Minetest logo

IRC log for #minetest, 2023-08-21

| Channels | #minetest index | Today | | Google Search | Plaintext

All times shown according to UTC.

Time Nick Message
00:10 v-rob joined #minetest
00:54 cryne joined #minetest
00:54 cryne joined #minetest
01:13 smk joined #minetest
01:48 cryne joined #minetest
01:48 cryne joined #minetest
01:57 cryne joined #minetest
01:57 cryne joined #minetest
02:28 proller joined #minetest
02:53 v-rob joined #minetest
03:29 proller joined #minetest
04:00 MTDiscord joined #minetest
05:56 germ joined #minetest
06:03 Trifton_ joined #minetest
06:24 calcul0n joined #minetest
06:25 lemonzest joined #minetest
06:27 olliy joined #minetest
07:00 cryne joined #minetest
07:00 cryne joined #minetest
07:13 Talkless joined #minetest
07:46 mrkubax10 joined #minetest
08:06 YuGiOhJCJ joined #minetest
08:12 YuGiOhJCJ joined #minetest
08:40 cryne joined #minetest
08:40 cryne joined #minetest
09:05 cryne joined #minetest
09:05 cryne joined #minetest
09:21 calcul0n joined #minetest
09:26 olliy joined #minetest
09:29 cryne joined #minetest
09:29 cryne joined #minetest
09:44 appguru joined #minetest
09:54 calcul0n joined #minetest
10:00 Thelie joined #minetest
10:24 Kilroy joined #minetest
10:44 s20 joined #minetest
11:07 proller joined #minetest
11:41 proller joined #minetest
12:33 mckaygerhard joined #minetest
13:04 Desour joined #minetest
13:43 TomTom_ joined #minetest
13:49 Leopold joined #minetest
13:59 Cork joined #minetest
14:04 Valeria22 joined #minetest
14:51 jaca122 joined #minetest
15:07 calcul0n joined #minetest
15:11 mckaygerhard left #minetest
15:45 definitelya joined #minetest
15:47 syl joined #minetest
16:10 proller joined #minetest
16:50 kyle56 joined #minetest
16:52 kyle56 interesting how my server still gets troll accounts going on there with racist names and shit. i get that its normal for that to happen with public servers. but my server is not in the list anymore and i dont share it anywhere publicly at the moment. its almost like someone out there, probably on a forum page only visible to logged in users, is still whining about it. now i dont know for sure because i dont have an account on
16:52 kyle56 there anymore but its a theory.
16:54 jonadab There are probably lists of servers other than the official one.
16:54 jonadab Though I don't know if anyone would be _portscanning_ for Minetest servers.  That seems a wee bit niche.
16:55 kyle56 maybe but i dont know why mine would be there. unless they just keep archives of old serverlist entries or port scan.
16:55 jonadab Archives is one possibility.
16:55 jonadab Also if you have existing users, some of them could be sharing it with friends.
16:55 Desour did your server's address change?
16:55 jonadab And then some of their friends could be...  not as nice as one would hope.
16:56 kyle56 well i know one of my existing users brought attention to it by posting a screenshot of his creation on the forum and forgeting to cencor some things. honesly thinking of banning him even tho i dont want to. he seemed kinda cool before that
16:56 Desour if not, it's probably always the same person. it's not like they're magically forgetting your server address just because you don't announce it anymore
16:56 jonadab With respect to archives:  the MT client retains any servers you've previously connected to at the _top_ of its list.
16:57 kyle56 i guess maybe i should change the server's port or something
16:58 jonadab Changing the port should get rid of anyone who is just using an archived list or still has the address from before.
16:58 jonadab But it also means your existing players have to take action to connect to the new port.
16:59 kyle56 well i am pretty much in contact with the users i care about. except the one who posted the screenshot checks my server website page which is pretty much a secret url.
17:00 book`_ joined #minetest
17:06 MTDiscord <warr1024> I doubt you're getting just normal "background" trolls; it's probably a few bad actors targeting your server due to the "controversial" nature of it.
