codestorm.net open-reg ban list

Automated protection against insecure matrix servers

Codestorm.net open registration policy list

Insecurely configured matrix servers are making it way too easy for spammers and put everybody else in the federation at risk. This policy list automatically scans for and finds those servers, providing you with one additional tool to protect you, your rooms and your servers users against large scale raids and invite spam campaigns.

↓  Scroll

What gets banned

A server is banned when registration asks for nothing at all

No email verification. No CAPTCHA. No registration token. If a scanner can walk through the whole signup flow and end up with an account without proving anything, the server is classified dangerously open and a ban rule is written.

Open registration by itself is not the problem. A server can let the public sign up and still stay off this list, as long as something on the way in makes automated account creation cost more than nothing.

dangerously open reg Signup completes with no verification step of any kind. Banned
protected open reg Public signup, but a CAPTCHA, email verification, or token is required. Not banned
oauth Login is delegated to an identity provider. Not banned
closed Registration is disabled. Not banned
unknown The probe failed (server offline or broken). Nothing is assumed. Held

Anything that does not positively resolve to ban or unban is held, and no rule is written.

How the list is maintained

Many scanners,
one list

Matrix is decentralized and so is this ban list. Several operators run their own scanner, each from a different corner of the federation, and every one of them writes into the same policy list. No human has to sit down and check servers by hand.

If you want to learn more about the scanner itself, check out Matrix-federation-scanner on GitHub.

●scanner — operator A
●scanner — operator B
●scanner — operator C
#cs-auto-open_reg:codestorm.netban and unban rules, written automatically
Discovery

Servers come in from everywhere

Each operator feeds their scanner from their own sources: server names seen by their homeserver or any other source that works.

Re-scanning

Entries never go stale

Known servers are re-checked periodically, so the list is always up to date.

Delisting

Automatic Ban Removal

When a re-scan discovers that a currently banned server is no longer in a insecure state, the ban rule is automatically removed.

Server admins

Just fixed your registration?

You do not have to wait for the next scheduled re-scan. The support room runs a self-service bot: ask it to re-check your server and it will queue a scan immediately and tell you what it found.

  1. Add a verification step

    Turn on email verification, a CAPTCHA, or registration tokens - or close public signup entirely. Any one of these is enough.

  2. Join the support room

  3. Ask the bot for a re-check

  4. The rule clears itself

    If the scan comes back clear, the ban rule is removed from the policy list automatically.

Think you were banned by mistake? Join the support room and get in touch with us. Edge cases and bugs happen but the people running the bots & list are reachable.

Moderators

Subscribe to the list

To start blocking insecure servers from your rooms and your users inboxes, tell your moderationbot to subscribe to the list. Meowlnir, Draupnir and Mjolnir can take the alias directly.

Meowlnir Draupnir Mjolnir

This site deliberately only explains the ban list itself. How to setup and use moderation bots and/or configure invite antispam on your homeserver is out of scope and best answered in the various support rooms of the moderation bots or your chosen homeserver implementation.

Open the policy list room  ·  Open the list support room