newsNews: Trackers spam

Latest News
Mercurial hg moved to new server posted by agn, Thu 12 Jan 2017 03:07:50 PM UTC - 0 replies
Bazaar bzr moved to new server posted by agn, Tue 10 Jan 2017 03:33:35 AM UTC - 0 replies
Subversion svn service moved to the new server. posted by rwp, Fri 06 Jan 2017 07:02:03 PM UTC - 0 replies
The cvs service has moved to the new server posted by agn, Fri 16 Dec 2016 03:14:26 AM UTC - 0 replies
The git service has moved to the new server posted by rwp, Sun 04 Dec 2016 12:38:44 AM UTC - 0 replies
[184 news in archive]

Trackers spam

Item posted by Sylvain Beucler <Beuc> on Thu 24 Nov 2005 07:14:44 AM UTC.

Although we do not provide blogs, we are more and more often hit by splog / wikispam in the trackers that allow anonymous submissions or anonymous comments.
(which, of course, include the administration tracker - if somebody can't login (s)he needs to be able to post a support request :))

This is not yet really widespread, but it's time to start working on it. What do you think about this? What kind of protection would be the most efficient?

To my understanding, those spam bots must browse the web looking for web <form>s, and try to submit spam.

Solutions I heard of include turing tests ("type that number"), enforcing registration (not always wanted by casual bug reporters), ability to quickly hide content (makes the spamming useless, but does that prevent spammers from starting again?), and block IPs (very upsetting for false positives). Maybe also the ability to block anonymous comments once a tracker item is closed.

Anything else?

Starting points:


Any news on this front? (posted by Paul D. Smith, Wed 28 Dec 2005 04:53:13 AM UTC)

Anything going on here? Code? Decisions about what to code? Thinking about decisions about what to code? :-)

A little late but here is my 2c (posted by Dave Hall, Mon 12 Dec 2005 08:08:50 AM UTC)

As Beuc knows this frustrates the hell out of me.

Currently the tide has subsided (around 1 per week), but I am sure there is another tsunami building.

Turing test for non registered users has been my preference for some time. My reasons are similar to Paul Smith's.

Seems straightforward...? (posted by Paul D. Smith, Mon 28 Nov 2005 08:25:56 AM UTC)

I think the solution is pretty straightforward: we should require a Turing test for anonymous posters (both for comments AND new artifacts) and let registered users add comments without needing to pass one (although having such a test to create a new account is not a bad idea, since the infrastructure will be there already). Surely there are freely-available and relatively easily-integrated testers so this shouldn't be a huge amount of effort. CAPTCHAs have issues (for visually impaired users for example) but those who have such issues could just log in first and not be subject to them once the account was created.

As for the rest, providing the ability to disallow anonymous comments is fine with me but this should not be the only solution: many of us (like me) will not disallow anonymous comments. In my experience black lists, etc. are difficult to administer and maintain and they are never fully up-to-date.

Also, I understand some folks' concerns about being able to delete comments BUT I do think that capability should be available to administrators. Being an administrator gives you the right and responsibility to delete stuff in your project, IMO. Being able to hide comments is OK but doesn't replace being able to delete them.

Solutions (posted by Sylvain Beucler, Fri 25 Nov 2005 08:56:16 AM UTC)

For bots, I like c2's solution (a simple number to rewrite) very much. This may be just enough to stop almost all anonymous posts.

Mathieu (from the Savane development) suggested:
to block anonymous posts by default, which I feel is a bit too much, then to add a turing/captcha test for new accounts and a way to tag an account as spammer.

As for existing posts, I don't think destroying them is a good option: the ability to irremediably remove history is problematic, especially in projects with several admins. You can already tag a whole submission as "private"; I think we could provide more granularity and offer to hide/privatize a comment.

Spam and jokers (posted by Enrique D. Bosch, Fri 25 Nov 2005 07:26:30 AM UTC)

In my case is not spam what I receive in a bug report (see support request #104853 I opened about this), I have a message from an anonymous joker (is a person, not a bot), but really I want a real anonymous occasional tester can report a bug without registration.

For spam from bots the number image check I think is a good idea.

For non-spam jokers I suggest the bug tracker administrator (usually project administrator) should have the option to delete a post (not only mark it as invalid).

Spam (posted by Baruch Even, Thu 24 Nov 2005 11:26:30 AM UTC)

I just got my first spam on a bug report, and it ain't pretty.

Another relatively simple option is to keep a list of forbidden links or forbidden keywords in links. It works pretty well on some Wikis like MoinMoin.



Back to the top

Powered by Savane 3.1-cleanup1