17:06 MTDiscord <warr1024> Running a publicly listed server would get you a certain volume of noise but actually relatively little would be apparently-malicious.
17:08 MTDiscord <warr1024> If it gets really bad, you could (1) move your server to another port, (2) setup a honeypot server on the old port, and (3) notify your existing players (and ONLY existing players in good standing) of the new port when they log in (you can copy the auth database from the real server to detect them)
17:08 kyle56 maybe my new port number should be "fu" when converted from ascii to binary then to decimal (16 bit int little endian).
17:09 MTDiscord <warr1024> you'll have to make the hard decision then on whether to go lowercase or capital 😏
17:09 kyle56 ill keep that part a secret for now ;)
17:09 MTDiscord <warr1024> Also make sure you don't hit an IANA-assigned port number or you could end up getting a lot more noise.
17:10 MTDiscord <warr1024> Well, not like MT was all that careful about port assignments when it picked "30000 up to whatever"
17:10 MTDiscord <warr1024> In theory 49152 thru 65535 are supposed to be "private use" and unassignable but I don't know if anyone pays attention to that 😄
17:11 kyle56 or maybe i will use big endian. ill also keep that a secret for now too
17:12 MTDiscord <warr1024> Medium endian gets no love.
17:13 kyle56 well Americans love it in their date format.
17:13 MTDiscord <warr1024> 22% more cursed than DD.MM.YYYY format
17:13 celeron55 definitely don't pick that port you just described though, this is a publicly logged channel and that's not a very hard puzzle to solve...
17:14 kyle56 yeah thats true. i suggested it pretty much as a joke tho i dont think the trolls are smart enough to solve it.
17:14 MTDiscord <warr1024> I think it would take more effort to do the ASCII conversion than it would to just simply port scan the already-known IP.
17:15 celeron55 then again if you know your playerbase why not just enforce password login and register new players elsehwere
17:15 MTDiscord <warr1024> It all just depends on how determined your trolls are.  The less reaction they get from you, the quicker they get bored of the shit.
17:16 kyle56 true. unless the trolls read this i suppose they wont be getting a reaction. tho some troll dont even care about that. they just like to think they are causing mayhem.
17:16 celeron55 in this case some trolls might be thinking they are saving the world
17:17 celeron55 it's going to be pretty difficult to turn that kind of person around
17:18 MTDiscord <warr1024> The "crusader" kind of trolls aren't necessarily that much more durable than the "for gits and shiggles" kind, though, because there's always another crusade that needs to get fought looming around the next corner.
17:18 celeron55 with some luck, yes of course. it depends
17:21 kyle56 using the old port as a honeypot probably would be good. i could make it... well i dont know if i should say it here lol
17:22 MTDiscord <warr1024> All you have to do is copy rather than move the old server, and then your old server acts as a de facto honeypot and you can start making diverging changes to either fork as needed.  Anybody could do that to any world at any time and it'd probably take those not in the know a while to figure out it even happened.
17:23 kyle56 oh yeah true lol. maybe could even "accidentally" disable the world protections on the honeypot lol and make it a "anarchy" server of sorts
17:25 MTDiscord <warr1024> Ideally, you'd make changes that would slow down the attackers' progress in subtle ways, like tuning the server to make mapblocks load slower or increasing delays in game mechanics, to make them have to spend more time in the honeypot.  You'd also want to populate it with bots, or clone in a chat stream from another world, or something, to give the impression they're fucking around with real people.
17:25 MTDiscord <warr1024> Basically anything to make them waste more effort and get no value.
17:26 MTDiscord <warr1024> You could, of course, do much more trolly things to them, but then that would require you to pay actual attention to them to enjoy the fruits of that, and ultimately they're just not really worth attention.
17:26 kyle56 ooh thats a good idea. i like these fun ideas. the idea i had was just a basic blocking type thing
17:27 MTDiscord <warr1024> The "honeypot" analogy refers both to the sweetness (drawing your attackers away) and also to the stickiness and viscosity (keep them there for as long as possible, divert as much of their resources away into the decoy).
