Getting op without admins.

[MEGAF4IL]

This is something a member on the forums asked about.

"Is there a way to allow Operators to OP themselves when there's no one else on?"

As I see it, TFM might already auto-matically OP the player when they join. But either they have a colored nickname or TFM doesn't always auto-op a player when they join.

Anyway, this is either an issue and a suggestion or just a suggestion.

[Wild1145]

TFM doesnt currently automatically add anyone to op and to be honest, im not sure if its an amazing idea to support... There are a lot of potential problems with doing this, and im honestly not sure ti would be a good idea to do...

[robingall2910]

Maybe just because of the Admin Impostors?

[Wild1145]

I am bumping this because I think this topic does need some more discussion. If you folks could see the issues referenced above, it would be nice to come up with some sort of "complete" solution to this.

[Wild1145]

@DUFCLiam I like the idea, but how are we going to know if they just got sanctioned, are we matching just IP, IP and username or just username? And how do we store this information?

[MEGAF4IL]

Why do I feel like we could also enhance admin verification using some of these techniques?

[Wild1145]

@MEGAF4IL We probably can, raise a new issue, lets do this!

[Wild1145]

I am going to bump this, if anyone has some ideas on the best way to do this, please do post, as this is something we need to get right.

[JeromSar]

This might hook into a 'trusted player' system I had in mind some time ago. TFM would automatically select trusted players based on playtime, number of smites, bans, and the such. These trusted players would have a limited set of additional permissions. One of them could be opping players and themselves.

[Wild1145]

@JeromSar Im not sure as that would exactly be in the scope of this issue or not? I was thinking here at least more with automatically opping new players that have not joined before as existing players OP status will remain in place, and any OP can op another player anyway

[MEGAF4IL]

I just thought up that possibly, there would be an ability to track whether or not someone's been punished in the past by using hash's, as Liam had mentioned 9 months ago. We already have the gadmin hash thing, would it be possible to track that while it's already in the game and tie it in with the feature to allow an OP to type a command and get OP without asking. It could be like the report system, where they can type in the self-op command only when they're not op. I figure somehow though, TFM would have to execute the cmd as OP privs, so the cmd might have to trigger some code sorcery before it op's the player.

Regardless of the solution, it's ultimately pointless to try and implement this. Although it would be fun to try and see what other things you can do with the end result, possibly make other commands that are more useful for security or whatever, using the same technique originally used for ppl to self-op.

[MEGAF4IL]

I can't figure out how to edit my comments on here with mobile. As for it being like the report system, it would track the player's "malicious history" using a history-log identifying a user by their IP, or whichever is possible - and when the op-request cmd is used, it could alert admins to op the player (although this simple approach is pointless and nothing new could possibly come from figuring it out, the way I see it at least).

[JeromSar]

I think @MEGAF4IL has a great idea: keep track of when punishments happen, and don't allow recently punished players to be reopped. Then we may give regular players the ability to op other players that have not been punished.

[Wild1145]

@JeromSar The issue comes down to one myself and Hockey have been discussing for another project, and thats how do you prevent players from imposing as one another? I could stop another OP from being seen as a good player by going on as them and getting smitten when they're offline.

[JeromSar]

@Wild1145 You're right, but this is possible regardless. If a player is banned, their username is also banned. Resolving this is possible but is beyond the scope of this issue.

[Wild1145]

@JeromSar I feel it should be taken into consideration, the development of a system to handle players sanctions history is probably out of the scope of this particular issue is it not?

[JeromSar]

@Wild1145 Possible, it may be beneficial to host these three topics under one issue. Either way, this issue can not be directly implemented without first implementing either system. These should probably get separate issues.

[MEGAF4IL]

The only easy way to prevent players as posing as one another would be to have online mode enabled. We could keep a record of the player's IP's and usernames that go with them, and use the IP for main recognition as done with TFM recognising an admin from an impostor. Possibly add a feature where an OP impostor (or ban bypasser) gets temporarily caged automatically similar to how an admin impostor would, and warn the admins about the impostor with a comparison of the original IP and the "impostor" IP. If it's the same username:IP combo

[MEGAF4IL]

As I was saying before I hit the wrong comment button trying to move my keyboard cursor (they're literally right next to eachother - smh github).

If it's the same username:IP combo, the 'player' is free to be on the server when they join, without containment. This is all to prevent impostors - obviously we'll add a whitelist/blacklist for certain usernames. (Such as any YouTubers or celebrities, .etc).

[Wild1145]

@MEGAF4IL That works until Dynamic / Sticky IP's come into play...

[MEGAF4IL]

@Wild1145 Couldn't we add their username to a whitelist though?

[Wild1145]

@MEGAF4IL Just gives the option for abuse though. I jimmy knows that bobby always is on a whitelist, he can just login as him and abuse.

[MEGAF4IL]

How often does a person's IP change? We could add another verification feature for people who are legit. I remember there being a mod implementing Twitter into the chat bar (I used it back when you could use Twitter to verify yourself as admin automatically). I'm thinking we could use an IRC (catserve had one - not sure if it still works) or a (custom/implemented into TFM) plugin for improved verification purposes, instead of manually having everyone verify. We've already got people with networking experience as well as coding expertise - if we were to make this work, it smells like a big project.

[MEGAF4IL]

Just remembered there's already some verification plugins made in the past where it asks a newcomer to create a password for them to use everytime they join, or when they have an IP change.

[Wild1145]

Currently the plan is to have a type of Discord authentication system for admins, but the scope of that has not expanded and is limited to just admins currently. Other ideas are possible, I think the forums is another option but again its currently just scoped around admin authentication.