sucks, but isn't that rather beside the point?

Re:WTF

[Cal Paterson]

I don't know what you're talking about. Everybody is out here in force talking about how bad Freenode is. All the posts I've seen are negative. No one has said that Freenode has a good design, and people are talking about it's faults.

There's no hypocrisy here. People are using the same standards of stupid security on Win32 as they are on Freenode. You're an idiot looking to score apologist points.

Re:WTF

[ems2]

Plan 9/Inferno were talking about secure chat yesterday (before the 'attack' happened):

caerwyn> tmcm, i rewrote the cryptfile.b to work as a file fs instead of a file2chan.
caerwyn> the only advantage is that the standard kfs can be used because it can read the file length, which is not available in a file2chan
caerwyn> is anyone interested in having a secure, encrypted, chat channel?
tmcm> yes, i am
tmcm> have you posted the new cryptfile.b yet?
tmcm> i'm interested in that
tmcm> comcast has really been fucking up in my area
tmcm> i've been offline for most of the past 24 hours
caerwyn> hi tmcm
caerwyn> i began looking at all the ways i was giving away private info in the last week.
caerwyn> what was easily trackable and logged etc. by outside companies and govt.
caerwyn> it's hopeless.
caerwyn> even my local public pool started requiring photo id with a barcode that they scan for everyone entering the pool.
caerwyn> and this applies to kids too!
caerwyn> it freaked me out.
caerwyn> time to quit using google/gmail etc. fire up tor. encrypt all network connections.
caerwyn> turn off the mobile phone
caerwyn> throw away the loyalty cards
caerwyn> i got a letter from wells fargo recently saying someone had stolen the computers storing my personal data.
caerwyn> who can you trust
tmcm> no one
caerwyn> bbl
caerwyn> back
caerwyn> bbl
tmcm> caerwyn: have you written or considered writing anything for osnews?
caerwyn> i considered it. and started writing something. but not much.
caerwyn> its hard to write that kind of thing. takes ages.
caerwyn> my conclusion of the day is that email is no way to have a private conversation
caerwyn> and neither is irc
tmcm> right
caerwyn> i spent over an hour today setting up gnupgp and thunderbird
caerwyn> and looking at webmail etc.
caerwyn> it's all hopeless.
tmcm> i thought the spree service you have/had set up was pretty good alternative
tmcm> you get user authentication and encryption if you mount it with -C
tmcm> that should read (user authentication) and (encryption if you mount it with -C)
caerwyn> yes. with /appl/demo/chat/chatsrv.b that'd be an encrypted private conversation
caerwyn> email reveals too much in the headers. the sender, receiver etc. with an inferno append only mailbox a user could mount the service and append an encrypted message.
caerwyn> and the connections could all go through tor.
caerwyn> and the userid's are anonymous
tmcm> you've heard of nym.alias.net, right?
caerwyn> no
tmcm> finger help@nym.alias.net
caerwyn> i was looking at some anonymous remailers todays
tmcm> nym servers allow you to have a two way exchange
tmcm> instead of just the sending feature of typical mixmaster setups
caerwyn> i'll look at it tomorrow
caerwyn> goodnight

(from #inferno on freenode; I have only removed join/part/disconnected/etc messages)

And as we speak discusion in #acme/#plan9 is taking place about moving to a 9P chat service and having a relay to irc for newcomers.

Re:WTF

[Ash-Fox]

I'm sorry, but FOSS services claim to be better than professionally run services, especially since their code is open to auditing, patching, and improvement by the masses.

Your low expectations mean nothing when the community cannot live up to its own claims.

I can't find any articles on Google even mentioning this?

Re:My password for everything is password who care

[Anonymous Coward]

Funny, but why did you change it? He'll just retrieve it by email.

Dalnet NickServ

[_aa_]

IRC4Life!

Also, back in the day, on Dalnet one could use /quote nickserv identify [passwd] or on most clients just /nickserv identify [passwd]

I'm not certain if this is done on Freenode, but it helped prevent passwords from being hijacked via situations like this or a simple typo.

Re:Dalnet NickServ

[FooAtWFU]

The preferred method to do this on Freenode is to set your password in the "Server Password" field of your IRC client; the Hyperion IRCD can associate this with your Nickserv account and authenticate you. This is even more secure than /quote nickserv and even easier to set up.

Re:Dalnet NickServ

[The MAZZTer]

UnrealIRCd ships with sample configs to do this... they cause the commands ns and nickserv to send the text to NickServ ONLY IF it is a service.

I don't use Freenode myself but I imagine if it's Unreal it uses those commands.

Re:Dalnet NickServ

[WilliamSChips]

Freenode doesn't use Unreal. It uses something called Hyperion.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Uh oh.

[SwartKrans]

Oh no! Someone stole my Freenode password! Now they can login and have no control over anything!

Re:My password for everything is password who care

[Anonymous Coward]

He didn't change it - he was going for a double +5 Funny :)

XMPP

[Anonymous Coward]

One can only hope that more incidents like this happen. It helps put the nails in IRCs coffin.

Use Jabber (XMPP) conference rooms instead. They are more secure and tie in with a modern personal messaging protocol. As an added bonus, we may soon have voice conference rooms once Google's Jingle (http://www.jabber.org/jeps/jep-0166.html/) XMPP extension is more complete and widely implemented.

Re:XMPP

[Ant P.]

If XMPP had anywhere near the bandwidth efficiency that IRC has, that'd be a good idea.

Re:XMPP

[rakaur]

Exactly. I only wish it was more like email, or something.

Oh, wait.

Re:XMPP

[Anonymous Coward]

They're both not incredibly brilliant on bandwidth.