17:28 book` joined #minetest
17:32 kyle56 oh yeah i guess i didnt think about that. my solution would not really be a honeypot then. i could go for some fun so i think i will definitely NOT be making a honeypot ;) ;)
17:32 kamdard_ joined #minetest
17:33 MTDiscord <warr1024> Well, it doesn't have to be super effective as a honeypot, I guess.  A little effective would be ideal, i.e. especiallyif it prevents them from moving on and finding your real server and starting the cycle again.
17:34 MTDiscord <warr1024> and of course you don't want to invest a whole bunch of effort in trolling them only to have them leave very quickly and you not get to use your whole bag of toys.
17:34 kyle56 i wonder how i could do the bot players tho. i would probably just have to generate some fake usernames and make them show up on the "players on:" thing in the MOTD. but how would i get those names?  i cant use chatgpt because i refuse to give closedAI my phone number. i did make a script that makes dumb names but they all have a pattern to them.
17:35 jaca122 joined #minetest
17:37 MTDiscord <warr1024> You could just clone the names from some of your existing players, e.g. people the troll likely has already seen and expects to see on there.
17:37 MTDiscord <warr1024> I'd say you could actually get your REAL players to still use the honeypot too, to join in on the trolling, but they might give the game up too quickly...
17:38 MTDiscord <warr1024> I know some people who will be logged into like 3 or 4 MT servers all at the same time, just idling in some while active in another, so it's not hard to actually populate a server with legit players.
17:38 MTDiscord <warr1024> And as long as your server isn't on the server list, rules about "misrepresenting the players on your server" aren't applicable, especially when the audience for said server is solely an attacker...
17:39 Thelie joined #minetest
17:42 kyle56 i just hope my VPS can handle 3 servers. i already run a second server on it and it only has 2GB of ram.
17:42 kamdard joined #minetest
17:53 MTDiscord <warr1024> Where you get your hosting?  Contabo currently has a very good repuation with MT; I use their "Cloud VPS S", get 8GB RAM, 4 cores, and like 200GB SSD for 6 EU per month (works out to like $7 USD, depending on fluctuating conversion rates)
17:54 MTDiscord <warr1024> I'm running 2 worlds on it right now, though I keep them fairly small.
17:58 kyle56 do they have a data limit? i use buyVM
18:02 MTDiscord <warr1024> 32TB out at 200Mbps, then 100Mbps after that, unlimited downstream, from the look of it.
18:03 MTDiscord <warr1024> I don't remember whether those were the same terms at the time I signed up, or whether I'm on some older restriction.  But it's plenty for hosting MT, and a web server, and a handful of other things.
18:04 MTDiscord <warr1024> If you want to use it as a torrent seed box, you might find it constraining, but I don't know if you'd want to mix that with an MT server anyway...
18:05 kyle56 heh...  i kinda already do since i use my VPS as a seedbox for torrent versions of some of my projects.
18:07 MTDiscord <warr1024> The annoying thing is that they make it clear that the instantaneous rates are in megabits, but the TB limit is a tad ambiguous between terabytes and terabits.  Using bytes for one and bits for the other seems needlessly confusing, even if it IS just following general conventions.
18:08 MTDiscord <warr1024> Haha, they charge $90 for an SSL certificate like it's 2005 or something 😆
18:11 MTDiscord <warr1024> Well, I don't really see the point of any of their add-ons, tbh.  Lowest-priced budget option seems to be their best market niche anyway.
18:15 liceDibrarian joined #minetest
18:16 kyle56 well im probably not gonna go with them anyway. for reasons that may seem ridiculous. one of which is their use of google recaptcha. also they market their DDOS protection but their main site is using a competing ddos protection system. almost like they have no faith in their own system.
18:46 MTDiscord <warr1024> The recaptcha thing is kinda ridiculous, if it's just for the sign-up form, though I think if they made you do it all the time, I'd probably find that a lot more understandable.  I don't know about the DDoS stuff though, I've never had occassion to actually try it.
