eMuleFuture

After timeless checking of data collected by my beta testers and myself, I might have something to finally detect current random str leecher mods.

If mod is 0.49b based and sends modstr (i.e. besides being based on 0.49b) and client is within Israel IP ranges (I'm aware a minimal requirement of IP2Country ...) > 99% (I'd dare to say about >99.3-99.4%) it is TLN/TLH.

As for arguments made by Stulle (here I won't be censored by him ...) like :

Code: Alles auswählen

1. "we don't ban on indicators like that. it would basically be a country ban!"
2. "and what if somebody made a private modification and did not update it yet? even a picky country ban with a whitelist and whatnot is a country ban and it is not up to anybody to decide a country is full of filthy leechers."

1. The random str leecher version usage is mostly limited to Israel, and so far no code even came close to idenify it - so ...

Just a simple correction a narrowed country ban - only mods, not official. Not any mod - just those based on 0.49b, among which this leecher usage is >99% (and rest assure the <1% are not always using non leecher mods - most of those are detected by CA as fast askers ...).

2. AJ hash ban was implemented knowing ~4% of all ed2k users are going to be banned - and yet DLP dlls with it were released ...
The chances of someone making new official mod based on old official version code which will be used by Israelli ed2k users are very slim, same goes for private copies of mods (how many non leechers modders or just compiling individual exists at Israel that would fail to get a published note on official site and on Israel's single non leecher community) ...


Personal note : if such a suggestion was made by other modders, or even users it is possible (some would say even likely) that it would have been reacted upon differently by Stulle. His reaction was to the poster (myself) and not to the post. This discussion could have been held of official site (DLP thread) - however the likelihood of being censored due to "propaganda" shifted the discussion here.

THIS IS OUTRAGINGLY WRONG! i am reacting to your proposal! i have had enough people telling me that the current mechanisms are wrong already and i am not going to get myself into the crossfire of this kind of discussion because i introduce anything like this! it is not a real detection if all you do is say "ah, well, if they use a mod, are israely and the mod they use is unknown to us it HAS to be bad!". this is whitelist banning and country banning!

if you are too much of a simpleton to understand switch statements and figure out a real way to ban these clients prophylactical banning anyone who is using a mod ain't gonna help you or anyone! despite your annoying simple-mindedness i am still capable of figuring out what is a good idea and what is not. the fact i seldomly do when interacting with you is that you seldomly - if ever - got any good ideas that are not just wrong or trivial.

it's pittiful how you try to influence other modders like this. i am certain that all other sane modders will deem your idea unfit and unfair. now get back to a fucking "C++ for dummies" book, you obviously need that more than extensive research that leads to unfair banning!

quick edit:
besides, the random modstring is NOT centered about israel. there are german leecher mods that use similar schemes and you are an idiot to be so self centered about israel and THL!

oh and about old aj detection:
it was based on the scheme AJ detected one another. that is entirely different to what you propose even though it failed at some points. nonetheless has it been removed from DLP already and will be removed from Morph ASAP!

it's really outrageous how I react short and on the point in this matter and all you do is accuse me of some personal feud when you are obviously the one getting to the personal level. shame on you, feel yourself spitted upon!

edit2: just by moving the discussion here without me even thinking about censoring you or whatever proved you are incapable to have a serious ontopic discussion. in fact, it disquallifies you from any.

You're using bad language - but that's you, I'll just deliver a kandy (it is spelled like this on puprose).

Besides - you seems to talk a lot of unfair banning: you did it, you did it for mutch wider audience, you were aware of if and look at your responce to nothing comparable ...

Another small point to think about is did it ever occour to you that C++ coding skills are not the topic here - start a topic on that if you wish (and look very good at the mirror if you claim that added "break" at last label in switches on official site was just mine, however you reacted only to those you choose. And yet you dare to say I make it personnal ...).

