Revert "Don't expose ZNC version in CTCP VERSION." #456

New Issue

2026-10-05T04:22:20+02:00

adam commented

2026-10-05 04:22:20 +02:00

https://github.com/znc/znc/commit/94f2b4dc971311de1955f08f38f443042fba431b

Under what reasoning do we need to hide znc's version number when almost all IRC clients show the version number by default?
What exactly do we gain when we hide the version number?

AdiIRC 1.9.6 Beta Build 2014/12/30 64 Bit
AndChat 1.4.3.2 http://www.andchat.net
Babbel v120107.14 Win32 Edition - http://www.babbelirc.com
bitchx-1.0c18(freebsd 9.2-stable): neonapple/v0.14i : dont you wish you had it?
Colloquy 2.4.3 (6011) - Mac OS X 10.10.1 (Intel) - http://colloquy.info
dircproxy 1.2.0 - http://dircproxy.googlecode.com/
eggdrop v1.6.20
HexChat 2.10.2 [x64] / Windows 7 SP1 [3.45GHz]
ircII 2.8.2-EPIC3.004 *IX - All the things phone wont include.....
irssi v0.8.15 - running on Linux x86_64
KVIrc 4.2.0 svn-6190 'Equilibrium' 20120701 - build 2012-07-04 14:48:08 UTC - Windows 8 (x64) (Build 9200)
Linkinus (Agent build 24570)
LimeChat for Mac 2.42
Miranda NG 0.95.3 build #11706 x64 (IRC v.0.11.0.2), (c) 2003-2014 J.Persson, G.Hazan
mIRC v7.32 Khaled Mardam-Bey
Quassel IRC v0.10.0 (git-575f27e) (built on Apr 8 2014 19:13:01) -- http://www.quassel-irc.org
Smuxi 0.8.9.2 (Debian 0.8.9.2-2) - running on GNU/Linux (elementary OS) i686
Textual IRC Client: www.textualapp.com — v5.0.3
Trillian IRC Module 5.0
WeeChat 1.1-rc1 (Dec 28 2014)
xchat 2.8.7f Windows 6.1 [i686/3.60GHz]
XChat-WDK 1508-3 [x64] / Windows 7 [2.00GHz]
X-Chat Aqua appstore-1.16.2-0-gb5ac411 (xchat 2.8.8-svn1523) Darwin 14.0.0 [x86_64/2.40GHz/SMP]

https://github.com/znc/znc/commit/94f2b4dc971311de1955f08f38f443042fba431b Under what reasoning do we need to hide znc's version number when almost all IRC clients show the version number by default? What exactly do we gain when we hide the version number? `AdiIRC 1.9.6 Beta Build 2014/12/30 64 Bit` `AndChat 1.4.3.2 http://www.andchat.net` `Babbel v120107.14 Win32 Edition - http://www.babbelirc.com` `bitchx-1.0c18(freebsd 9.2-stable): neonapple/v0.14i : dont you wish you had it?` `Colloquy 2.4.3 (6011) - Mac OS X 10.10.1 (Intel) - http://colloquy.info` `dircproxy 1.2.0 - http://dircproxy.googlecode.com/` `eggdrop v1.6.20` `HexChat 2.10.2 [x64] / Windows 7 SP1 [3.45GHz]` `ircII 2.8.2-EPIC3.004 *IX - All the things phone wont include.....` `irssi v0.8.15 - running on Linux x86_64` `KVIrc 4.2.0 svn-6190 'Equilibrium' 20120701 - build 2012-07-04 14:48:08 UTC - Windows 8 (x64) (Build 9200)` `Linkinus (Agent build 24570)` `LimeChat for Mac 2.42` `Miranda NG 0.95.3 build #11706 x64 (IRC v.0.11.0.2), (c) 2003-2014 J.Persson, G.Hazan` `mIRC v7.32 Khaled Mardam-Bey` `Quassel IRC v0.10.0 (git-575f27e) (built on Apr 8 2014 19:13:01) -- http://www.quassel-irc.org` `Smuxi 0.8.9.2 (Debian 0.8.9.2-2) - running on GNU/Linux (elementary OS) i686` `Textual IRC Client: www.textualapp.com — v5.0.3` `Trillian IRC Module 5.0` `WeeChat 1.1-rc1 (Dec 28 2014)` `xchat 2.8.7f Windows 6.1 [i686/3.60GHz]` `XChat-WDK 1508-3 [x64] / Windows 7 [2.00GHz]` `X-Chat Aqua appstore-1.16.2-0-gb5ac411 (xchat 2.8.8-svn1523) Darwin 14.0.0 [x86_64/2.40GHz/SMP]`