18:48 kyle56 i just wish that virtually every website on the internet didn't use a captcha that basically punishes users who are not signed into a google account and force them to help train google's AI systems.
18:49 MTDiscord <warr1024> You'd think that needing to actually have a credit card or paypal or some other form of payment would be sufficient and you'dn't need a captcha at all.  I mean, if robots want to actually pay you, I say let 'em.
18:50 kyle56 and is almost always implemented incorrectly tho this is true for pretty all captcha systems. often if i complete a form and do the captcha and it turns out something is wrong, they make you do the captcha again even tho you already proved you are not a bot. which makes the google recaptcha less likely to trust you next time as well.
18:51 MTDiscord <warr1024> Also hilarious when they blank the whole form on you too 😄
18:51 celeron55 captchas are already broken, bots are better at them than humans by now
18:52 celeron55 the only thing that works is money, or by delegating login to a bigger player (who likely generally asks money)
18:52 celeron55 the third thing that kind of works is being so obscure that bots don't care
18:53 celeron55 which often is the case when someone asks about these things
18:53 kyle56 or maybe make your own captcha system lol so they have to make new bots to solve them.
18:53 celeron55 when a service grows, you will end up in the situation that only money or requiring a google/whatever login works
18:53 celeron55 that doesn't help
18:54 celeron55 bots can use machine learning nowadays with image support
18:54 MTDiscord <warr1024> Eventually requiring a 3rd party service is doomed to fail too, unless they require an actual medical exam to prove humanity...
18:54 celeron55 they can solve any captcha with any required user actions, just like a human
18:55 MTDiscord <warr1024> Captchas used to be an effective way to let humans in and keep bots out, but since maybe a few months ago, that's basically been reversed.  They were never VERY effective, though, as people had "mechanical turk" type workarounds for a long time.
18:55 celeron55 well 3rd party services have a variety of options at their disposal. money is one, which tends to work. just requiring a phone number is basically requiring money via a 4th party, which works
18:56 MTDiscord <warr1024> My favorite trick I've heard of hackers using to trick human labor into solving captchas for free was to build it into some kind of "strip poker" kind of game and basically pay people in porn 😆
18:56 kyle56 man that would be interesting to actually see. imagine if my made my own captcha by making a simple puzzle in godot and export to HTML5. and monitored it somehow. would be interesting to see what the bots do.
18:57 MTDiscord <warr1024> The money thing only works as long as it remains feasible to keep robots from having financial resources, which is itself expensive.
18:57 celeron55 in finland domestic services can use a form of authentication that bases on the real identity of the user via a state issued smart card, which is pretty cool. that's one thing which isn't money based, but state based. i believe most of the world isn't quite set up for such a thing though, and it doesn't work for international services
18:58 celeron55 and most people use online banking based authentication in such cases
18:58 MTDiscord <warr1024> The idea of state-issued IDs is weird in the USA.  Like, we have cultural reasons to not want them to exist, but they DO exist, so the "compromise" is basically that they exist but they're a total mess 😆
18:58 celeron55 which again is based on money
18:58 kyle56 it kinda sucks that all the anti bot measures seem to have to be privacy invasive nowadays. im pretty sure thats how google recaptcha works. i think its only possible to get the "click the checkbox, wait a second, and verified" is to be signed in to a google account in the browser.
18:58 rubenwardy The US would never accept a state-issued id card. Which is why they abuse the insecure national insurance number system for that
18:59 MTDiscord <warr1024> It's not an insurance number system because it doesn't actually "insure" you against anything 😏
19:00 MTDiscord <warr1024> It's basically like a tax ID.  It also has some failure modes, like collisions, that you'd assume wouldn't be possible without making the entire system come crashing down, but it apparently limps along well enough somehow.