I'm not obssed with TLN / TLH (I even pointed out faulty detection based on nick for these which was implemented by others) and CA based mods (all mine are such) do not ban by modstr, further more - surprisisingly leechers are treated according to their behaviour not their name. "Poor" DLP failed right their on that very spot - name (modstr) is all of a sudden undetected, my suggestion was aimed to offer a sharp critria (without getting a lot of innocents in cross fire as you did) by which it could ban known leechers.

edited :

just by moving the discussion here without me even thinking about censoring you or whatever proved you are incapable to have a serious ontopic discussion. in fact, it disquallifies you from any.

==> claimed by the censor ...

oh, if you've ever been censored in the Xtreme subforum it was because i made up my mind and said there was no way. there is no point in discussing something that will certainly not added. besides, if you are so happy with the CA just GTFO and leave me alone with your bullshit. i said it is unfair and claiming the CA is better just shows that you do not want to contribute the DLP but to promote the CA but I won't let that happen after all the fighting going on for way too long!

and yes, in fact C++ skill got to do with this because you propose something that is unfair just because you cannot figure out a way to identify those clients with satisfying certainty. i am not saying i can but at least i am not suggesting unfair detection schemes.

a last thing, i never did unfair banning. there is always the likelihood of improper detection. a client may be modified to be called as a bad leecher or in case of the old AJ detection another client might share the same pattern. however, the major difference to your proposal is that you inflict a general guilt on an unknown but certainly large group of users. this is a major difference. another very notable thing to mention is that i did not write the code but only kept maintaining the DLP. i added the AJ detection to Morph but as i already said, it was the same detection used by the AJ and not some general "country + unknown mad = leecher" scheme.

your supidity seems to know no end and as much as i loathe myself for even caring to reply your posts i loathe you a lot more for trying to make yourself look better and smarter than you are. you are a pathetic simpleton who should learn to code rather than telling people who - as admitted by yourself - have superior skill how to reinvent the C++ language and do their business. just GTFO and get a decent book on C++ and don't come back until you've learned what is required to be a decent coder!

he makes new thoughts about what I find so that the dlp eh outdated technology because they can not at enough current to keep his ide would almost suggest that the shark is almost the best of the analyzer and the dlp attachable for more EFFICIENCY and analyzer is before the best moment because it simply recognizes slower but more equitably?


Taz jou are a good moder for all!

@ Stulle:

Mein Englisch ist zu schlecht, um den Kern der Sache bislang verstanden zu haben. Aber bitte sachlich und keine persönlichen Anfeindungen. Jeder Modder hat das Recht hier Änderungen oder neue Sachen sachlich zu diskutieren. Nichts anderes macht taz, egal worum es genau geht.

Mich würde die Meinung von WiZ dazu interessieren....

@Stulle : You can show me the door on boards & forums you have moderation power on (if I really want - using another email address and / or a proxy might get be back in ...). As a matter of fact shifting the discussion that involves DLP prove to be useful. About the language and style you use, well this might get you warned and worst ..., and don't use childish arguments ("i did not write the code but only kept maintaining the DLP. i added the AJ detection to Morph but as i already said, it was the same detection used by the AJ") to avoid responsibility (at the time added you were fully aware that~4% of the whole ed2k users are going to be banned by it - that's not fair, and considering the figures even a big one).


@winmann : 10'x for your support. I produce mods and point things for promoting sharing and reducing leechery (and while at it sharp my programming skills).

taz, I'm sorry to say that the thing you proposed really is NOT a got idea.

You can't ban this way innocents and force them to use official eMule, even if you introduce some kind of white list... Including sth. like that in your mod would NOT be accepted on the official eMule Board and would make your mod a non-legit "bad mod".



But to explain things a bit further:

There's a big german leech-community "Applejuice" (AJ) used by many leecher mods.
TLH 800STER-Mod is a hacked version of the 0.49b Applejuice. Since they didn't get the sources they used some kind of res-hacker to change some strings & stuff inside the 0.49b-AJ-EXE.
Very quickly after that the AJ-Leech-Modder Ekliptor changed detection scheme and all AJ-mods upload-ban the TLH-Mod on sight. To avoid the things repeating all newer AJs have their EXEs encrypted so that sth. like TLH Booster can't be done again.