adam closed this issue

2026-10-05 04:22:20 +02:00

adam commented

2026-10-05 04:22:21 +02:00

Wasn't this commit a response to VERSION only showing the version when you are detached (and thus a bug)? https://github.com/znc/znc/issues/818#issuecomment-70398593

I think this issue would be better if it were to suggest adding a constant CTCP response to version (or merging it with the current CTCP response) rather than trying to revert something which looks like a bug to me.

Wasn't this commit a response to VERSION only showing the version when you are detached (and thus a bug)? https://github.com/znc/znc/issues/818#issuecomment-70398593 I think this issue would be better if it were to suggest adding a constant CTCP response to version (or merging it with the current CTCP response) rather than trying to revert something which looks like a bug to me.

adam commented

2026-10-05 04:22:21 +02:00

@KindOne- Slight difference, ZNC is far more than a client in comparison to the examples you used. It's a multi-user daemon running on a server. However, I have no strong preference on the response.

@KindOne- Slight difference, ZNC is far more than a client in comparison to the examples you used. It's a multi-user daemon running on a server. However, I have no strong preference on the response.

adam commented

2026-10-05 04:22:22 +02:00

I don't have strong preference for either "show" or "don't show", but I prefer stuff to be consistent.

In web, ZNC shows version number only after login. There's no other way to get it (except heuristics) without login, but only continuously /ctcp version someone until their client is disconnected, and ZNC starts reporting its version instead of version of client.

If /ctcp version is to report version, it should do so regardless of whether client is connected or not, and web should show version without login too.

I don't have strong preference for either "show" or "don't show", but I prefer stuff to be consistent. In web, ZNC shows version number only after login. There's no other way to get it (except heuristics) without login, but only continuously /ctcp version someone until their client is disconnected, and ZNC starts reporting its version instead of version of client. If /ctcp version is to report version, it should do so regardless of whether client is connected or not, and web should show version without login too.

adam commented

2026-10-05 04:22:23 +02:00

I don't think the gained convenience from fshowing the version string outweighs the loss of security =/ You can always just ask or let the person enter a command.

I don't think the gained convenience from fshowing the version string outweighs the loss of security =/ You can always just ask or let the person enter a command.

adam commented

2026-10-05 04:22:23 +02:00

To quote @sfan5 from https://github.com/znc/znc/issues/818:

Sorry to interrupt the discussion, but I think it doesn't make sense to leave the version out of the CTCP VERSION reply. It's named VERSION because it is supposed to inform the person doing the CTCP of the client version and not just the client name.

To quote @sfan5 from https://github.com/znc/znc/issues/818: > Sorry to interrupt the discussion, but I think it doesn't make sense to leave the version out of the CTCP VERSION reply. It's named VERSION because it is supposed to inform the person doing the CTCP of the client version and not just the client name.

adam commented

2026-10-05 04:22:24 +02:00

Probably there should be a new setting, which by default makes ZNC to show the version everywhere, but if turned off, show it only internally when logged in?

Probably there should be a new setting, which by default makes ZNC to show the version everywhere, but if turned off, show it only internally when logged in?

adam commented

2026-10-05 04:22:25 +02:00

👎 Given ZNC is more than a client, its a daemon serving many users, and that the version is shown only to detached users, and said command has limited real world usefulness, I think to be consistent it should stay hidden.

