Libera-Chat / libera-chat.github.io

The website of Libera Chat, providing documentation and news
https://libera.chat
MIT License
418 stars 104 forks source link

Directions for connecting with SASL for thelounge IRC client #225

Closed samebchase closed 2 years ago

samebchase commented 2 years ago

I have been a thelounge IRC user and have been connecting to Libera.Chat for several months now. As of today, it seems I am locked out of Libera.Chat, and the message I am getting:

*** Notice -- SASL authentication to a NickServ account with a verified email address is required to connect from your current network. Please see https://libera.chat/guides/sasl for configuration assistance.
13:00
*** Closing Link: (SASL authentication to a NickServ account with a verified email address is required to connect from your current network. Please see https://libera.chat/guides/sasl for configuration assistance.) (irc)

Would be amazing if there are some directions given for TheLounge client as well. I'd be happy to contribute these instructions to the docs, if they are given in rough form over here and I manage to get it working successfully.

swantzter commented 2 years ago

It seems you just need to set the password and it should just work :tm: https://thelounge.chat/docs/configuration#defaults

lynnpepin commented 2 years ago

This bit is unclear to me and I don't see anything in this guide (or the libera.chat SASL guide) that helps explain it. (This is coming from someone coming back to IRC with ~15 years of experience on IRC. I am surprised to find IRC more alienating than Discord!)

Specifically, I am also kicked with the message "SASL authentication to a NickServ account with a verified email address is required to connect from your current network. Please see https://libera.chat/guides/sasl for configuration assistance."

As far as I can tell, this is not a problem with TheLounge, it is intentional behavior from Libera.Chat: It is just impossible to register if you're in a "bad" IP block. (VPN, VPS, unlucky, etc.) You can only register from a "good" IP block.

I know this is not intended as a help forum, but I hope this can help any wayward souls in search of an answer.

TLDR: It appears you must register from a "good" IP first, only clients on "bad" IPs get this message.

samebchase commented 2 years ago

Thanks for the details @lynnpepin. Guess we can close this now. I'm able to use TheLounge now.

ballerburg9005 commented 3 months ago

Libera is totally broken now for lots of people.

I get this error from dozens of places: when in public wifi, when trying to connect from a friend (cellular, DSL), when at home, also from various servers (OVH, Oracle Cloud, AWS, etc.), from VPN so and so.

I mean the extreme blacklisting of entire server IP-ranges seems to be the most bewildering and intentionally defective part of it, since people have to use IRC bouncers to be able to read messages when PCs are powered off, which invariably must run on some server. And blacklisting just one server can blacklist thousands of people. But I wouldn't be surprised if Libera also blanket-blacklists CGNAT IP addresses, i.e. just a single one of those banned IPs can equal hundreds of thousands of people at a time (not just servers - any sort of client). This is generally speaking why IP-based blacklisting is a 100% never ever no-go nowadays. Just can no longer sanely be done, without breaking like 10-25% of all clients for this reason alone. There are other solutions like no-registration one-time captcha challenges plus off-network reg + auth for this reason. Which Libera has implemented none of, so it is literally killing users with no options.

But arguably, within just very bad and ultra lazy pre-IPv6 non-IRC network policies this would make some sort of sense in a way and hence be "understandable" in a very remote sense of the word. Thousands and thousands of clients via a single IP = higher odds of blacklisting. Just roll the dice too often and you get normal people banned on masses by awful lazy and outdated practices. However from my extensive testing, it makes absolutely no sense at all that the tested IPs are shitlisted, like literally none. With NordVPN I was able to connect from certain countries. But my home IP didn't work, although I had this exact IP for months and it is not CGNAT (only at friend's and public wifi they have CGNAT I believe, though my country is extremely IPv4 heavy and others like India are extremely IPv6 heavy). But then I tried from this pure backend server I have access to, that has had the same IP since over a decade: again the shitlist error (very premium/expensive hoster). Another random server IP: the error. Then Kimsufi, the cheapest most abused server IPs you will find: Libera connects. It makes no sense, just broken nonsense. I have access to dozens of servers and VPNs, yeah, me personally I can find some solution. And so do spambots.

But what about all those other normal people with just normal internet connections, without VPNs, without extra servers and just maybe that one free bouncer box?