Having this in mind you see that users using the TLH don't gain anything except getting banned by many sources. Since the mod is 0.49b and were on 0.49c now I don't think it will get used any further. By time it will die out since there can't be a new version of it. Even if we could detect 100% secure you would just be banning some kind of AJ-subnet and the vast majority of AJ-users still can't be detected & handled (and btw: nearly all of them are able to use random modstring).

By the way: If you really like the Analyzer's philosophy you should know that there's no need for banning the old TLH/TLN. Since they are leech and basically share only amongst each other they will get some MBs from you without ever giving anything back and will get punished by the CA no matter if they are TLH or any other client.

WiZ already stated many times that he is so much against banning without 100% security not to ban false positives that his opinion about that issue should be very clear. The original Tombstone already has this statement of him in the welcome message since the very first version !
(german since pesti asked: "WiZ hat schon so oft geschrieben, daß er Bans ohne die 100%ige Sicherheit, daß keine "Unschuldigen" gebannt werden können, total ablehnt, also sollte seine Meinung zu diesem Vorschlag glasklar sein. Der Original-Tombstone-Mod hat sogar diese Aussage von WiZ in seiner Willkommensmeldung und das seit der allerersten Version !")



To cut things short: CA is already protection enough against this kind of leechers. Whitelist-mechanism are very bad and even worse than blacklists and really shouldn't be used. All we can do is use the CA and optionally ban the known AJ-modstrings (for those AJ-leech-users which are dumb enough not to turn on random modstring or fake modstring...).



IMPORTANT:

Since I'm one of the moderators on this boards I kindly ask both of you, taz and Stulle, to try to keep calm and don't let things escalate. Please try to avoid personal attacks. Thanx



Greetz --


Spike2

@Spike2 : 10'x, you outlined what I've posted above "CA based mods (all mine are such) do not ban by modstr, further more - surprisisingly leechers are treated according to their behaviour not their name" - I've no intension to break that and jeoperdise CA philosophy or my own mods validation status.

I didn't chose to get personal - just tried to avoid being censored on that basis (you can look on official and figure out why ...)

so, bevor ich jetzt hier ab spikes post lese bitte ich euch mal die vorgeschichte anzuschauen und fragt euch bitte selbst, hab ich irgendwie mit zensur oder anderweitiger nutzung meiner moderator rechte gedroht? ich finde es eine absolute frechheit mich hier hinzustellen als wäre ich Zensursula persönlich, wenn ich lediglich kurz und knapp auf den sachlichen inhalt geantwortet habe. vielleicht muss ich wirklich nicht immer so schnell durch die decke gehen, aber wenn etwas derart absurdes und unhaltbares gesagt wird, dann ist es wohl mein gutes recht das als persönliche attacke zu nehmen und auch auf diese in irgendeiner form zu reagieren!
hier begann es! http://forum.emule-project.net/index.php?s...t&p=1036032

edit:
taz: you are despicable. that is all you are. you compare aples to beans when you compare your scheme to the old AJ detection and even if there is a chance for false positives, it has been proven that the real AJ mods used exactly the scheme that Xman (!!!) implemented after he got it leaked from some source. we are talking about "same detection the evildoer got" vs. "general guilt for anyone who meets really soft criteria". besides, when Xman introduced this scheme he was talking about a much lower percentage... something 1'ish or 2'ish, iirc! i bet if i had just implemented that half a year ago without you even thinking about this you would have called me some jew hating nazi... well, probably you give me more than enough reason to hate one israeli - you!
get a life and come up with something real but don't pretend i was banning anyone from the xtreme subforum that is not complying my personal taste. when somebody proposes something that will never make its way into a project i got a vote in there is no loss if i make discussion shut up. besides, i think the last time i had to shut your trap in the DLP thread or at least in the Xtreme subforum is because you were going on about how superior the CA is and i think it is a moderators task to ensure calm, so we don't need no old wounds reopend!
pah... despicable creature!

winnmann: so basically you are saying we should quit on the DLP and this bad attempt of a new ban - see spikes post - is just his way of saying that? now tell me what is so great in finding just another introduction to reopening the same old feud? i find nothing positive about that at all and if this really was his intention it is even more questionable what kind of a person taz is... then he certainly is no better than i am with all my cursing and swearing.