:-1: Given ZNC is more than a client, its a daemon serving many users, and that the version is shown only to detached users, and said command has limited real world usefulness, I think to be consistent it should stay hidden.

adam commented

2026-10-05 04:22:25 +02:00

IRC_d_s are also daemons and I am seeing version numbers there.

2015-01-23 12:54:16+0200 -- bitlbee-3.0.5-1.2. ip6-localhost (Linux/x86_64)
2015-01-23 12:54:16+0200 -- ircd-seven-1.1.3(20111112-b71671d1e846,charybdis-3.4-dev). rajaniemi.freenode.net (eHIKMpSZ6 TS6ow 21W)
2015-01-23 12:54:16+0200 -- charybdis-3.5.0-dev(20140818-aea6c4f). london-uk.pirateirc.net (eIKMpSZ6 TS6ow 0UK)
2015-01-23 12:54:16+0200 -- charybdis-3.5.0-dev(20131122-88c478c). ventura.atheme.org (eHIKMpSZ6 TS6ow 2VE)

I am not including inspircd here as it only shows full version numbers to opers.

And thinking about daemons, services are also those...

2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.4. services. 0e52b675cc9be3e937b671604afc4be9a5d838f6 :cejtR [ircd-seven] [enc:posix] Build Date: Jan 18 2015
2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION BitlBee 3.0.5-1.2 Linux/x86_64
2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.3. services.atheme.org 0e52b675cc9be3e937b671604afc4be9a5d838f6 :cFjtR [Charybdis] [enc:pbkdf2v2] Build Date: Jan 18 2015
2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.4. services.queertech.irc 91f23df4ccd16b5b1b38c1ebc3bc5cae86b260a4 :cFljR [InspIRCd] [enc:posix] Build Date: Jan 18 2015
2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.0-dev. e9843cb97bb19d205bd8e1db27f3d8df2731d5b5 services.pirateirc.net ceFljtR [Charybdis] [enc:posix] Build Date: May 15 2014
2015-01-23 12:55:48+0200 -- CTCP reply from NickServ: VERSION atheme 7.1.0. 4d3c580077a295bad5528cf9df7b669e8209a739 services.chatspike.net ceFljtR [InspIRCd] [enc:posix] Build Date: Nov 19 2014

IRC_d_s are also daemons and I am seeing version numbers there. ``` 2015-01-23 12:54:16+0200 -- bitlbee-3.0.5-1.2. ip6-localhost (Linux/x86_64) 2015-01-23 12:54:16+0200 -- ircd-seven-1.1.3(20111112-b71671d1e846,charybdis-3.4-dev). rajaniemi.freenode.net (eHIKMpSZ6 TS6ow 21W) 2015-01-23 12:54:16+0200 -- charybdis-3.5.0-dev(20140818-aea6c4f). london-uk.pirateirc.net (eIKMpSZ6 TS6ow 0UK) 2015-01-23 12:54:16+0200 -- charybdis-3.5.0-dev(20131122-88c478c). ventura.atheme.org (eHIKMpSZ6 TS6ow 2VE) ``` I am not including inspircd here as it only shows full version numbers to opers. And thinking about daemons, services are also those... ``` 2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.4. services. 0e52b675cc9be3e937b671604afc4be9a5d838f6 :cejtR [ircd-seven] [enc:posix] Build Date: Jan 18 2015 2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION BitlBee 3.0.5-1.2 Linux/x86_64 2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.3. services.atheme.org 0e52b675cc9be3e937b671604afc4be9a5d838f6 :cFjtR [Charybdis] [enc:pbkdf2v2] Build Date: Jan 18 2015 2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.4. services.queertech.irc 91f23df4ccd16b5b1b38c1ebc3bc5cae86b260a4 :cFljR [InspIRCd] [enc:posix] Build Date: Jan 18 2015 2015-01-23 12:55:47+0200 -- CTCP reply from NickServ: VERSION atheme 7.2.0-dev. e9843cb97bb19d205bd8e1db27f3d8df2731d5b5 services.pirateirc.net ceFljtR [Charybdis] [enc:posix] Build Date: May 15 2014 2015-01-23 12:55:48+0200 -- CTCP reply from NickServ: VERSION atheme 7.1.0. 4d3c580077a295bad5528cf9df7b669e8209a739 services.chatspike.net ceFljtR [InspIRCd] [enc:posix] Build Date: Nov 19 2014 ```

