On 19 July 2013 04:18, Jimmy Hess <mysidia@gmail.com> wrote:
On 7/19/13, Holbrook Bunting <holbrook@dal.net> wrote:
> hostname at anytime, I am thinking why not do this on a global scale?

The idea that a CSop can take action doesn't do much to address the
possibility of abuse.
Basically, there are a limited number of CSops,  whom additional work
should not be created for on a daily basis   ----   that is,   the use
of CSops to correct problems should be considered a contingency or an
emergency response in case of extreme unexpected circumstances,  not
an appropriate system for  deterring or preventing abuse on a daily
basis.

CSOp was a suggested level, this could of course be any global operator,SA, CSOp, sabuse or SRA. That would be an entirely different discussionthough and would ultimately be the decision of the highers.  
IRC operations staff involvement,  should always be kept an available
option to deal with emergencies,   but  it should not be an excuse for
 failing to insist that possible intrinsic avenues for abuse be
appropriately controlled and minimized  -----   automated systems
should resist abuse, and this makes them more scale able,  and
capable of servicing larger number of users more reliably.

--
The most likely kind of abuse I see with masking is -- ban evasion,
or  suppression of the user's real host, so they could rejoin channels
later using a different identity.

The server that a user is on also keeps the users ip and hostname (as withoper hostmasking). The ircd still checks against that as well when comparing with a channels ban/exempt/invite list. 
To allow users to have custom hosts on any global scale;   I do
believe  this calls for  having some form of  "IRC User"  reputation
system;   to restrict the capability to   "trusted users",   such as
nicknames with a known history:    nicknames registered for a
significant length of time,  that are able to get other IRC users to
vouch for/endorse them.

Could limit the use of the system to nicknames registered for say 30 daysor more.

Then I would recommend that there be an automated system   IRC users
could use to  report suspected abuses of masking  and other service
features.

And an automated mechanism for channel  operators to make an "Official
inquiry"  through services,   about  the real hostname behind a masked
user  visiting their channel

This would have to be something looked further into. Who's to say that such anautomated system there would in turn not be open for abuse as well? #operhelp would be a good place to start for reporting. 

--
-JH



--
holbrook / zort / srd