01:15 < TeeSlayer> Does somebody know any other catch16 maps besides Grasscatch and Lightcatch?
15:58 <@Dune> strange, teeworlds uses .local?https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1677960.html
15:58 <@Dune> it uses .teeworlds for me
15:58 <@Dune> "added path '$USERDIR' ('/home/_teeworlds/.local/share/teeworlds')
15:58 <@Dune> "
16:05 <@heinrich5991> Dune: https://github.com/teeworlds/teeworlds/blob/07fa835e0f9435de1b9b67510d6bae3aa1bd2645/src/base/system.c#L1496-L1516
16:06 <@Dune> so that new folder path is not automatically created it seems
16:08 <@heinrich5991> Dune: issue reported in https://github.com/teeworlds/teeworlds/issues/1643 and fixed in https://github.com/teeworlds/teeworlds/commit/e117ee0ef1c329f3559fcfb64bd9b33e6adb82d2
16:12 <@Dune> ah, nice catch, that's on 0.7.2
16:35 < Oy> the rest on the list seems fixed or outdated
19:59 <@Dune> hm
19:59 <@Dune> Reportedly, twmaster3.teecloud.eu is sending a "near constant 20MB/s stream of UDP packets"
20:00 <@Dune> to a 0.7.2 server
20:00 <@Dune> reflection attack?
20:00 <@Dune> heinrich5991 ^
20:00 <@heinrich5991> yes
20:01 <@Dune> is that because of the 0.6 vulnerability?
20:01 <@heinrich5991> de*en already reported that their master server is being used for reflection attacks
20:01 <@heinrich5991> yes
20:01 <@Dune> :/
20:05 <@Dune> ooh the rcon command completion thing was just a reset issue :o
20:08 < Oy> yeah
20:08 < Oy> are there still 0.6 masters running?
20:08 <@heinrich5991> yes
20:09 < Oy> oh
20:09 <@heinrich5991> in fact, I think we still have more players on 0.6 than 0.7
20:09 < Oy> but 0.6 masters are unfixable :(
20:12 <@Dune> yeah
20:15 <@Dune> there is 7 years of content on 0.6, lots of people won't easily give up on that
20:25 < Oy> yeah, too much time without a major release :(
20:25 <@Dune> yeah that's the problem
20:25 < rand> without breaking everything
20:25 < Oy> but people providing the masters might get a problem with their hoster and then it closes eventually
20:26 <@Dune> yeah it can't be worked around
20:26 < rand> mods are ported to 0.7 step by step
20:26 <@Dune> some stuff won't be because their content creator is gone for years
20:26 < rand> 0.7 makes some mods features easier
20:27 < rand> unmaintained mod binaries will disappear
20:28 < rand> and then, when everything is calm, 0.8 will strike
20:28 < Oy> :P
20:29 < Oy> yeah, can't update when there's no src or people available doing it
20:30 < Oy> is there a 0.7 flagball already?
20:30 <@Dune> nope, but was there a 0.6 flagball?
20:30 < rand> better being open source than lost
20:30 <@Dune> sometimes there is source, like for ddnet and its forks and some client mods
20:31 <@Dune> but it's just really big and their original creators are gone I guess
20:31 < Oy> hm, thought there was
20:31 <@Dune> one the other side I think it's nice to only have well maintained servers :)
20:32 < Oy> yeah, bad when people don't update and keep security risks running
20:33 < Oy> i wonder if there still 0.4 or 0.5 servers running :)
20:33 <@Dune> there were 0.4 desertcamp servers back in the 0.6 days
20:55 < minus> heinrich5991: deen shut their 0.6 master down, i assume?
20:56 <@heinrich5991> I think it's just part of everyday master operation. perhaps some firewall rule is in place, I dunno. he certainly didn't shut it down for good
20:56 < minus> i tried pinging all 0.6 masters and none responded
20:56 <@heinrich5991> probably hoster/manual firewall in place
20:57 < minus> maybe the ping thing was just wrong
20:57 < minus> anyway, stopped the flood by shutting down master3
20:57 < minus> now you don't get any servers in 0.6
21:01 <@heinrich5991> I still get 137 servers on 0.6
21:01 < minus> interesting
21:02 < minus> did the server list query protocol change in 0.7?
21:03 <@heinrich5991> yes
21:03 <@heinrich5991> now it has a challenge-response before sending hte server list
21:03 < minus> i see
21:05 < rand> great work
21:11 < matricks_> heinrich5991: I saw somewhere a quite cool technique that increased the difficulty of the challange if it came from the same ip over and over again
21:11 <@heinrich5991> how? :)
21:11 < matricks_> heinrich5991: so it started to consume a lot of cpu power on the attacker end
21:11 < minus> proof of work?
21:12 < matricks_> was something quite simple, like factorizing numbers or something like that
21:12 < minus> wondering if i should set up a master myself
21:20 < minus> heinrich5991: how do i check server count per master on 0.7?
21:20 <@heinrich5991> do the challenge-response thing
21:20 <@heinrich5991> don't know how to off the top of my head
21:20 < minus> :<
21:27 < deen> minus: you can also ask me directly :D
21:28 < minus> i *could*
21:28 < deen> it's currently being used for reflection attacks and we have a hard limit of 1000 requests / second on it to cut down on that
21:28 < minus> can you add a low limit per ip?
21:29 < deen> sure
21:30 < minus> i do wonder why it targets that one dude only
21:31 <@Dune> probably because it would dilute the attack power otherwise?
21:31 < deen> does it? We get ~300 Mbit/s incoming from reflection attacks on ddnet servers too
21:31 < deen> spread across all
21:31 < minus> deen: you (or anyone, really) don't happen to have a tool for monitoring masters (server count)?
21:31 < deen> nope
21:31 <@Dune> https://status.tw/?p=status
21:31 <@Dune> ah, server count
21:31 < minus> i have this for 0.6 https://github.com/minus7/teeworlds_prometheus
21:32 < minus> that list seems quite outdated
21:35 < deen> minus: don't think it helps much, I see spoofed requests from different ips all the time
21:37 < minus> deen: how about a per-ip(hash) rule first, and a "global" rule afterwards in case >1kpps fall through the previous rule?
21:37 < deen> that's what I have now
21:43 < rand> server count per master ?
21:43 < rand> you could hack tw_api.py (upstream for 0.7, tag 0.6 for 0.6)
21:46 < rand> well: python2 tw_api.py >>> 0 servers
21:53 < rand> hm, for some reason, master1 does not like my server with bot…
21:58 < rand> dumb me with old firewall rules