adam commented

2026-10-05 04:22:26 +02:00

The version shouldn't be shown for outsiders -- Visible for everybody that has an account at the znc instance though. Outsiders shouldn't care about it -- People also hide nginx, apache2, etc version strings.

The version shouldn't be shown for outsiders -- Visible for everybody that has an account at the znc instance though. Outsiders shouldn't care about it -- People also hide nginx, apache2, etc version strings.

adam commented

2026-10-05 04:22:27 +02:00

This should be an option, not a forced message. I agree if it's shown one place, it should show everywhere, but this would be one of the ONLY clients I have seen that forces their signature regardless of user preference.

This should be an option, not a forced message. I agree if it's shown one place, it should show everywhere, but this would be one of the ONLY clients I have seen that forces their signature regardless of user preference.

adam commented

2026-10-05 04:22:27 +02:00

You only cause spam by saying the same thing at more places. In the commit where you commented at first DarthGandalf replied to you and I also said that this is an option in global settings in webadmin.

Hide ZNC Version: [ ] Hide version number from non-ZNC users

but security through obscurity is not real security...

ref: https://github.com/znc/znc/commit/cf6ec5646b6c7c09fd54730c352f8805ea90d7ca

You only cause spam by saying the same thing at more places. In the commit where you commented at first DarthGandalf replied to you and I also said that this is an option in global settings in webadmin. - Hide ZNC Version: [ ] Hide version number from non-ZNC users but security through obscurity is not real security... ref: https://github.com/znc/znc/commit/cf6ec5646b6c7c09fd54730c352f8805ea90d7ca

adam commented

2026-10-05 04:22:28 +02:00

@uncled1023 ZNC honors user preferences. You can set "CTCP replies" for VERSION to whatever you want, or make it to be ignored by setting it to empty value. In that case it won't be sent to client, client won't reply, and ZNC won't add anything.

@uncled1023 ZNC honors user preferences. You can set "CTCP replies" for `VERSION` to whatever you want, or make it to be ignored by setting it to empty value. In that case it won't be sent to client, client won't reply, and ZNC won't add anything.

adam commented

2026-10-05 04:22:29 +02:00

@Mikaela Was that directed at me? This was my first comment on the matter.

@DarthGandalf From my understanding of the code (ref: cf6ec56), the CTCP version will always be appended with ' via ' , where can be either just ZNC, or includes the version number (which is an option to disable the version number). Am I understanding this correctly?

@Mikaela Was that directed at me? This was my first comment on the matter. @DarthGandalf From my understanding of the code (ref: cf6ec56), the CTCP version will always be appended with ' via ' <token>, where <token> can be either just ZNC, or includes the version number (which is an option to disable the version number). Am I understanding this correctly?

adam commented

2026-10-05 04:22:29 +02:00

Was that directed at me? This was my first comment on the matter.

Sorry, it seems that there are two people asking the same thing, but my comment also applies to you.

> Was that directed at me? This was my first comment on the matter. Sorry, it seems that there are two people asking the same thing, but my comment also applies to you.

adam commented

2026-10-05 04:22:30 +02:00

@Mikaela Ok, no worries. As I said in the above comment, my issue isn't about showing/not showing the version number of ZNC. My issue is appending "ZNC (url) - (sometimes version)" to any ctcp version reply, no matter what the user set's it to. This has nothing to do with security. For instance, those applications that have the "Sent from " at the bottom of posts users make. Those have actually been banned from certain forums/sites. Also, it is like forced advertisement. It's a free service, so I would understand, but you should probably tell the user you will be doing it. (Or opt-out option).