XMPP throws bandwidth to the air because it makes very stupid unicasting of every message that needs to get to several destinations, and also because it uses XML which is very stupid for a messaging technology.

IRC has huge overheads because of the distributed user and channel database that it keeps synchronizing across its network.

But should you have a bit of time to spare, there is a technology which does
* not keep a shared database across its servers
* use multiple multicast trees instead of just one like IRC does
* is client-compatible to both IRC and XMPP

It is called PSYC, and it is open-source too.
Have a look at http://www.psyced.org/

I was there

[SB_SamuraiSam]

[9:10pm] encro left the chat room. (Connection timed out)
[9:46pm] <samuraisam> back in the nam
[9:47pm] koan left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Mike468_ left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] graphite left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] sdDistracted left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] wesley96 left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] imajes left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] khmer left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] feyth left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] SphinX left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] autoxr left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] CIA-3 left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] jruderman left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] xenon left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Eridius left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Mike left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] pat left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] omnivector__ left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Rinoa left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] lisppaste left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] fdiv_bug left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] ScottM left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] |-- left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] bnovc left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Parthos left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] prophile left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] janey left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] Minuo left the chat room. (clarke.freenode.net irc.freenode.net)
[9:47pm] vip left the chat room. (clarke.freenode.net irc.freenode.net)
[9:52pm] You left the chat by being disconnected from the server.

My thoughts..

[paulmer2003]

People should not use /msg nickserv pass on connect. They should be using scripts that check that nickserv is on a certain server (services.int, services.* etc etc) and its hostname matches.The IRC server should also have *serv juped/qlined so nobody can set their nick to *serv.

Of course, if someone was able to nab lilo's password, every user password may have been ripe for the taking.

What im wondering is, WHY THE FUCK ISNT HIS O:LINE IP RESTRICTED? Did he use one password for both the ircd ssh and his operline (if they were the same hacker could add himself a oline or add his ip to his oline..)? Either way, hes a moron.

The details are still unknown, but these events raise scary questions about the actual security of FreeNode and other organizations like it."

Not really. If he had his shit setup correctly this would have never happened in the first place.

Re:My thoughts..

[The MAZZTer]

There are some situations where it might be impossible to do even an ISP-level restriction... of course those involve using proxies to get around restrictions on IRC by over-zealous network administrators.

But at any rate, even with an oper password, impact should have been minimal... (of course if the guy had /operserv raw enabled, I'm a little less certain... see below notes) it's with an SSH password to the box where unreal is running where things get troublesome (change password, then change the IRCd conf to your liking, you can't get control back until you get your server host to reset your password for you).

Theoretical scenario: Some jerk comes on and knows my oper password. First of all, my oper password is NOT the same as my SSH password. Let's say this jerk goes and /kill me, like in one quote I saw. First thing I do is hop back on and /gline him (or worse... I think /zline bans by IP, but I'm not a server root admin guy myself). I do believe with a /gline on him even with an oper pass he can't get on.

Of course if he /glines me I just SSH to my box, kill unreal, edit the conf to change my oper pass for good measure, and restart unreal (glines/klines/etc are volitile).

If you have a network you might have a bit of a problem, since you'd need to distribute the new conf to all admins, and glines tend to propagate along nodes until every single one gets shut down. But, if you can get in contact with the admins for the other servers usually it's trivial to get them the file and have them rehash and clear whatever damage (glines in this case).

As for the NickServ impersonation, it's important to use /nickserv or /ns INSTEAD of /msg to identify if your server supports it, since these aliases (on unreal at least) by default will only work if NickServ is a service. If your server doesn't, someone on this comments page mentioned that using NickServ@HOSTNAME will only msg NickServ if he's logged on from HOSTNAME... which, if it's a service, will always be the same. If someone impersonates NickServ, the host will change, and the /msg will fail (/whois NickServ to get the hostname).

One last thing occured to me... the services connect password... if someone had THAT, they could connect their own services (if the server was set up to allow services from any host, which is a poor configuration) or connect using an IRC client (not sure if that's possible, I'll have to experiment with that on my own server) and pose as genuine NickServ. Aliases would work, hostmask would show as legit services. Furthermore, since services get more powers than even the highest ranking opers, all hell could break loose. (Anyone who's fooled around with /operserv raw might know some of the powerful stuff you can do with it... and by the way, if you have it enabled on your server, disable it unless you're just running a server as a text or experiment and noone else uses it.)

Re:My thoughts..

[paulmer2003]

[blockquote] Of course if he /glines me I just SSH to my box, kill unreal, edit the conf to change my oper pass for good measure, and restart unreal (glines/klines/etc are volitile). [/blockquote] Or rather, why not just SSHin, edit config file and add a gline/shun exemption and change operator pass. 'killall -HUP ircd' and hop on. Gline him, and remove all of the glines he set. [blockquote] If you have a network you might have a bit of a problem, since you'd need to distribute the new conf to all admins, [/blockquote] Not really. Because A.) Why have your oline on all servers? And your O:line shouldent have user = *@*...If it is, die. [blockquote] One last thing occured to me... the services connect password... if someone had THAT, they could connect their own services (if the server was set up to allow services from any host, which is a poor configuration) [/blockquote] Whom the fuck uses a configuration like that :S [blockquote] connect using an IRC client (not sure if that's possible, I'll have to experiment with that on my own server)and pose as genuine NickServ [/blockquote] Easily (Just the /identify probally wouldent work). All they need to do is connect, oper up and just change their name to NickServ (On unreal that means they would need to be Global Operator or higher. On hybrid/ratbox it would mean the operator would need a auth{} with 'resv_exempt'. If the hacker just got oper access this would mean they would be fucked as they wouldent have a auth{} line allowing them to be resv exempt). [blockquote]Aliases would work, hostmask would show as legit services.[/blockquote]Unreal checks that the NickServ user has a uline before making the ailas work. The only way you can get a uline on unreal is if you have access to OperServ RAW or are using the m_uline module from QuakeIRCd.

