search

matrix-org / mjolnir

A moderation tool for Matrix
Apache License 2.0
325 stars 55 forks source link

Nonstop Abuse Reports #540

Open Ryonez opened 1 week ago

Ryonez commented 1 week ago

Essentially a recreation of #406

When pollReports is enabled, the management room is spammed (30sec-1min) with report messages. This will continue until the messages are deleted via the synapse admin api.

Ignoring(bad-report) the messages has no lasting effect, the message will show on the next poll.

I'm unable to use the web api for some reason. Even with the provided ngnix block, reports are not routed to mjolnir. It is disabled atm, but the ngnix block is still in place.(Some characters got stripped from a paste followed by cors issues. Resolved now)

turt2live commented 1 week ago

Logs from Mjolnir would be helpful to triage this.

Gnuxie commented 1 week ago

We have the same bug https://github.com/the-draupnir-project/Draupnir/issues/258

https://matrix-org.github.io/synapse/latest/admin_api/event_reports.html

Seems like Synapse doesn't anticipate the API to be to be used in a similar way to /sync, where the token would be used to make sure you don't read the same report over and over. They use the from token for pagination but they won't create pages for a client in a way that is consistent with /sync. This means that in Mjolnir & Draupnir's current report poller implementation we show the same reports over and over. They include an id for reports so that we don't show the same reports. It's difficult to see how we could utilise the ID without persistent storage.

Ryonez commented 1 week ago

Logs from Mjolnir would be helpful to triage this.

I'd love to offer them, but due to the other bug causing 404 errors, the log messages are self restricting. I can try poking again, but if there's a way to prevent the logging from muting itself that'd help.

We have the same bug the-draupnir-project/Draupnir#258

https://matrix-org.github.io/synapse/latest/admin_api/event_reports.html

Seems like Synapse doesn't anticipate the API to be to be used in a similar way to /sync, where the token would be used to make sure you don't read the same report over and over. They use the from token for pagination but they won't create pages for a client in a way that is consistent with /sync. This means that in Mjolnir & Draupnir's current report poller implementation we show the same reports over and over. They include an id for reports so that we don't show the same reports. It's difficult to see how we could utilise the ID without persistent storage.

Mjolnir stores some data in the room state it seems. Could seen id's be saved there? Then when you poll, check against seen id's, and if they are there don't display them again. Could expand that with timestamps, so if it's been say a day, or a week, and the issue is still there, then repost in case the mods missed earlier posts. And when reports are resolved, the reports could be removed via the admin api. That way the core of the reports is still in/managed by synapse, and the bots provide easier ways for management to view and respond?

I have found having mjolnir receiving reports directly is much slower for the clients making reports, and I dislike some that I can't see or manage them with other tools.