@Mikaela Ok, no worries. As I said in the above comment, my issue isn't about showing/not showing the version number of ZNC. My issue is appending "ZNC (url) - (sometimes version)" to any ctcp version reply, no matter what the user set's it to. This has nothing to do with security. For instance, those applications that have the "Sent from <app name here>" at the bottom of posts users make. Those have actually been banned from certain forums/sites. Also, it is like forced advertisement. It's a free service, so I would understand, but you should probably tell the user you will be doing it. (Or opt-out option).

adam commented

2026-10-05 04:22:31 +02:00

@uncled1023 there are 2 different scenarios:
a) CTCP reply for VERSION is not set.

ZNC receives CTCP VERSION from someone
ZNC forwards CTCP VERSION to client
Client replies with something
ZNC adds itself to the reply
ZNC sends the modified reply to whoever asked

b) CTCP reply for VERSION is set.

ZNC receives CTCP VERSION from someone
ZNC replies with the configured reply (or just drops it if empty), without forwarding anything to client
Client does not see any CTCP request, and does not reply

@uncled1023 there are 2 different scenarios: a) CTCP reply for `VERSION` is _not_ set. 1. ZNC receives CTCP VERSION from someone 2. ZNC forwards CTCP VERSION to client 3. Client replies with something 4. ZNC adds itself to the reply 5. ZNC sends the modified reply to whoever asked b) CTCP reply for `VERSION` _is_ set. 1. ZNC receives CTCP VERSION from someone 2. ZNC replies with the configured reply (or just drops it if empty), without forwarding anything to client 3. Client does not see any CTCP request, and does not reply

adam commented

2026-10-05 04:22:31 +02:00

@DarthGandalf Ok, thank you for the explanation. For some odd reason, that was not the behavior I was experiencing. I will double check.

@DarthGandalf Ok, thank you for the explanation. For some odd reason, that was not the behavior I was experiencing. I will double check.

adam commented

2026-10-05 04:22:32 +02:00

@uncled1023 Maybe you configured custom CTCP reply in client instead of ZNC?
Earlier, in such case ZNC would reply "ZNC" if no client is connected, but let the client's reply go through unchanged if a client is connected.

@uncled1023 Maybe you configured custom CTCP reply in client instead of ZNC? Earlier, in such case ZNC would reply "ZNC" if no client is connected, but let the client's reply go through unchanged if a client is connected.

adam commented

2026-10-05 04:22:33 +02:00

Some users do not want people to know that there is a bouncer between them and the IRC server however they don't mind people knowing what kind of client they are connected with. There is no reason that users should have to change the version information by hand every time he/she connects with a different client in order that you can advertise your program. This should, at the very least, be an option that users can easily choose to toggle on or off. Another option would be to add a %clientversion% to the expandable strings so we don't have to edit it over and over.

Some users do not want people to know that there is a bouncer between them and the IRC server however they don't mind people knowing what kind of client they are connected with. There is no reason that users should have to change the version information by hand every time he/she connects with a different client in order that you can advertise your program. This should, at the very least, be an option that users can easily choose to toggle on or off. Another option would be to add a %clientversion% to the expandable strings so we don't have to edit it over and over.

adam commented

2026-10-05 04:22:33 +02:00

@nhockey

So here you chose not to insult anyone, like you did on IRC?
Believe it or not, but bouncer is a client, which connects to a server. If you don't mind showing your client version, why do you mind showing your bouncer version?
Do you really think noone would suspect that there is a bouncer in between when the same user sometimes reports itself as one client, sometimes as another client, sometimes as both clients at once, and sometimes (when no client is connected) as ZNC? And that user didn't even reconnect. [sarcasm]And when it reports itself as ZNC, certainly noone can even think of it being a bouncer![/sarcasm]
And finally, there is an option to turn it off. It's explained above.