Re:My thoughts..

[nenolod]

Hi! I used to be freenode staff, and I figured I would comment on this.

You obviously have no idea how freenode's infrastructure is managed -- the infrastucture isn't a land of ZOMG I BOUGHT SHELLZ FROM SHELLFX.NET garbage. Most of these servers exist solely to host freenode, do not use ssh passwords (instead private keys are used), and do not use the same passwords as lilo's o:line password.

The fact is that they rooted servers close to freenode servers (i.e., on the same switch); then used ettercap to sniff o:line passwords. This was exacerbated by the fact that o:lines are (NOT masked *@*, but masked ?=levin@*), so basically all that had to be done was use the username levin, and boom you're opered up.

That is what the issue is, the o:lines are insecure masked. Nothing more.

HOWEVER, since they were sniffing, it is possible that they may have lifted services passwords as well -- people should probably change them. Then again, how do you know that they still aren't sniffing. Quite simply, nobody except the people behind this know.

Also, the group freenode is dealing with is known as Bantown, which has a reputation of causing whatever hell they wish wherever they feel like doing so. So no, none of what you said is truly relevant, as this group is a tad more unpleasant than the GNAA is. Infact the GNAA is a bunch of nice guys in comparison to Bantown.

Re:My thoughts..

[paulmer2003]

Still, fact remains that lilo is a moron for having just his user in oper mask. Should have been a ip. Stupid.

Re:My thoughts..

[paulmer2003]

I'm just reposting this, because my last posts formatting got screwed..Figured noone would read it if it was. [blockquote] Of course if he glines me I just SSH to my box, kill unreal, edit the conf to change my oper pass for good measure, and restart unreal (glines/klines/etc are volitile). [/blockquote] Or rather, why not just SSHin, edit config file and add a gline/shun exemption and change operator pass. 'killall -HUP ircd' and hop on. Gline him, and remove all of the glines he set. [blockquote] If you have a network you might have a bit of a problem, since you'd need to distribute the new conf to all admins [/blockquote] Not really. Because A.) Why have your oline on all servers? And your O:line shouldent have user = *@*...If it is, die. [blockquote] One last thing occured to me... the services connect password... if someone had THAT, they could connect their own services (if the server was set up to allow services from any host, which is a poor configuration) [/blockquote] Whom the fuck uses a configuration like that :S [blockquote] connect using an IRC client (not sure if that's possible, I'll have to experiment with that on my own server)and pose as genuine NickServ [/blockquote] Easily (Just the /identify probally wouldent work). All they need to do is connect, oper up and just change their name to NickServ (On unreal that means they would need to be Global Operator or higher. On hybrid/ratbox it would mean the operator would need a auth{} with 'resv_exempt'. If the hacker just got oper access this would mean they would be fucked as they wouldent have a auth{} line allowing them to be resv exempt). [blockquote]Aliases would work, hostmask would show as legit services.[/blockquote]Unreal checks that the NickServ user has a uline before making the ailas work. The only way you can get a uline on unreal is if you have access to OperServ RAW or are using the m_uline module from QuakeIRCd.

Re:My thoughts..

[cortana]

Forgive me, I don't know anything about IRC on the server side. But this would have been prevented if the server-to-server links used SSL, right?

Re:My password for everything is password who care

[xEndymionx]

i believe the correct response to that is "HAHAHA DISREGARD THAT, I SUCK COCKS"

Re:Explaining the jargon... That 70' Show style

[stewwy]

We used to have a store in the uk called C&A (Went belly up a few years ago) used to be a great joke about blondes always buying their knickers there as they had the instructions written on them.



For those who are a bit slow in social situation/or are humour impared the C goes at the front the A at the back

What kind of auth protocol? I'll tell you...

[FooAtWFU]

What kind of auth protocol sends passwords in plaintext across the network, rather than hashing them at the client for comparison at the server?

HTTP. Like the kind you use it to log into Slashdot, you know.

Sure, yes, you can tunnel that through SSL. You can IRC through SSL too. The server still gets the plaintext password on the other end.

Re:What kind of auth protocol? I'll tell you...

[Doc Ruby]

Which is why HTTP clients tell users that such forms are insecure, right where the user is entering the password. While the HTTPS protocol is indicated to be secure by the client, because it is secure during the part of the transaction that includes the client.

That is of course not as secure as transmitting only a hash, which can help ensure the password doesn't get exposed. But it is a lot more secure than the nearly totally insecure IRC protocol we're talking about. And therefore a lot less vulnerable, therefore more trustworthy. IRC doesn't indicate how untrustworthy is its password authentication, so the public exposure of its failure in this case is valuable, in educating users. At higher cost, and lower return, than just making the protocol use hashes instead.

Couldn't have happened to a better guy

[irq]

lilo, hi, remember me?

What goes around, comes around.

Re:Couldn't have happened to a better guy

[Anonymous Coward]

Lilo is a nice guy.
If you pissed him off you must have done something really bad.
I have gotten drunk many times on freenode. Even banned from #suse occasionally,
but lilo is truly a very giving, and friendly guy.
Freenode helps people. Even I help people.
Why you got to be so fucking evil?
You suck for that.

~ gnupengwyn

Re:Couldn't have happened to a better guy

[Squigley]

All these posts, and I haven't seen one mention of "freeload".

Re:Couldn't have happened to a better guy

[stonecypher]

I can't imagine that you'd actually want to be associated with something this unimpressive, or that you'd be so desperate to be right as to gloat about something you didn't do on a public site behind someone's back to a group of people who doesn't know or care about you.