19:00 celeron55 anyway, captchas are over. if you try to design any new service that needs to scale out of obscurity, you need to base registrations on something else
19:01 kyle56 oh hey rubenwardy did you get my email? it was from a domain that starts with o and ends with x
19:02 MTDiscord <warr1024> Captchas are not exactly "over" yet, but they've definitely reached a terminal stage of their lives.  Basically you can no longer think of them as a "wall", but they're still a bit of a "speed bump", i.e. they make it a little more annoying for somebody to gain unauthorized automated access.
19:02 celeron55 i believe in the next, let's say, 5 years captchas will stop being a speed bump
19:02 celeron55 there will be a machine learning library available in every programming language to fill in captchas
19:03 MTDiscord <warr1024> It's gone from "oh shit, I guess I can't spam this place with bots" to "oh shit, I guess I have to download a 10GB model file and only run this thing when I'm not using my GPU for gaming" instead 😆
19:03 celeron55 or in your example, "oh shit, i guess i'll have to call my friend who runs the strip poker site"
19:03 MTDiscord <warr1024> Haha, yeah, it's hard to put a date on it because it's more like an asymptotic thing.  5 years from now, maybe we won't even think about captchas anymore, but even a few months from now, you could see drastic reduction in the usefulness of them.
19:04 kyle56 thats true. they will still keep basic bots out. at least for now. i know that if i made a web scraper, i cant be bothered to pay some shady AI captcha solving site for an API nor get a top of the line Nvidia® CUDA® GPU and train my own AI model locally.
19:04 grorp joined #minetest
19:05 MTDiscord <warr1024> I mean captchas seemed basically just fine at the end of 2022; the threats against them were just theoretical, and it was like "you'd need some serious resources" kind of stuff, like an OpenAI or Google or state-level actor.  Throughout 2023 that's gone from "huge budget" to "any kind of budget" and now we're on the cusp of "how good are the dumpsters in your area" for the level of resources needed...
19:06 MTDiscord <warr1024> Captchas still work in MT servers, though, because basically nobody can be really arsed to actually implement enough of the protocol, and throwing a basic captcha is just enough to make anyone who did just ragequit.
19:07 celeron55 there's the suspicion running around that openai didn't make the gpt-4 image API public because of captchas
19:07 MTDiscord <warr1024> (Weird to think of the ragequit-inducing-ness of MT as a security measure, but I guess whatever works 😏 )
19:07 celeron55 they're offering it only to legit companies and researchers while they're waiting for services to stop using captchas
19:07 MTDiscord <warr1024> I've heard the "we were worried about the implications for humanity" theory, and I've heard the "hey we can make some serious money with this" theory, and I bet it's a combination 😄
19:08 kyle56 oh that reminds me lol, i thought about making a client cheat mod that solves the anti-human math equation captcha used on the voxelmanip server but i didnt bother because i dont care enough.
19:08 celeron55 MT itself is still in the obscure category in terms of this captcha thing. not sure whether it needs to 10x or 100x in order to actually face the real world
19:08 MTDiscord <warr1024> Yeah, "don't care enough" is the hard hurdle to cross.
19:09 MTDiscord <warr1024> In my experience, 95% of human users can't pour water out of a boot with instructions written on the heel, so I'm not sure how worried I should be about somebody building a sophisticated boot-water-dumper bot.
19:12 celeron55 in order to consider implementing auto-solving for a custom captcha to be a good business decision, you need to be able to gain access, by doing it, to thousands of daily users with credit cards. for example for the MT forums it's like 100 tops of mostly kids with no money
19:12 celeron55 (not actually sure what the daily number is)
19:13 MTDiscord <warr1024> Well, the exact minimum return you need depends a lot on what you need to invest, which is the main thing that's so concerning about the reduction in the required investment.
19:14 celeron55 yeah i mean the case where it requires actual work and not a one-liner using a pre-made library
19:14 MTDiscord <warr1024> "Good business decision" only depends on money if you're in the "business" of trying to make money, but if that were universal, we wouldn't have to deal with occasional high-effort trolls.
19:14 celeron55 well, when it's not about money, it's usually about trolling, and the good thing about trolls is they're at least sometimes funny
19:15 celeron55 spam is never funny
19:15 celeron55 spam is the worst
19:16 kyle56 high-effort trolls are at least kinda interesting. i like to do that sometimes.
