So, if you don't know what freenode is, you can stop reading right now; you won't find it interesting at all.
iptables -m u32 --u32 0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0=0x504f5354 -m recent --set --name lastmeasure --rsource -j DROP
Yes. That's it, and freenode couldn't do it for unspecified reasons. They kept telling us "Oh, we'll be moving to ircd-seven soon, and it'll be fixed then". I bought it. Everyone did. And true, no more spam and netsplits! For now.
But of course, the total failure level didn't improve at all. Now, people who don't auto-identify have a life of pain up their hands. Here's what happens when you identify after you've joined a channel:
* NICK (~HOSTNAME@IP ADDRESS) has quit: Changing host
* NICK (~HOSTNAME@CLOAK) has joined #CHANNEL
Yeah... your ip address gets displayed to everyone in the channel.
No, I lied, it doesn't get displayed to everyone. Everyone except you can see it. So you don't even know your ip address is getting displayed to everyone and quite possibly being logged in the channel. NOW WHOSE HARE-BRAINED IDEA WAS THAT?
Their "solution" for this? "Please use auto-identify, and no, we don't care about the reasons behind you not auto-identifying in the first place."
Oh, but there's more. If you have nick protection turned on, if you don't identify within 30 secs, your nick gets changed to GuestXXXX right? And the nick you were using gets "protected" right? With the move to ircd-seven, someone had to bright idea to make it "protected" against use by ANYONE including YOU. So you're left nickless unless you do a Quick Draw McGraw after logging in.
And don't give me the bullshit about "It's a free service, you get what you paid for". Other free networks get this right without getting funding from Canonical and hardware from Osuosl.