fckmeta addon

2024-09-09 09:56:08

adminsforum@hubzilla.org

𝓒𝓱𝓻𝓲𝓼 wrote the following post Mon, 09 Sep 2024 09:56:17 +0200

fckmeta addon

can we use the streams addon "fckmeta"

https://codeberg.org/streams/streams-addons/src/branch/release/fckmeta/fckmeta.php

also for HZ?

show all 9 comments

2024-09-09 11:34:09

Harald Eilertsen

harald@hub.volse.no

Can't see why not. You may have to double check the hooks, but otherwise it looks like it should be a straight forward port.

2024-09-09 11:44:48

RockyIII

rockyiii@huby.infozoo.de

@Harald Eilertsen

double check the hooks

not sure how to do this... i looked into the list /help/en/hooklist and some of the hooks in streams seam to be different

2024-09-09 16:18:37

Grouchy

grouchy@hub.grouchysysadmin.com

You're honestly better off dropping Meta at the web server or network level. If you wait until traffic reaches Streams/Hubzilla, then you're spending resources on PHP execution. That can take away from being able to process legitimate traffic.

2024-09-09 16:33:54

Harald Eilertsen

harald@hub.volse.no

@Grouchy I don't disagree, but that may not be an option for all setups. This could be a useful addon for those cases.

2024-09-09 18:14:41

RockyIII

rockyiii@huby.infozoo.de

@Grouchy

dropping Meta at the web server or network level

how could we do that?

2024-09-09 18:25:41

Harald Eilertsen

harald@hub.volse.no

@RockyIII Have the webserver (or a WAF like ModSecurity) do the checks and block the requests before they're passed on to PHP.

2024-09-09 18:38:18

*_jayrope

jrp@hub.kliklak.net

@Harald Eilertsen @Grouchy @𝓒𝓱𝓻𝓲𝓼 Isn't it sufficient to simply put threads.net into admin/security "Block communications from these sites"?

2024-09-09 18:50:20

Grouchy

grouchy@hub.grouchysysadmin.com

@RockyIII

Here's a Haproxy and Nginx example.

Haproxy - Add this to your front-end. Create listed meta-asn files. This blocks IP ranges as well as bot names.

        acl network_meta src -f /path/to/haproxy/meta-asn-ipv4
        acl network_meta src -f /path/to/haproxy/meta-asn-ipv6
        acl meta_agent hdr_sub(user-agent) -i "threads.net"
        acl meta_agent hdr_sub(user-agent) -i "instagram"
        acl meta_agent hdr_sub(user-agent) -i "facebookexternalua"
        acl meta_agent hdr_sub(user-agent) -i "fb_iab"
        http-request reject if network_meta meta_agent

Nginx - This just blocks bot ranges. You can block by IP to in a similar fashion.
meta_bots.conf = list of user-agents

map $http_user_agent $meta_bots {
default 0;
"~threads.net" 1;
"~instagram" 1;
"~facebookexternalua" 1;
"~fb_iab" 1;
}

Then in your nginx.conf, or site file, add the following to use the above agent list.

include /path/to/nginx/meta_bots.conf; 
if ($meta_bots = 1) { 
   return 444; 
}

2024-09-09 18:54:03

Harald Eilertsen

harald@hub.volse.no

@_jayrope They may operate from different domains. The plugin checks the user agent from the request, which would block the bots regardless of which domain or IP address they originate from.