This is the mark of desperation. If you want to seem like a big man, do something worthwhile. Don't bitch on Slashdot about something someone else did on IRC. You'll break your elbow, patting yourself on the back like that.

Priceless!

[thedarb]

AHAHAHAHA! That's okay, EFNet is use to taking other IRC networks refugees. Welcome back all you little run-aways. I just love anarchy! This is why it's better to war over a nick than to have a NickServ.

Anope passwords are hashed.

[The MAZZTer]

I'm not sure what algorythm, but I have Anope set up to use MySQL, I'm looking at the anope_ns_core table right now and passwords are stored as a 128-bit hash.

Re:Anope passwords are hashed.

[Anonymous Coward]

Except Anope's MD5 is broken.

Re:Anope passwords are hashed.

[The MAZZTer]

Really? Could you perhaps offer a link with details? I've never heard this before. Unless you're referring to the slashdot story on the breaking of MD5 with included sample code.

BTW, I don't know what services FreeNode uses, but Anope is the most popular so I thought I'd point out the fact it hashes passwords.

Re:Anope passwords are hashed.

[paulmer2003]

[blockquote]I'm not sure what algorythm, but I have Anope set up to use MySQL, I'm looking at the anope_ns_core table right now and passwords are stored as a 128-bit hash.[/blockquote]anope uses MD5 encryption which is totally useless for their databases. But, Freenode dosent use anope, they use dancer-services.

Re:Anope passwords are hashed.

[Anonymous Coward]

http://lists.ircservices.esper.net/pipermail/ircse rvices/2006/005154.html

Anope forked ircservices, Anope has unfixed ircservices bug, which causes the majority of the hash to be truncated (iirc, it's only the first 4 bytes, or something weird.)

Serves them right!

[onthost]

This is the SECOND time in a month this has happened. Anyone know why? Freenode uses OPEN O:Lines, meaning they can be accessed from any user@host instead of using proper O:Lines specifying the users ident (which is useless since it can be changed) and their hostname (which is harder to spoof/use).
Also during the whole thing lilo actually asked for donations. My questions is if their servers are donated, where does the money that is donated goto? They don't pay for bandwidth, servers, anything really. Curious really.

Re:Serves them right!

[Anonymous Coward]

Goes to pay lilo's salary.

Re:Serves them right!

[Ilgaz]

I have no clue why donations are almost begged. If it requires such money how can EF , DAL like networks survive?

I mean people are free to donate of course but I don't get what happens to amazing money that gets donated. /lusers (of this time)
There are 12304 listed and 12842 unlisted users on 20 servers

That is a SMALL network compared to DAL/IRCnet/EF.

Here is IRCnet of exact same minute, now that is a real large network. /lusers
There are 97459 users and 5 services on 35 servers

I have never seen some donation begging etc on those servers.

If a networks founder gets /ignored by its users, something is definitely wrong.

BTW, of course attacking to a network which is house of many open source projects is a lowest one can get.

challenge authentication

[Spy der Mann]

If nickserv used some kind of challenge authentication (it sends you a random challenge, and you hash the password with it), we wouldn't have these problems. Of course, this is irc, and that might be somwehat difficult to implement.

Re:challenge authentication

[Anonymous Coward]

If you were going to break the IRC protocol with challenge authentication, why not just switch to SILC altogether. That's supported by Gaim, irssi, and Colloquy already. Those three clients cover gui and text interface on OSX, Linux, *BSD, and Windows... and if your favorite client doesn't already support it, there's toolkits to help the developers add support for it. If you are willing to sacrifice the unsupported clients, you could also add an IRC->SILC gateway so that other IRC only clients could connect (and lose all the great safety features of silc).

Re:challenge authentication

[Anonymous Coward]

I don't understand why people use challenge based auth. Every challenge auth protocol I've looked at boils down to: C->S: username, S->C: challenge, C: R=F(secret, challenge), C->S: R, S: A=F(secret, challenge), S: cmp(R, A).

Sometimes it gets dressed up and people toss some extra trash in there (timestamps, nonces, random gibberish from /dev/random, whatever) - but the essence of the problem is that an observer has full knowledge of every piece of information other than 'secret', all he has to do is generate F(potential_secret, challenge) until he generates R.

Maybe I'm missing something, but it looks like you'd be just as well off using uuencode and rot-13 as a challenge protocol.

Re:challenge authentication

[spx]

"Of course, this is irc" Thats the point, its IRC, shit man its not like your damn datacenter went down, its IRC. Get over it. :X

Dude

[/dev/trash]

a person has to eat

It goes to lilo

[a16]

The money goes 100% to Lilo. *All* of their servers and hardware are donated. I believe they may pay for their web server, but even then, that's $99/month max?

This is what annoys me most about Lilo's "donation" pledges - he has set up a non-profit organisation with himself as the only paid employee, and receives thousands in donations yearly which all go to him. Oh, and "supplies", which of course are used by the only employee of the organisation. Yet he doesn't make this clear, at all. I believe most people genuinely think they are donating to the network, not the guy who sits there all day running it.

Lets also not forget his latest project, for us to all pay off his debt and buy him a new trailer to live in. Seriously, I'm not joking.

Freenode really, really needs new leadership, fast. Something not controlled by one person, or even if it is, someone competent would be a nice change :)

Re:It goes to lilo

[ameyer17]

IANAL, but if that's true, it's fraud.

Re:It goes to lilo

[Anonymous Coward]

Or just move to OFTC(.net), which Debian already has. Many of the free software projects have moved there in the last five years, for a good reason.