@nhockey 1. So here you chose not to insult anyone, like you did on IRC? 2. Believe it or not, but bouncer _is_ a client, which connects to a server. If you don't mind showing your client version, why do you mind showing your bouncer version? 3. Do you really think noone would suspect that there is a bouncer in between when the same user sometimes reports itself as one client, sometimes as another client, sometimes as both clients at once, and sometimes (when no client is connected) as ZNC? And that user didn't even reconnect. [sarcasm]And when it reports itself as ZNC, certainly noone can even think of it being a bouncer![/sarcasm] 4. And finally, there _is_ an option to turn it off. It's explained above.

adam commented

2026-10-05 04:22:34 +02:00

i still think it's a stupid idea to FORCE your version string, or spoof it outright.
i've been helping with IRC clients for years, so i understand it's a client. However because i help with several IRC clients; i like people to know when i'm helping them that i actually use the client that they are. Most of the time i run EPIC5, however i've CHOSEN to suppress the script from adding a bunch of bullocks onto the end of my version reply.
the beginner user typically does not know what a 'bouncer' is, and not having a choice to suppress the added version reply add's a layer of obfuscation that i have to explain to the end user why their client doesn't say the same thing as mine. I previously disabled the version reply when disconnected. now i have no choice, it's always on.
it still appends "via znc" after my version response. The only solution is to remove the lines of code you have committed.

I've always liked ZNC because of it's transparency, i liked how i had a choice. commenting out lines 241-243 in Client.cpp seems to be the only way to enforce my choice now.

1) i still think it's a stupid idea to FORCE your version string, or spoof it outright. 2) i've been helping with IRC clients for years, so i understand it's a client. However because i help with several IRC clients; i like people to know when i'm helping them that i actually use the client that they are. Most of the time i run EPIC5, however i've CHOSEN to suppress the script from adding a bunch of bullocks onto the end of my version reply. 3) the beginner user typically does not know what a 'bouncer' is, and not having a choice to suppress the added version reply add's a layer of obfuscation that i have to explain to the end user why their client doesn't say the same thing as mine. I previously disabled the version reply when disconnected. now i have no choice, it's always on. 4) it still appends "via znc" after my version response. The only solution is to remove the lines of code you have committed. I've always liked ZNC because of it's transparency, i liked how i had a choice. commenting out lines 241-243 in Client.cpp seems to be the only way to enforce my choice now.

adam commented

2026-10-05 04:22:35 +02:00

2 and 3: So do I, and the topic of VERSION rarely gets brought up. If an user is having difficulties, 9/10 times they do not know how to connect, or their connection was interrupted and they don't know how to reconnect. I don't think your argument is invalid, but you make it sound as if someone comes around and asks about this every single day.

I've never minded 4. I like ZNC as a product, and do not mind showing it off. If the latter part of "via ZNC" is not changable (which I believe it is by adding a manual CTCP response - which can be cumbersome if you change your CTCP response i.e. by upgrading your client. I wanted to confirm but could not.). In either case, I would definitely not mind there being an option for that. I can see why some people would want to turn that off.

2 and 3: So do I, and the topic of VERSION rarely gets brought up. If an user is having difficulties, 9/10 times they do not know how to connect, or their connection was interrupted and they don't know how to reconnect. I don't think your argument is invalid, but you make it sound as if someone comes around and asks about this every single day. I've never minded 4. I like ZNC as a product, and do not mind showing it off. If the latter part of "via ZNC" is not changable (which I believe it is by adding a manual CTCP response - which can be cumbersome if you change your CTCP response i.e. by upgrading your client. I wanted to confirm but could not.). In either case, I would definitely not mind there being an option for that. I can see why some people would want to turn that off.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#456