NanderTGA / msgroom-orm

A MsgRoom client.
https://nandertga.github.io/msgroom-orm/
MIT License
4 stars 0 forks source link

block other bots too #63

Open NanderTGA opened 1 year ago

NanderTGA commented 1 year ago

So turns out people have been experimenting with TestBot's repeat command, and used it to trigger other bots. This is not good, as people could for example abuse one bot to trigger another, while the bot that was triggered wouldn't know. Solution? New option in the constructor: blockBots. This new option will block anyone who has a prefix or "bot" in their name. I'll also notify a user when they change their name or join with such a name that they will be ignored due to their name.

mybearworld commented 1 year ago

I'll also notify a user when they change their name or join with such a name that they will be ignored due to their name.

So if a bot joins, all bots using msgroom will send a message saying that they'll be ignored?

NanderTGA commented 1 year ago

Yeah, not the best solution. How about one bot does that? But what if that one goes offline? Maybe I should just scrap this stuff.

The way we'll know if a user is a bot is if this pattern can be found in the name: [something here] All bots have this to indicate a prefix. (or to indicate they are a bot, like this: Yabluzo [BOT]) There's one downside though: something like this user [ADMIN] will also match. But that doesn't seem that big of a problem since most people will not pretend to be admins.

mybearworld commented 1 year ago

So I'd have to rename toB for that to work?

NanderTGA commented 1 year ago

What's the current name of toB?

mybearworld commented 1 year ago

It's just %toB (whatever). It should probably be clearer that it's a bot, anyways, I wanted to give as much space as possible to statuses.

NanderTGA commented 1 year ago

I think you're the only one who doesn't have this pattern in the name. How about you rename to [%] toB :)?

mybearworld commented 1 year ago

It would be unfortunate, but if necessary, I'll do it...

NanderTGA commented 1 year ago

Maybe we can have bots send a message 🤖 Beep boop, I'm a bot. My prefix is ${prefix}. But yet again, a bunch of messages.

So how about we combine the two? We add an option in the constructor to mark the client as a bot, we check if the bot complies with the name pattern on join, if it doesn't, we send the message. This should solve the problem.

NanderTGA commented 1 year ago

I have recently gotten back in touch with ctrlz. I am planning to make a proposal to give clients the ability to mark themselves as a bot (and provide their prefix as well), so other bots can ignore them.

NanderTGA commented 1 year ago

This issue is probably not going to be fixed on our side, as we will need to do some weird stuff if we would want to fix this.

miki1513 commented 1 year ago

I think it should detect those: [bot], [BOT], BOT, bot, and prefixes in name

NanderTGA commented 1 year ago

Then how would that work for toB? I have added the wontfix label for a reason and I'm unfortunately not changing my mind.

NanderTGA commented 1 year ago

To clarify my decision: Implementing this idea would be too risky because we would be blocking people based on their names. Oh and we can't tell them either due to not wanting useless spam in the chat. Then we'd have to account for name changes. And one more thing: not all bots have bot, [bot] or whatever in their names.

Detecting prefixes in names is practically impossible, since anything can be a prefix. It doesn't even have to be inside brackets (e.g. toB) If we were to assume anything inside square brackets to be a prefix, there would also be a whole load of false positives. For example: kris47 [botcreator] is not a bot, but this solution would tell us kris47 is a bot with the prefix botcreator.

Conclusion: this would be too much work implementing a terrible solution for a problem that shouldn't even be fixed on our side. Not a single solution (or a combination) would be practical and reliable.

Thank you for understanding.

miki1513 commented 1 year ago

Kris47's name is Kris47[botcrea], not Kris47 [botcreator]

NanderTGA commented 1 year ago

I know, I was just trying to get the point across.

NanderTGA commented 12 months ago

The wontfix label is a pretty inaccurate representation of what's going on here. I have published a proposal to the blog and have sent it to ctrlz. I was told yesterday to "expect a response either later today or tomorrow".

nolanwhy commented 10 months ago

a very bad way of doing it, putting an invisible character on the left and right of the message of the echo command, (alt+0173).

NanderTGA commented 10 months ago

That's a good way of hacking around the issue tbh, but why on the right of the message too?

NanderTGA commented 9 months ago

I'm currently implementing a temporary solution using Sheesh's bot API. The option will be called blockBots and will use the bot flag to check if a user is a bot in the future. I'm also adding an option called bot to mark your user as a bot.

Defaults: bot is true by default. If bot is true blockBots and blockSelf will be true too. If bot is false blockBots and blockSelf will be false too.

nolanwhy commented 8 months ago

MRCS has implemented the bot tag, would be cool if the real msgroom had implemented it too. or at least just in the flags