Re:It goes to lilo

[BoldAndBusted]

On some points, you are probably correct, but on the last one, on "Spinhome", what's the big deal? It's not like he says that the money is going to support the network and then turns around and spends it on his land yacht. That site makes it pretty clear what the money will go towards.

And, do you think that Freenode would run as well as it does (today excepted) without some guy "who sits there all day running it"? Oh, people don't deserve money, but, yesyesyes buymoreservers/bandwidth? He's being paid for the service he provides. And so far, that's been a decent service.

Wow, he recieves thousands in donations yearly. Literally *thousands*. Why, he could be... a Thousandaire! What a mogul.

one problem...

[verbatim_verbose]

It's not "just a goddamn nickname". It's how people on IRC identify you as you. If someone impersonates you successfully and talks to the right people, or uses some bot in your channel, all kinds of damage could be done. Suppose they convince someone to manipulate an account that you hold somewhere, because after all, they know "you". This is why nickserv exists.

Re:one problem...

[irc.goatse.cx troll]

It's (one of the reaons) why NickServ/host spoofing is bad. Once someone on freenode has your nickserv account, they ARE you. No way for someone else to tell sort of guessing by the way you talk/verifying externally. Try and 'steal' a nick on efnet. They'll use a different nick, and everyone else will see that you're ircing from somewhere that they normally don't, and instinctively distrust you until proven otherwise.

Passwords are also a pretty silly thing to still be using over the internet. Hybrid supports RSA public key authentication for ircops, I don't see why nickserv would be any harder.

Re:one problem...

[3vi1]

Does *anyone* do important business over IRC?!?! What kind of "damage" do you think they could do?

I haven't been on IRC in seven or eight years, but the last time I checked it was 99.99% cybering and warez-bots.

Sure: *Maybe* *someone* (who doesn't know you and has never glanced once at your source address) might think you're really the leader of some Linux distro and that your command to announce its disolvement is true. So freaking what? Like you can't fix that with a single post to your web page, and get great publicity in the process?

-J

Re:one problem...

[cortana]

Without a signed communication instructing that these changes be made?

How did this happen?

[ThinkingInBinary]

I think the Freenode community deserves to see a mention of this on freenode.net, and an explanation of the circumstances that led to it. I understand that compromises happen, but knowing how they happened will put a lot of people at ease, and the act of explaining it will make Freenode appear more professional, because they aren't trying to hide their mistakes.

In the middle of this, I would like to remind people that Freenode is an awesome service. It is a gigantic network, and a great facilitator of free software efforts.

On the internet...

[Poromenos1]

...the insecure places are more than the secure ones. Come to think of it, if someone got my password for the insecure places, he could do almost anything posing as me :P

Yeah, but six pizzas a day?

[James A. V. Joyce]

I can't think of what else that fat fuck is spending his cash on...certainly not a network security apprenticeship...

Re:BBQ?

[Achra]

That's so awesome! You must have some pretty bad karma to start out modded -1. How did you get it so bad? I thought that was impossible? Trolling, obviously.. But you must have been trolling for _Serious_.

So...you 69? Can I see pictures?

[SlashdotTroll]

Do you 69 while on rollerskates?
Or are you an 69-year-old granny on rollerskates...69ing?

  Picture please!

Situation normal for IRC gang wars

[Anonymous Coward]

Unless things have changed recently, there IRC serves two purposes:

• It lets people chat about meaningless stuff.
• It's a global competition to see who can write the best bots to get ops and kick their competitors off their own servers.

It sounds like this is a clear-cut case of the latter.

He then proceded to kill and/or k-line every staff member in sight, including lilo, and brought down quite a few of FreeNode's servers.

Nothing to see here. It seems that CmdrTaco has been trolled. :( :(

Let me be clear

[tmandry]

The possibility of passwords having been compromised is just that, a possibility. It is speculation based on possible facts. Please don't take it as more than that, though if you went through the ordeal last night then you should probably change your password(s).

root users suck, insecure by design

[DrSkwid]

Having admin privileges exist in-band is asking for trouble really.

IRC server's should have out of band control.

We don't even have anyone with OPs in "our" freenode channel.

messages from my freenode status window:

[RotJ]

[01:26] -lilo- [Global Notice] Hi all. We just experienced a brief outage between our US and EU hubs....we're investigating. Apologies for the difficulties, and thank you for your patience.
-
[01:28] -lilo- [Global Notice] We're told that the service interruption affected EFNet as well....in the absence of further problems, we'll pass you any information we receive on wallops (/mode yournick +w)....thanks!
-
[23:44] -ratbert- [Global notice] I am a fat asshole, who loves abuse, die
-
[23:44] -ratbert- DCC SEND YOUAREALLJUDENLOL
-
[01:07] -lilo- [Global Notice] Hi all. As you may be aware, freenode has experienced a crack attack and we're working on tracking down the details. At this point, we cannot guarantee that more problems will not occur.

I swear it was him!

[Anonymous Coward]

http://uncyclopedia.org/wiki/Peer
Unfortunately he's still at large.

Watch as the Linux community eats it's own young..

[Anonymous Coward]

You know, i've been watching this conversation, and decided to stop here..I feel a little bit compelled to defend Rob.

First of all, cards on the table, I've known Rob on and off for a few years, and i've even donated to PDPC when times were apparently a little rough. Rob has been nothing but kind to me, and supportive of the work that people do on his server(s). If he made a habit of intentionally pissing people off, PDPC and Freenode wouldn't be where it is, really, when you think about it. Whether you like the guy or not, Freenode is a valuable resource.

Now, regardless of what trouble you might have had with him in the past, there's one important thing to keep in mind. Rob doesn't have to do what he does. And without PDPC, alot of Linux projects would essentially be homeless. It might also benefit you to remember that you cant make everybody happy all the time. Thats not to dismiss your gripe against him, of course, but it's useful to keep in mind nonetheless.

