Mibbit Hacked

We write to report emerging news of certain elements of Mibbit (an AJAX IRC client service) being hacked. The proof of hack is further backed up by Mibbit’s official statement.

Because of the nature of Mibbit’s front end, your web browser cannot connect directly to IRC. Rather, it has to connect via a Mibbit back end service in order to make a connection. This is comparable in some ways to connecting via a dodgy Russian proxy. The intermediate party (Mibbit in this case and a dodgy Russian in the case of the proxy) can view all transmissions made to IRC and do as they please with that data.

For you, as GeekShed users, this should flag up some major concerns. The first of these is that Mibbit appears to log all private messages. Mibbit has refuted these claims and stated that private messages are only logged when permission has been given by the user. GeekShed questions the legitimacy of this as both parties should surely be complicit in the logging of their conversations on a 3rd party server. We can only assume that this includes messages you sent to GeekShed’s services (NickServ, ChanServ, etc.) when registering and identifying to your nicknames and channels.

We are, as an immediate precaution, recommending that anyone who has registered their nickname or ever identified to it, using Mibbit, changes their password as soon as possible. If you are using the same password for other services such as Facebook, Twitter, E-Mail, etc. we strongly suggest that you change these passwords also to avoid these accounts being compromised.

We also strongly suggest that our users cease to use Mibbit at their earliest convenience. GeekShed offers a flash alternative and also fully supports use of the lightirc client.

To change the password of your nickname, use the following command, when you are identified to that nickname:

/NS SET PASSWORD yournewpasshere


To change the password of your channel, use the following command, when you are identified to the channel founder’s nickname:

/CS SET PASSWORD yournewpasshere


If you have any questions, don’t hesitate to find us in #help.

Tonight’s Problems

It’s been a rough few hours. We are sorry for this. An exploit was found in a 3rd party services module and used against us. This allowed the corruption of the access lists of 2 channels. Although it is fairly obvious from the code that an exploit caused by flawed logic exists, this has gone unnoticed for almost 3 years and it is expected that many more IRC networks will be affected by this.

We will shortly carry out a full audit of all 3rd party modules to check for similar exploits in those. We are sorry for any inconvenience caused.

Welcome CornishNerd

CornishNerd has recently kindly accepted our offer to join the GeekShed staff team. He will be primarily responsible for the forums in a bid to make them an active part of the community. Network administration is not an easy job and we are thankful for the time he has dedicated to us.

P.S. I realise this is the same as the post I did for Brigitte with the name and gender changed. Why reinvent the wheel, eh?

Welcome Brigitte

Brigitte has recently kindly accepted our offer to join the GeekShed staff team. She will be primarily responsible for the forums in a bid to make them an active part of the community. Network administration is not an easy job and we are thankful for the time she has dedicated to us.

Apply to Have Your Channel Featured!

Want more people to know about the fun stuff going on in your channel on GeekShed? Answer a few questions about your channel here, and we’ll consider your channel for a new feature on the GeekShed site. The idea is that every few weeks, a channel will be highlighted on the website, with details about the channel, what happens there, and other details.

There are a few requirements:

  • You have to be the owner of the channel or have the full permission of the channel owner.
  • You have to have an average of 10 or more different people in the channel regularly.
  • The channel has to be at least 3 months old.
  • The channel has to be open and public (no private or secret channels).

The GeekShed staff will choose channels to feature based on the application and observation of the channel. Acceptance is at the discretion of network staff. There is no promise or guarantee implied. To apply, just fill in the form below.

What is Identd?

When you use the /whois command or /ns info on yourself, you may notice the tilde before your connection information. Here’s an example:

~ilovestig@somewhere.com

That leading tilde (~) indicates that you are not running identd on your machine. As Phil explains it, identd is an age-old service that runs on port 113 and was designed for shared shells. It’s essentially a process that confirms that you are who your ident says you are. For the full, geeky details on identd, see RFC 1413.

Basically, your client sends your required ident as part of the initiation commands when you connect to GeekShed. The server then checks to see whether you have an identd running and uses the ident reported by that in your hostmask. If the server does not find identd running on your machine, it adds the tilde (~) to your ident.

Note: don’t confuse any of this with the tilde (~) you may see in your nick list as an indication of a channel’s admins. Those are nick prefixes.

How do you enable Identd on your machine?

Many clients either have Identd built in or include the option to turn it on. Check the documentation for your particular client. Note however that there are clients that will not provide support.

ChatzillaSee How do I enable ‘ident’?
ColloquySee Enabling Identd.
LightIRCNo longer available for use on this network.
MibbitSee ident.
mIRCSee Why am I unidentified and what does it matter?
SnakSee “The server keeps saying something about ‘Ident’ problems” on the Troubleshooting page.
TFlash (GeekShed’s
web client)
No longer in use.
X-ChatSee How do I enable identd in X-Chat?