19:17 kyle56 one example of a script i made is in my minetest-pentest git repo
19:17 MTDiscord <warr1024> "high effort" as in "I'll run an entire server for it" is more like a piece of performance art, and I can appreciate that, but "high effort" as in "I'll bypass every security measure just to keep griefing the same thing over and over to get a reaction out of people", not so much.
19:18 MTDiscord <warr1024> putting it next to "minetest" makes "pentest" sound like somebody who just "builds" structures out of cubes by drawing them on paper.
19:19 kyle56 ah. well i guess i have sort of done both of those kinds. tho if something i do can be annoying if repeated, i try not to repeat it.
19:26 kyle56 well i might just make my honeypot server go through a UDP proxy to my home server. the connection will be less reliable but i dont care.
19:26 Talkless joined #minetest
19:31 proller joined #minetest
19:31 grorp joined #minetest
19:31 kyle56 then again i might not because i would like to know the IP of users who connect. right now when using nginx i just get the ip of the proxy.
19:35 kyle56 so how can i make the mapblocks load slowly?
19:39 MTDiscord <warr1024> I think there are settings you can use to limit the mapblocks sent per tick or the queue depth or something.  I don't remember, it was kinda arcane stuff.
19:39 celeron55 that's kind of the weirdest question i've ever heard
19:39 MTDiscord <warr1024> I don't think you can force it to be slow under all circumstances, but you can make it very sensitive to congestion or priority contention.
19:40 MTDiscord <warr1024> IIRC I once made a proxy that injects significant artificial latency on connections (really good for testing MP stuff locally) and I guess maybe that might work.
19:41 MTDiscord <warr1024> c55: actually, reducing mapblock sends could be pretty useful for really shit networks, which I've had some players from.  I suppose you could just try reducing the total terrain loaded in those cases, but being able to prioritize nearby interactions over terrain loading might be a nice compromise...
19:42 ROllerozxa I assume you can make mapblocks load slower by setting `max_simultaneous_block_sends_server_total` to something really small
19:43 ROllerozxa (and then there's also `max_simultaneous_block_sends_per_client`, which is per-client)
19:43 celeron55 here are some settings i could quickly look up that allow making a shitty experience: max_block_generate_distance, mapgen_limit, max_simultaneous_block_sends_per_client, full_block_send_enable_min_time_from_building, max_packets_per_iteration
19:43 celeron55 just read the explanation for each and set it "accordingly"
19:44 MTDiscord <warr1024> We should just have a shitty_experience_enabled setting.  We might even consider turning it off by default eventually...
19:44 ROllerozxa nah, shitty_experience_enabled should be a hardcoded C++ constant :D
19:45 MTDiscord <greenxenith> Remember to integrate the BS constant into it
19:45 celeron55 Warr1024: the thing you'd be looking for is for the server to dynamically adjust parameters per client to match the guesstimated client network performance
19:45 ROllerozxa ah yes, the minetest bullshit factor constant
19:46 celeron55 (a bit like, let's say, youtube switches you to 240p when it thinks your connection is bad)
20:00 proller joined #minetest
20:01 sometalgoo1 joined #minetest
20:06 appguru joined #minetest
21:14 BuckarooBanzai joined #minetest
21:14 appguru joined #minetest
21:23 grorp1 joined #minetest
21:40 grorp1 left #minetest
21:54 kyle56 it would be cool if the minetest mod api had built in websocket support. that could really help with the idea that was suggested of syncing the chat in the 2 servers.
21:56 MTDiscord <warr1024> Built in websockets would be good, as would built in luasockets.
21:57 kyle56 ooh yeah that too.
22:12 fling_ joined #minetest
22:33 panwolfram joined #minetest
22:52 vampirefrog joined #minetest
23:01 Lesha_Vel joined #minetest
23:58 kyle56 joined #minetest

| Channels | #minetest index | Today | | Google Search | Plaintext