There's a remarkable quality among open source geeks to absolutely skewer people who spent years working on something for other people without expecting a dime. One day they're considered generous and altruistic, the next day they're ripped open because you and other people stopped getting your milk through the fence. Having been on both sides of that equation, it's just not cool.

Don't be one of those people.

IRC is dead. Use Jabber.

[Baloo Ursidae]

This could have easily been prevented if IRC wasn't being pushed to be what it isn't (namely secure and scalable).

• Jabber has a built-in authentication method instead of relying on bad, afterthought hacks like NickServ.
• Jabber has built in multiuser chat management without having to rely on afterthought hacks like ChanServ.
• Jabber can't netsplit.

So why is Freenode still stuck in the stone age on this? Better, more reliable IM software exists than IRC these days.

Still bad

[Anonymous Coward]

Look at the source to the page. Your password is never sent over the network, even if you use it as hashapass.com. There is no form being submitted. Everything is done in javascript in your own computer.

Yeah, I noticed that it does the work on the client side. However, this behaviour could be changed at any time by the owner of the website, or anyone that could compromise the webserver, or carry out a man-in-the-middle attack. I think that the website is a neat idea but I'd never use it, and I wouldn't encourage anyone else to use it. If you're going to use something to manage your passwords, it should be fully controlled by yourself. What's wrong with running a hash program on your own machine?

Re:Still bad

[Bodysurf]

"I think that the website is a neat idea but I'd never use it, and I wouldn't encourage anyone else to use it. If you're going to use something to manage your passwords, it should be fully controlled by yourself. What's wrong with running a hash program on your own machine?"

So save the webpage to your machine, examine the source HTML so you know it is not sending any information remotely and then execute it locally on your machine.

Re:Still bad

[Anonymous Coward]

Or, as two other people have suggested already, use the md5sum program on your own computer. Why introduce needless complication?

Re:Horse Testicles

[DJCacophony]

Freenode wasn't hijacked, Jmax of gnaa just squit the network.

I knew _something_ was wrong

[mav[LAG]]

Everyone in #lisp was polite.

Who the fuck keeps posting on my account

[bxbaser]

Im changeing my password now.

Re:IRC is dead. Use Jabber.

[Anonymous Coward]

that's because IRC is not Instant Messaging software. IM is a scourge on the face of the net and I wish people had managed to kill it back in its infancy when Mirabilis brought AOL's IM to the rest of the internet (as ICQ). *shudder* There were already enough ways for people to annoy me as it was, without:

Dude?

YOu there?

Hello?

HEY I'm TALKING to you!!!!

Helllooooooooooooooo1!!11!1

wtf??! .... and nary a sign of what the hell was so god damn important from these freaking IM co-dependants. Do they even THINK to leave a message, when I'm clearly marked as "away" ? no. and if it were just one or two people, yeah they would have been easily ignored, but I seemed to be a magnet for them.

IM hit my bit bucket shortly thereafter.

Time to move to OFTC?

[timbrown]

Seriously though, is it not the problem that so many FOSS projects rely on FN, a network what relies on a single point of failure to survive?

Re:GNAA DENYING fault???

[WilliamSChips]

Freenet isn't Freenode.

Re:Explaining the jargon... That 70' Show style

[kongit]

huh? I don't get it.

Re:IRC is dead. Use Jabber.

[WilliamSChips]

The biggest problem with Jabber is that there's no really good console client for it like irssi is for IRC.

Re:Watch as the Linux community eats it's own youn

[Emmettfish]

I have also known Rob on and off over the years, and I have *also* donated money. While I understand your interest in keeping the conversation civil, I wanted you to know that I have also been a vocal and financial supporter of Freenode.

Re:IRC is dead. Use Jabber.

[paulmer2003]

You can just die, right here, right now. Pull your head outta your ass, IRC is plenty secure (as long as it is deployed intelligently). Services rock, they arent 'afterthought hacks'. anope services includes all the options you need, hell, the ircd itself, without any services, has everything you need! And how can jabber not netsplit? Anything connected can split. And if jabber cannot link, its a piece of shit thats unscalable. And if it dosent split, it dies dies. Boom goes the whole thing. Good point asswipe.

Bull

[nurb432]

And this makes it ok why? " Awww shucks he was just a kid " doesn't make it any less wrong. The kid should rot in jail. Age does not justify criminal behavior.

And OT, on your sig: What do you define as 'build it yourself'? From someone your age i picture you buying a MB and some cards, 'look mom, i did it myself' .. Until you build your own CPU out of discrete logic , you haven't built your *own* computer You just assembled someone else's.

Re:Bull

[Breakfast Pants]

Hey dumbass, he didn't say he was still 15. And no, if it is a 15 year old kid who did this, he should not 'rot in jail'. If he takes pws and begins breaking into bank accounts with them, sure.

Re:Bull

[Lord Ender]

Well, in college, I did build a CPU (on paper) at the gate level. But my point is only that a person who is highly aware of every major component of his system is going to be able to wield it more effectively than a person who does not. Building (and selecting components) makes a person more aware of the machine's capabilities and more capable of fixing failures and bottlenecks.

And I don't mean to say it is OK for a kid to do this. I was answering the question "why are you a jackass?" That's why. It's not malice.

Re:Bull

[nurb432]

Good for you then, even if it was only on paper.

Re:Bull

[Lord Ender]

I'm sorry... is that sarcasm? If it is, I don't really care. I'm proud of having done it in a 10 week course and it's not the point of my sig (which many Mac users hate), anyway. My computer arch. class was one of the things that makes me think school was worth the $50,000 and sleepless nights in the lab.