Additional Troubleshooting Information

You can connect to GeekShed even if you cannot get identd running on your machine. You’ll just have the tilde (~) show up before your connection information. If you cannot get it to work, relax because there’s no penalty.

That said, if you investigate things further, you may find that you need to open up port 113 on your firewall or enable identd on your router. For more information, check out Section 4.3. “No identd” of IRC Connection Problems or Setting Up Identd on the IRCPolitics site.

 

—tengrrl

Is There Free Speech on GeekShed?

At some point, you’re likely to see someone else complaining about their right to free speech when a member of network staff asks them to quit talking about something. You may even see someone protesting about a channel’s moderators violating their right to free speech. What these people do not understand is that there is no right to free speech on a private network, like GeekShed IRC.

Why can’t I say whatever I want on GeekShed?

We want GeekShed to be a fun, family-friendly place where everyone feels safe and welcome. To help provide that environment, the staff of GeekShed believe that certain topics and ways of talking are not acceptable. The Terms of Service, linked in the footer on every page, explains that you are not allowed to use hate speech, harass anyone else on GeekShed, create a hostile environment for minors, or spam. If you say anything that violates these rules, you will be removed from the network. Read the Terms of Service for full details on the restrictions on your discussion.

Why can the network staff make rules about what people can talk about?

GeekShed is a private network. In such a private place, the right to free speech does not apply. A person’s right to free speech is only guaranteed in public spaces and from restrictions by the government.

First, recognize that GeekShed is not governed by the U.S. Constitution. Instead, GeekShed complies with the laws of the United Kingdom since the GeekShed IRC network is owned by GeekShed Ltd., a company registered in the United Kingdom. Personal rights in the United Kingdom are outlined in the Charter of Fundamental Rights of the European Union. In relationship to discussion on GeekShed, here’s the important passage:

Article 11. Freedom of expression and information
1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.

The Charter of Fundamental Rights only guarantees freedom of expression “without interference by public authority.” Your freedom of expression and information applies only to freedom from government censorship. Private authorities, like a private company and IRC network, are free to set whatever guidelines for speech and expression that they wish.

What about discussion in my channel?

The Terms of Service apply in your channel, but you can make additional rules for discussion if you want. Some channels on GeekShed have rules against discussing topics like politics, religion, or torrenting. Additionally, some channels do not allow “bad words”—rude or explicit language. As the owner of a channel, you are free to make and enforce such rules.

 

—tengrrl

How to Join Channels Automatically

The AJOIN command is a server-side command that keeps track of the channels you join each time you connect to GeekShed. If you login with your nick and identify with your password, you can join all the same channels automatically. It works no matter what client you use or where you connect from since all the details are kept on the server.

Note that your client may have an option to keep an auto-join locally. Check your documentation for details on using a client-side system if you want to keep your settings on your machine(s). This explanation will focus on the server-side system only.

What is required to join channels automatically?

Your nickname has to be registered, and you have to identify before you can use the AJOIN command. Additionally, the channel that you want to join has to be registered. Remember that you can only be in 100 channels, so you can only include 100 channels in your AJOIN list.

How do I join a channel automatically?

To add a channel to the list of those that you join every time you connect to GeekShed (your AJOIN list), use the following command:

/msg NickServ AJOIN ADD #channel

For instance, /msg NickServ AJOIN ADD #topgear would add the channel #topgear to your AJOIN list.

How do I add a channel that uses a key to my AJOIN list?

If the channel you want to add uses a key, you need to include the key when you use the command:

/msg NickServ AJOIN ADD #channel key

For instance, /msg NickServ AJOIN ADD #topgear hAmsT3r  would add the channel #topgear with the channel key “hAmsT3r” to your AJOIN list.

Can I just add every channel I’m in right now?

Yes, you can. Join all the channels you want to add, and use the command:

/msg NickServ AJOIN ADDALL

The command will also automatically include the keys for any channels to your AJOIN list.

How do I see a list of all the channels I join automatically?

To see a list of all the channels on your AJOIN list, use the command:

/msg NickServ AJOIN LIST

Use wild cards with this command to list only the channels on your AJOIN list that match a specific pattern. For instance, the command /msg NickServ AJOIN LIST #top* would return all the channels on your AJOIN list that begin with “#top” (for instance, #topgear).

How do I remove a channel from my AJOIN list?

To remove a channel from your AJOIN list, use the command

/msg NickServ AJOIN DEL #channel

For instance, /msg NickServ AJOIN DEL #topgear would remove the channel #topgear from your AJOIN list.

How do I delete all the channels that I join automatically?

To remove all the channels from your AJOIN list, use this command:

/msg NickServ AJOIN CLEAR

The command will delete all the channels from your AJOIN list. When you connect to GeekShed again, you will not join any channels automatically.

What if I get banned from a channel I usually join automatically?

