BUBU CAPTCHA SOFTWARE UPGRADE

However, Synapse can optionally be configured to provide a brief grace period such that users are not prompted to re-authenticate on actions taken shortly after logging in or otherwise authenticating. User-interactive authentication ('UIA') is required for potentially dangerous actions like removing devices or uploading cross-signing keys. You can learn more about the new module API in the docs linked above, or in Matrix Live S6E29, due out this Friday, July 2nd. This new interface consolidates configuration into one place, allowing for more flexibility and granularity by explicitly registering callbacks with specific hooks. That changes with Synapse 1.37, which introduces a new, generic interface for extensions. However, Synapse previously lacked a unified means of enumerating and configuring third-party modules. Third party modules can customize Synapse's behavior, implementing things like bespoke media storage providers or user event filters. A Unified Interface for Extension Modules

One caveat: Though the server-side foundation is there, knocking is not yet implemented in clients. Knock, knock?Īfter nearly 18 months and 129 commits, Synapse now includes support for MSC2403: Add 'knock' feature and Room Version 7! This feature allows users to directly request admittance to private rooms, without having to track down an invitation out-of-band. Server administrators should place Synapse behind a reverse proxy for TLS termination, or switch to a standalone ACMEv2 client like certbot. This release also removes Synapse's built-in support for the obsolete ACMEv1 protocol for automatically obtaining TLS certificates. Please see the module docs for information on updating. Note: The legacy APIs for Spam Checker extension modules are now considered deprecated and targeted for removal in August. Meanwhile, over to Dan for the Synapse 1.37 release notes. Problematic accounts can then be dealt with using the Deactivate Account Admin API. To ease review, we're working on an auditing script in #10290 feedback on whether this is useful would be appreciated. We do not recommend relying solely on lists of suspicious IP addresses for this task, as the distributed nature of the attack means any such list is likely to be incomplete or include shared proxies which may also catch legitimate users. Your best bet for spotting and neutralising dormant spambots is to review signups on your homeserver over the past 3-5 days and deactivate suspicious users. Once deactivated, you will need to contact to request that blocks on your server are removed. Otherwise you may find your server blocked all over the place if it is hosting spambots.įinally, if your server has open registration, PLEASE check whether spambots have been registered on your server, and deactivate them. Empirically adding a CAPTCHA is not enough.

BUBU CAPTCHA SOFTWARE UPGRADE

Please upgrade to Synapse 1.37.1 as soon as possible, in order to increase resilience to any other traffic spikes.Īlso, we highly recommend that you disable open registration or, if you keep it enabled, use SSO or require email validation to avoid abusive signups. First impressions are that this has significantly improved federation performance and end-to-end encryption stability - for instance, new E2EE keys from remote users for a given conversation should arrive immediately rather than being blocked behind other traffic. We're happy to say that Synapse 1.37.1 fixes this and we now process inbound federation traffic asynchronously, ensuring that one busy room won't impact others. This was due to a combination of factors, but one of the most important ones was Synapse issue #9490: that one busy room could cause head-of-line blocking, starving your server from processing events in other rooms, causing all traffic to fall behind. memory explosions, or very delayed federation). However, on Monday and Tuesday the volume of traffic triggered performance problems for the homeservers participating in targeted rooms (e.g. The spam itself has been handled by temporarily banning the abused servers. Over the last few days we've seen a distributed spam attack across the public Matrix network, where large numbers of spambots have been registered across servers with open registration and then used to flood abusive traffic into rooms such as Matrix HQ. To accomplish your task, you need to check whether there is a file with the same name as the downloaded file in the directory where you're going to load the avatars.$i = 1

Bubu captcha software