And if that wasn't sarcasm: thanks for the compliment! :-)

Re:Bull

[nurb432]

Nope, not sarcasm at all.. if it came off that way, sorry about that .

Explaining reality

[Anonymous Coward]

Dude, if you think slashie comments are worth reading, I have a great job for you. I know this publisher, see, and he has this slush pile...

(yeah, I'm "reading" the comments on this article. First time in weeks as best I can recall, and frankly, so far I haven't seen one single thing that's worth half the time it's taking me to explain this to you. Mind you, I remember back when the slash wasn't 99% twits, but those days are long gone, and besides, the wench is dead...)

Re:IRC is dead. Use Jabber.

[Baloo Ursidae]

You inflict that problem on yourself. Write one.

Re:IRC is dead. Use Jabber.

[Baloo Ursidae]

You can just die, right here, right now.

Rest of comment discarded until paulmer2003 can grow a brain.

signal to noise

[Gary W. Longsine]

That's why there are so many accounts and so few posters. And that's how Slashdot has been able to remain readable.

Only just readable at that. The signal to noise ratio could stand some improvement. I'd like to be able to mod entire posts "lame," as well as be able to filter out people below a certain karma threshold. If I could send voltage to the user keyboard that would be even better. I'd love to be able to meta-mod "Fair mod, but lame ass comment."

Does that make me a bad person? ;-)

OWNED BY BANTOWN

[Anonymous Coward]

Not a troll, but the culprits were bantown.

They prolly did some social engineering on lilo or one of his fellow staff members. AGAIN.

Like the incident a while back when grog from the GNAA tricked him.

That is kinda scary though, that freenode has fallen into GNAA/Bantown traps several times.

Seriously, Should we be trusting them with projects and chats if they cant even tell when someone is playing them like a card to get their info?

You mean Ayn Rand, surely?

[Anonymous Coward]

Sorry, I had to be pedantic. Old Fred was far more forgiving.

Re:IRC is dead. Use Jabber.

[Anonymous Coward]

Rest of comment discarded until paulmer2003 can grow a brain.

Good retort. Now we know you are just a sycophant, not someone interested in technical merit.

everyone rags on poor old pizza

[/dev/trash]

But get the supremo versio and you get ALL your food groups all in one easy to eat meal.

Only the large networks are like that

[WilliamSChips]

On smaller networks, you see a lot fewer of those types. When you have a lot of people somewhere(tens to hundreds of thousands on Freenode) a lot of them tend to be bad.

Re:IRC is dead. Use Jabber.

[Baloo Ursidae]

I'm interested in technical merit, but no such debate can start off with "Fuck this guy," as paulmer2003 essentially started with. If you're going to call someone a sychophant, it's paulmer. That being said, if he's interested in reassessing his statement and removing any and all ad hominem attacks, I would be happy to listen.

Re:Watch as the Linux community eats it's own youn

[tetrahedrassface]

Yeah, I have to step up here and speak my mind about Freenode and Levin. I too have used Freenode for years, and as a signal of my appreciatian for the service.. have donated as well. The funny thing is the voluntary donatations are just that. Purely voluntary.
We have a small, but civil channel on Freenode, and have had to ban/kick him many times. We don't allow cussing, etc, and have the rules of conduct clearly stated, but he could never come to terms with them in any sense.
In a lot of ways he acts like a troll. He is clearly masking his own personal ambitions and prejudices against the PDPC under the guise of freeing freenode..whatever. All I can say is this, if McFarlands actions in #space in the past are any indication of his character and I believe they are.. Then be prepared for more childish hijinks from him.
He won't learn, never will, and hates anyone that does not abide his bad behavoir.
The first 4 or 5 times we had to ban him, we thought he might learn something. Turns out that was overly optimistic. The open source community should not eat its own..
That just ain't right

An excercise in free speech

[Legal]

An excerpt from the largely eneventful briefing session on #freenode-moderated tonight about said incident (brackets are mine, intended for illumination):

HedgeMage: We believe that 25 nickserv passwords were compromised during a limited window, but all concerned individuals are encouraged to change their nickserv passwords just in case.
HedgeMage: thanks, Astinus
HedgeMage: We'll open up the floor for questions, one at a time, in a moment. Please keep your question concise, and type it ahead of time so we can move as quickly as is practical.

          [several questions, answers, and no-comments]

HedgeMage: Since most of these seem to be repeats, we're going to close for now. I'd like to reiterate that we encourage all concerned users to change passwords

          [...]

Astinus: This room will go -m shortly, so ya'll can chat before we have another session.
HedgeMage: try not to get blood on the carpet
Astinus: Or we'll send in the cleaners, with pointy brooms
          Astinus has removed operator privileges to HedgeMage
          Astinus has de-activated the following mode : Moderated
nunsoup: DCC SEND "startkeylogger" 0 0 0
QuantumBeep: (o__o)
J: BACON
b33fc0d3: O.o
bureado hugs channel
enderst: heh
Naconkantari: ceiling cat is watching you.
WeblionX: First blood!
snorkle: !!!!!!LOLDONGS!!!!!VIVA EL CHE!!!!!!LOLDONGS!!!!!
rooly: spam
rooly: spam
rooly: spam
rooly: spam
rooly: spam
jeebusmobile: wewt
snorkle: !!!!!!LOLDONGS!!!!!VIVA EL CHE!!!!!!LOLDONGS!!!!!
snorkle: !!!!!!LOLDONGS!!!!!VIVA EL CHE!!!!!!LOLDONGS!!!!!
Eidolos: omg deluge
snorkle: !!!!!!LOLDONGS!!!!!VIVA EL CHE!!!!!!LOLDONGS!!!!!
snorkle: !!!!!!LOLDONGS!!!!!VIVA EL CHE!!!!!!LOLDONGS!!!!!
DosBubba: 'Grats out to the GNAA for their newly acquired property, irc.vaccus.com #chat . /server -m irc.vaccus.com -j #chat Attacks will continue if you don't join.
DosBubba: I would like to thank Freenode for taking the time to gather the whole of IRC, it has been our pleasure to take part in such a trolling opportunity.
DosBubba: Remember: /server -m irc.vaccus.com -j #chat Attacks will continue if you don't join. !startkeygen
DosBubba: IRC was founded on the principles of trolling, and we thank Freenode from the bottom of our hearts for carrying the fine tradition into the 21st century - hopefully beyond.
bitplane: wooo
          lilo has activated the following mode : Moderated
          lilo has activated the following mode : Invite Only
lilo: got to love that
HedgeMage: so much for that.
Astinus: some people need to grow up :/

