Flood/Spam blocker suggestion and question
 

This is both a question and a suggestion:

What exactly is the format of entries in the blocker? Can I use wildcards an/or boolean operators?

Right now, it seems that the search request must match the "banned message" exactly. I am not certian if wildcards or booleans are allowed, but it would be a great feature to add. For instance, I could add "hardcore AND sex" to filter all messages that contain both hardcore and sex.

I hope you get the idea.

Great client, by the way!! Keep up the good work!

Good question, it's a common one (in fact, I updated the Gnotella FAQ the other day to reflect this question at http://gnotella.nerdherd.net/help.html#Q_FOURTEEN ). No, boolean operators are not allowed. Right now Shaun is working really hard on sockets, so this is going to fall under a low priority at the moment, but it has been recognized.

-Yytrium-

One more thing... The block list is not saved after I close Gnotella.

Maybe it is supposed to be this way, but I would like that changed so it saves.

Thanks

Well, it's not "supposed" to be like that, it just never was programmed. I think I'm going to recommend to Shaun that it clears the entry after say, 60 seconds. This way nobody can abuse the feature. Whatd'ya think?

-Yytrium-

Well, I can see why you would not want the blocker list to be saved and why you even suggest it should be automatically cleared every so often. You could argue that it goes against the "open" nature of Gnutella as a whole to be able to block certain searches from propogating through your client (on an ongoing basis).

BUT..... Because Gnutella is open sourced, individuals can do whatever they want, and I may not want my compter being used to help distribute certain propoganda (some of which is obviously illegal, and I don't mean MP3s). I, personally, would like to be able to specify what I don't want propogating through my computer and keep that list at my own discression.

You can argue all you want, but in the end it comes down to CHOICE. People can choose to ignore what their client propogates or they can block something they don't believe in.

Perhaps we could have two types of item in the block list: one temporary in which Gnotella detects flooding and spamming and Gnotella can clear, and one permanent that the user can control according to his/her discression.

Not everyone may agree with me, but that is their CHOICE. I just want to have the CHOICE of blocking what I want while still supporting Gnutella.

As far as manually adding filter rules, I don't do that (anymore). But the idea of blocking, at LEAST temporarily, repeatedly abused queries is a good one. It's basic network protection at its finest. Whenever I used to use other clients than Gnotella, I'd feel naked and helpless on the network because I just knew I was participating in the abuse.

-Yytrium-

Your choice shouldn't be whether or not you want to destroy the network by blocking searches. Your choice is between using the gnutella network or not.

I've been noticing a lot of repeated denial of service type queries that are at the level where they don't trigger the autoban. I am assuming they are DOS because they occur together in cyclic sequence. These are terms like: "asf", ".asf", ".mpg", "jpg", ".jpg", ".avi", etcetera.

I've added them manually to be blocked. It's easy enuf to manually add them each time I fire up gnotella, but it would be nice to have them saved. Yeah, I know, abuse will occur as long as blocking is allowed. But having gnotella forget after 60 seconds will not stop automated re-adding of terms. The best thing to prevent casual DOS by network vandals is to not allow wildcards and require exact matches. And to set a limit on the number of banned items or else you will have someone entering 1000 lines into the banned list like "gnutella.zip", "file.rar", you get the drift.

dan:

Destroying the network? IMO, it would be destroying if there wasn't protection against flooding.

-Yytrium-

Hmmm.. this has become a much bigger and more contorvesial topic than I originally thought it would...(that's good, the entire Gnutella idea needs some serious thought and discussion to succeed).

Anyway, I still feel that a SAVEABLE custom block list would be beneficial in my opinion. (And this is just that, an OPINION. I realize some will disagree with me. If you do disagree with me, you don't have to use the saveable block list) If you are running a client, you obviously want to contribute to the network, so you will not deliberately block all searches if that is what you are worried about.

If you just want to search the network and not serve any files, you can just use one of the many web portals.

Like I said, you have the CHOICE of putting entries in the saved block list. If you think this is the wrong choice, educate me and others why.

Yytrium-
Perhaps it would help if you described exactly how Gnotella determines if a particular search is spam/flood or legitimate.

Well, we don't have to have any manual blocking. My way around it then would be to use any gnutella client that let me spam a whole bunch of repeated keywords and then everyone else on gnutellanet would AUTOMATICALLY add that keyword to their banned list.