It is broken for them. RIP Libera. No point for me in even going for that 4th or 5th connection after the first 3 or 4 failed - if normal people would just die on the 1st try. This level of defectiveness is just too ludicrously insane to even attempt to bypass. Like where are we at now with Libera?; 1 out of 5 people not being able to connect or 1 out of 7? Even 1 out of 10 would be 100% never ever acceptable!

VPN is the only effective solution to make it work, since you can choose between hundreds of IPs easily and the blacklisting is random and affects all kinds of IPs all alike, not just VPN. But this solution doesn't work for servers, so you can't read any offline messages, which is basically garbage nowadays with Discord as competitor and high quality servers literally costing $0 at Oracle Cloud (in my experience all banned IP ranges with never ever offending addresses) and other providers. VPN on the other hand costs money. The verdict: it is fubar. IP-based blacklisting is absolute nonsense in this day and age (in large part thanks to IPv6), and will only ever result in nonsensical outcomes that break people's neck and yours included. But most competent and sane people already know this.

RIP and double and triple RIP. No network can recover from this kind of arbitrary and excessive shitlisting.

Meanwhile, Freenode, Quakenet, Tilde, etc. just work on all of those IPs like normal IRC networks ... if people only had known Libera would be crashed this hard against a wall, we would have all stayed at Freenode. I mean, I didn't even know until I tested it recently. I didn't connect to Libera for years, and back then when I did, I always used this one single IP (or range), that worked maybe just by chance to begin with. There is just no telling how many people have been booted out of the network from the start or are still being booted out slowly and cumulatively, due to bad blacklisting practices and whatever automated processes, that just permanently and indiscriminately ban and ban more and more IP addresses and ranges over time. Certainly not with heaps of communities still migrating from Freenode up to this day, and all that fuzz that has been going on due to the switch. There are tens of thousands of users missing on Freenode that never came back to anywhere on IRC. You have to ask: to what degree is this because of gross blacklisting malpractice on Libera? No one knows.

At this point, even if Libera publicly crucified all the staff responsible for this total breakage, it would take a whole lot more than that to recover from this situation, and establish some level of trust again. Like full transparency of network blacklisting and banning practices. I don't have any hopes in that personally. My advice: just put it to the garbage. This kind of stuff doesn't happen by accident or sheer incompetency in that kind of dimension. It only happens if an entire team of people is removed from reality and inaccessible to reason. Just personal experience. A network that discriminates this hard against such an astronomically huge percentage of users, and blocks access randomly and permanently based on IP, with no proper solution except for "keep trying at more and more friends places and hotspots at McDonalds until you hit one non-offending guy out of 5 or 10 we have not arbitrarily banned yet - or just get some VPN" is totally worthless. No matter if you personally can connect or not.

I mean even if my tests were an outlier by one order of magnitude (which is just mega unlikely, but entertain the thought for a second), or if it somehow depends on country of origin + providers, then it is still a total outrage that it is even possible for someone to hit like 9 out of 12 IPs banned, most of which verifiably non-offending the last month up to a decade (thanks to IPv4 address shortage, dialin pools now often have shrunk to like 1-6 addresses and you keep the same one forever unless you reset the router), plus having friends not being able to connect either.

top10_2023u

Look at this shit: Libera permanently lost 33% of all of its users over night in August 2023. Just further indication that it is totally RIP + fubar due to operators being insane.

If you think that it makes sense to remove 5 spambots, at the colateral of removing 1 valid user, I regret to inform you that this practice is not called "administration" it is called "mismanagement". I mean I get that they are probably understaffed, but this kind of outrage is just not a viable solution to anything. It is pure distilled death squared and evil to the core in nature. QuakeNET had 250k clients 20 years ago, and other networks were at 100k regularly. No one would have ever even thought of such things at the time. This situation is just unthinkable and unspeakable and no amount of excuses or backpaddling can fix this. Exit this network while you can.

Edit: I was told that the 33% user drop was due to a deliberate shutdown of the Matrix bridge (due to a dislike of spam-policies on the Matrix end), and that the bridge operated in a manner which only made verbally active users join on the other end. Since the overwhelming majority of users on the IRC end are verbally inactive all of the time and vice versa, this would mean they effectively killed more than half of their userbase with this decision (if not much much more). It is pure madness.

They are literally insane.

this-is-fine