If you are banned from a channel, please be sure to remove it from your AJOIN list, using the AJOIN DEL command above. Keeping a channel you are banned from on your AJOIN list may result in accidentally evading the ban.

Video Demonstration of the AJOIN commands

If you’d like to see some of these commands demonstrated, take a look at UKGeek’s video below, which was entered in our birthday competition last year:

 

 

—tengrrl

Recent Downtime

The more observant of you may have noticed us suffering from some major netsplits lately. GeekShed has typically been a stable network because of the pro-active tactics of its staff in resolving server issues such that they have minimal effect on our users.

We have, recently, been hit with large scale Denial of Service attacks which have crippled our servers. A number of servers have had to delink as the attacks are affecting other services that run on those servers.

We are making attempts presently to re-evaluate our infrastructure and will hold a meeting later today to decide on the best course of action. We do not have the finances to purchase DDOS-protected servers and, as such, are very limited in what we can do.

It is completely unknown to us who is launching the attack or what their motives are, but we ask them to kindly cease these attacks. We are a donation-funded service who are simply trying to provide people with an enjoyable experience.

EDIT: New infrastructure has been put in place and we are restructuring the network as best we can. We hope to have full service resumed shortly.

How to Use the Ignore Command

Ever wish you could mute someone on IRC? Maybe someone is talking about a movie you haven’t seen yet. Maybe a bot is making a lot of announcements in a channel and you don’t want to see them. Or maybe someone is just annoying you and you don’t want to listen to him anymore. The IGNORE command is likely to be the solution.

How do I ignore someone?

The IGNORE command is a client-side feature, not a command included on the IRC server. As a result, the exact way the command works depends upon the client that you use. Generally, you use the following command:

/IGNORE <nick>

Let’s say you’ve had your fill (so to speak) of LordBaconCheeseburger. You’d use the following command:

/IGNORE LordBaconCheeseburger

After that, you would no longer hear anything LordBaconCheeseburger has to say. Your client may support more complex features, such as the ability to ignore only some messages (such as ignoring PMs but not comments in a channel). Check your client’s documentation for specific details on how the command works.

How do I ignore someone who keeps changing nicknames?

You can keep adding nicks to your ignore list by using the command for each new nick. If someone is following a pattern, however, your client may allow you to use * as a wildcard. Let’s say LordBaconCheeseburger keeps changing nicks, if your client allows wild cards, you can use this command:

/IGNORE Lord*Cheeseburger

After that, you would no longer hear anything from LordBaconCheeseburger, LordCheeseburger, or LordDoubleCheeseburger.

If your client allows you to ignore by hostmask, you may be able to use this command, which works in mIRC:

/IGNORE *!*@protectedhost-ABCDEFG.fios.wi.cheesehead.net

With this command, any connection with that hostmask would be ignored, no matter what nick the user has. Remember though that these commands depend upon the client you are using. Some clients do not support these options at all.

How do you stop ignoring someone?

The way you remove someone from your IGNORE list depends upon the client you use. On some you can use this command:

/UNIGNORE <nick>
For instance, /UNIGNORE LordBaconCheeseburger

On other clients you use the same exact command you used to block the person: /IGNORE <nick>. The first time you type the command the client blocks the user, and the second time it removes the block.

Finally, some clients have their own system for managing the IGNORE list. You may need to access an address book or a user list. Check your client’s documentation for the specific details.

How does the IGNORE command work on different clients?

Each client has its own method for using the IGNORE command. Some pop up a box that lists everyone you have ignored. Some have an Address Book where you can check who you have ignored. Some feature ways to ignore one kind of message while still receiving another. It’s best to check the documentation for whatever client you use. Here is information for some of the more popular clients on GeekShed:

Chatzilla While not well-documented, Chatzilla does have IGNORE commands:
  • /ignore <nick> ignores nick
  • /unignore <nick> unignores nick
  • /ignore lists ignores
Colloquy Details on the Ignore command are on the Colloquy website. The FAQ also includes details on ignoring join/part messages.
LightIRC Use three commands as listed below, according to the lightIRC website:
  • /ignore <nick> ignores nick
  • /unignore <nick> unignores nick
  • /ignores lists ignores
Mibbit Find details on the Ignore command in the Mibbit Wiki.
mIRC You can use the /IGNORE command as described above. You can also click the Address Book button and then the Control tab to find the list of people you have ignored as well as simple buttons to add, edit or delete people from your Ignore list. To find more details, search for /ignore in the mIRC help file.
TFlash (GeekShed’s
web client)
Under the OPTIONS menu, choose the Friend/Ignore List command to see who you have ignored. You can add nicks with the + button and remove them with the button. You cannot use wild cards or hostmasks. You can ONLY ignore nicks.
X-Chat Find complete documentation for X-Chat on the Toxin site.

 

—tengrrl