fckmeta addon

Mon, 09 Sep 2024 09:56:08 +0200

adminsforum@hubzilla.org

𝓒𝓱𝓻𝓲𝓼 wrote the following post Mon, 09 Sep 2024 09:56:17 +0200

fckmeta addon

can we use the streams addon "fckmeta"

https://codeberg.org/streams/streams-addons/src/branch/release/fckmeta/fckmeta.php

also for HZ?

show all 9 comments

Mon, 09 Sep 2024 11:34:09 +0200

Harald Eilertsen

harald@hub.volse.no

Can't see why not. You may have to double check the hooks, but otherwise it looks like it should be a straight forward port.

Mon, 09 Sep 2024 11:44:48 +0200

RockyIII

rocky3@im.allmendenetz.de

@Harald Eilertsen

double check the hooks

not sure how to do this... i looked into the list /help/en/hooklist and some of the hooks in streams seam to be different

Mon, 09 Sep 2024 16:18:37 +0200

Grouchy

grouchy@hub.grouchysysadmin.com

You're honestly better off dropping Meta at the web server or network level. If you wait until traffic reaches Streams/Hubzilla, then you're spending resources on PHP execution. That can take away from being able to process legitimate traffic.

Mon, 09 Sep 2024 16:33:54 +0200

Harald Eilertsen

harald@hub.volse.no

@Grouchy I don't disagree, but that may not be an option for all setups. This could be a useful addon for those cases.

Mon, 09 Sep 2024 18:14:41 +0200

RockyIII

rocky3@im.allmendenetz.de

@Grouchy

dropping Meta at the web server or network level

how could we do that?

Mon, 09 Sep 2024 18:25:41 +0200

Harald Eilertsen

harald@hub.volse.no

@RockyIII Have the webserver (or a WAF like ModSecurity) do the checks and block the requests before they're passed on to PHP.

Mon, 09 Sep 2024 18:38:18 +0200

_jayrope

jrp@hub.kliklak.net

@Harald Eilertsen @Grouchy @𝓒𝓱𝓻𝓲𝓼 Isn't it sufficient to simply put threads.net into admin/security "Block communications from these sites"?

Mon, 09 Sep 2024 18:50:20 +0200 last edited: Mon, 09 Sep 2024 18:59:40 +0200

Grouchy

grouchy@hub.grouchysysadmin.com

@RockyIII

Here's a Haproxy and Nginx example.

Haproxy - Add this to your front-end. Create listed meta-asn files. This blocks IP ranges as well as bot names.

        acl network_meta src -f /path/to/haproxy/meta-asn-ipv4
        acl network_meta src -f /path/to/haproxy/meta-asn-ipv6
        acl meta_agent hdr_sub(user-agent) -i "threads.net"
        acl meta_agent hdr_sub(user-agent) -i "instagram"
        acl meta_agent hdr_sub(user-agent) -i "facebookexternalua"
        acl meta_agent hdr_sub(user-agent) -i "fb_iab"
        http-request reject if network_meta meta_agent

Nginx - This just blocks bot ranges. You can block by IP to in a similar fashion.
meta_bots.conf = list of user-agents

map $http_user_agent $meta_bots {
default 0;
"~threads.net" 1;
"~instagram" 1;
"~facebookexternalua" 1;
"~fb_iab" 1;
}

Then in your nginx.conf, or site file, add the following to use the above agent list.

include /path/to/nginx/meta_bots.conf; 
if ($meta_bots = 1) { 
   return 444; 
}

Mon, 09 Sep 2024 18:54:03 +0200

Harald Eilertsen

harald@hub.volse.no

@_jayrope They may operate from different domains. The plugin checks the user agent from the request, which would block the bots regardless of which domain or IP address they originate from.