From 43c1999eb0130382909ff04ff2a51b5939018ce9 Mon Sep 17 00:00:00 2001 From: reverse Date: Sat, 18 Jul 2026 17:28:35 +0000 Subject: [PATCH] NOTIFY: document the enriched feed line (real IP, rdns, login, server) --- Services.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Services.md b/Services.md index c7fa425..4f3e4da 100644 --- a/Services.md +++ b/Services.md @@ -30,6 +30,12 @@ AKILL and other X-lines, FORBID, SPAMFILTER, NOTIFY, DEFCON, JUPE, SESSION limit `NOTIFY ADD + ` watches a mask; matching users have their flagged events announced to the staff feed (as DebugServ, tagged `[NOTIFY]`). Also `DEL `, `LIST`/`VIEW [pattern]`, and `CLEAR`. Admin only. +Each line carries the forensic detail a cloak hides — the real IP (with rdns in parentheses if it differs), the login, and the origin server: + + [NOTIFY] TimeRider!swaygo@kmaclxbm.dvmin24u.po6mymze.IP joined #devs · 81.185.171.238 (host.swaygo.fr) · acct swaygo · via irc.swaygo.fr + +The displayed `nick!ident@host` keeps the cloak so it still correlates with what ordinary users see. Because these lines expose real IPs, keep the log channel **operator-only** (`+O`). The connection *port* is not shown — the ircd's server-to-server burst never sends it to services. + - **Mask** — a `nick!user@host` pattern, a bare nick glob (`baddie*`), or a `#channel` (watches everyone who joins a matching channel). - **Flags** — `c` connect, `d` disconnect, `j` join, `p` part, `n` nick change, `t` topic, `s` services command, `S` services SET; `*` for all. - **Expiry** — `+30d`, `+12h`, `+45m`, or `+0` for permanent.