          [and then the channel fell silent again]

Re:IRC is dead. Use Jabber.

[paulmer2003]

I have better things to do with my time. If you do not wish to read my post, thats your biz - I couldent give a shit less. Have a good one, ~paulmer

Re:IRC is dead. Use Jabber.

[geminidomino]

Do what I do. Use irssi.

http://www.bitlbee.org/

boten anna

[MrHali]

after reading this, why does this story remind me of this -> http://video.google.com/videoplay?docid=6880888700 625496919

Re:IRC is dead. Use Jabber.

[stonecypher]

This could have easily been prevented if IRC wasn't being pushed to be what it isn't (namely secure and scalable).

IRC is way more scalable than Jabber, actually. That's one of the primary reasons for *not* switching.

Happy I stopped using Freenode

[dushkin]

See? Now I'm happy I stopped using freenode. Back then the problem was that it was just consuming too much of my time. However, now after FreeNode's huge failure to protect its users, I actually have a VERY good reason to just stay away from it. By the way, I wonder where ##otw is going to be at now.. :P

Re:IRC is dead. Use Jabber.

[Baloo Ursidae]

IRC is way more scalable than Jabber, actually

o rly? Since when? Last I checked you didn't have to go through some absurd peering arrangement to get Jabber servers to peer. Jabber is at least as scalable as SMTP, which is far more scalable than IRC could ever dream to be.

I agree!

[Anonymous Coward]

Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.

Which is why I always describe anti-Arab prejudice as "anti-semitism". Shakes out the propagandized suckers.

Where's the Updates?

[TheoMurpse]

What the hell is a "news" page for on http://www.freenode.net/ if you're not going to put, "WARNING: Do not identify with a password on IRC right now!!" on the page. The last news posted is from early May!

I'm not sure what IRCd Freenode is using...

[av2]

I'm not sure what IRCd Freenode is using but most networks have what you call q-lined nicknames setup on the servers. NickServ would of course be one of those qlined nicknames. You can't use it unless you are a client connected from a services server, it doesn't allow incoming client connections, only pseudo clients from the services daemon itself. I'm guessing the NickServ hack was made by tricking the other servers thinking it was linking the services daemon.

Re:IRC is dead. Use Jabber.

[WilliamSChips]

I used bitlbee a while ago but it didn't work on Jabber.

OK, which one of you

[Apoklypse]

fuggahs done this? 'fess up! ...

Re:Good Riddance - the five mistakes on freenode's

[Ailin]

I can't comment on FTP servers, but it is certainly not the IRC protocol being to blame here.

There are several faults of freenode:

• First of all, the authentication mechanism freenode employs is not written down in any IRC protocol. It is freenode's decision to use this authentication mechanism. As a proof that this can be done in a much more secure way on IRC, just look for example at QuakeNet. They are using a challenge authentication mechanism to authenticate users, yet they are still fully IRC compilant.
  
  Thus, using a weak authentication mechanism that can be easily sniffed is a fault of freenode.
  
  
• The second fault of freenode is the ability for IRC Operators to take the nickname of services bots without having access to the server computer. Other networks disallow the use of common IRC service nicks for everyone, without the possibility to override.
  
  Was freenode not using insecure server software, this security breach could have been avoided as well.
  
  
• Thirdly and fourthly, freenode supports authentication via the IRC PASS command as well as using the proprietary IRC NS or NICKSERV command extensions additionally to the PRIVMSG NickServ authentication mechanism. Such extensions are usually supposed to be more secure than just a PRIVMSG, since the software can easily make sure that such commands are ONLY forwarded to services.
  
  However, freenode server software will happily forward the passwords introduced via these alternate authentication comands to whichever person (service or IRC Operator) is currently carrying the correct nick.
  
  Freenode fails to send messages to NickServ to NickServ@services.server, as well as promote this possibility (or even enforce it) like other networks do (example: Undernet, one of the largest networks).
  Not only do they fail to promote this more secure alternative, but it is actually a broken server implementation that makes it impossible for them to use this additional security feature which would make sure that passwords end up only on the services servers.
  
  
• Fifthly and lastly, using a hostmask of *@* in the IRC Operator line is just foolish. It serves the network head right to have been taught a lesson, but it is unfortunate that he put his users and their credentials in danger.
  
  Such situation could also be avoided by using a more strict and secure IRC server software, but most of all this could have been avoided by simply some more cautiousness on the Network Administrator's side. Not using a blank wildcard in your IRC Operator line is like the first bold warning found on every Beginner IRC Admin tutorial.
  
  

As such, it can be very well aid that the whole situation is at the sole fault of freenode alone, and the IRC protocol - be it flawed all the way - can not be blamed for this.
On a sidenote, I am amazed that despite the IRC question time there still is no official announcement about this on their website.