I am tempted to do that right now in order to get rid of all these "*.mpg", "*.zip", ".zip", ".asf", etcetera, wasteful "denial of service (DOS)" searches that are appearing via the Monitor function. I know that they are DOS because they keep appearing in cyclic fashion from someone's automated robot. I am also seeing a lot of "a mp3", "b mp3", "c mp3", etcetera types of searches in cyclic fashion too. Whoever is doing this is pretty clever. They're starting to use a lot of asterisks in their keywords to avoid the exact name matching of people's filters.

In my feeble attempts to filter out these spammers trying to reduce gnutellanet, I end up setting 1 outgoing, 5 incoming connections in the hopes that more people would use the filtered feed from my machine. *sigh*

No one has comments on these spammers? It is almost like the RIAA or MPAA is practicing Denial of Service tactics. I thought DOS was illegal for them to practice on internet?

Wow, this thread has gotten out of hand! http://www.gnutellanews.com/forums/smile.gif
I never would have imagined that this feature would raise so much controversy, although this isn't the only place it's discussed; it's come up in #gnutella IRC more than once in the past. I simply think of it as a feature, and nothing more -- I don't understand all the talk about it http://www.gnutellanews.com/forums/smile.gif
I think people are too dependant upon this big gnutellaNet (what we know as the gnutellaNet, that is). Let me take you back a few months ago, when I first got my hands on Gnutella 0.45. When I first discovered what it could do, I thought, "Wow! I could setup private networks amongst a group of people and it would be totally anonymous." Not to bore you or anything, but I still keep that view in mind today. It's just my opinion that people get on Gnutella and think of it as this global file-swapping solution like Napster is/was. I really have no news to report about changes with this feature in the upcoming 0.7 release (we just fixed the BBS bug (don't ask), which means we're very close to release!) Anyway, that's just my $0.02.

-Yytrium-

As if enough wasn't said already...

I do agree that one must have the choice of whether to propagate any particular query or not. People that strongly feel towards an issue may find it uncomfortable to encourage sharing of certain information. I feel we must account for their right to express themselves.

Yes I do feel that argument stating that one should only choose whether to participate in the GnutellNet or not, rather than whether to propagate a certain type of queries, is reasonable in a number of ways. One, it makes client programming much easier. However, I feel that just because it is POSSIBLE to block some queries by any client on the network, we must account for future (or present) development of this feature.

In a word, I feel that if it is possible, it must be done or accounted for. Gee, maybe we should even have to classify each client according to the degree of restriction it puts on the queries it propagates.

Below are 2 extremes:

• A fully UNrestricted (or fully open) client will propagate any query, no matter what it is.
• A fully restricted client will propagate NO queries.

There will be a number of intermediate classifications:

• A client which propagates everything, except globally banned queries.
• A client which propagates everything, except globally banned queries, and a few manually banned queries (ding-ding, we've heard this one before from Neo_Geo!)
• A client which propagates everything, except globally banned queries, and a bunch (see below) of manually added queries.
• A client which propagates only a specific set of queries (say those that match a certain substring).

Exactly how many is a "bunch" (as used above)? We might want a formula, in which some queries may be given more weight, while others less. Weights of all queries would be added, and if the sum excxeeds a certain number (say, based on the current GuntellaNet average), client would recieve a certain classification.

If course, we can add to this thoughts on how a group of users can create a GnutellaSubnet for the purpose of sharing a custom query ban list... Gee, my mind is just running wild, can't you tell? :-)

All this sounds awfully complicated. Am I possibly adding features to the next generation of the protocol?.. Hey, some time someone has to come up with these thoughts, for them to even be considered.

But back to the present... I do feel that for now users should be able to add manual queries bans, which would persist from session to session. For each of then the user will specify whether the ban will be distributed to the GnutellaNet (in other words, will the neighbors be told to ban this query also). The bans recieved from the GnutellaNet will be added to the list but will not persist from one session to another.

I know it is easy for me to say all this, since I am not coding... Just my $.02 ... :-) Or more like $5.00 considering the length of this post...

-= onTy =-

Yytrium, I don't know How nor Who I would set up a private network with, so I am dependent on the gnutellaNet. That is why I think about the banning of certain keywords as being so important.