PSPP - Cookbook: recipe #140, Fighting Spam
recipe #140: Fighting Spam
Savane provides several ways to protect trackers from spam.
Preventing Spam
Savane runs DNS blacklists checks on all forms submitted by non-project members (NB: not activated at Savannah).
Apart from that, there are a few options that can allow a project admin to prevent many spams.
Spam are usually caused by anonymous robots.
- A good starting point to avoid spam is first to set trackers Posting Restrictions to a tough policy:
- On every trackers that you feel dedicated to manage the project workflow, without end-users interaction, like the task manager, set project membership as minimal level of authentication.
- On every trackers that need input from non-members, like the support manager and the bug tracker, set logged-in user as minimal level of authentication, if you can afford to forbid anonymous post (it means that external contributors will have to create an account)
- Another good idea is too use the special Lock Discussion field. This field, that can be modified only by trackers managers, is complementary to the Posting Restrictions. When an item is set as Locked, only technicians and managers are still be able to post further comments. While it may be used to end a flamewar, it will obviously reduce the number of targets available to spam robots if you set one (or more) automatic transition update so whenever an item is closed, the item get additionnally locked. Obviously, this is useless on trackers where only project members can post.
Automatically Checking Potential Spam
Savane allows to automatically check posted content with SpamAssassin. (NB: not activated at Savannah).
Any post that Savane feels needs to be crosschecked automatically by SpamAssassin (depends on site configuration) will be delayed, temporarily flagged as spam, when posted until it is checked in the following minutes. If it is found to be spam, no notification will ever be sent, it will stay flagged as spam.
Removing Spam, Spam Scores
Spam Scores
Any logged-in user is able, when he sees content (comment or item) that he believes to be spam, to flag it as spam. This will increment the spam score of the item.
- If the reporter is project admin on which the suspected spam have been posted, the spam score of the content will grow of 5
- If the reporter is project member on which the suspected spam have been posted, the spam score of the content will grow of 3
- If the reporter is not project member on which the suspected spam have been posted, the spam score of the content will grow of 1
Any content with a spam score superior or equal to 5 is considered to be spam.
Each user have also his own spam score. Each time an user got one of his post flagged as spam (spam score > 4), his own score grows of 1. User own spam score is used to determine the spam score of any new post. In other words, someone caught 5 times posting spam will get all his further post automatically flagged as spam as soon as posted.
Site administrators have a specific interface that will allow them to check if spam reports against a user were legitimate and will be able to take necessary actions accordingly (like banning account used to spam or to maliciously report as spam perfectly valid content).
It is also possible to project admins and site admins to unflag content, which means they can reset the spam score of some content if they think there is a mistake.
Removing Spam
When content is considered to be spam (spam score > 4), it is not removed from the database. We do not want to risk loosing data in case of false positives.
However, comments that are spam are automatically removed from items pages, only a link remains for checking purpose.
Also, when browsing items, items that are spams are not shown, unless you change the related display criteria.
If the content is an item, it is automatically set to Locked so further post are impossible.
If your site runs checks with SpamAssassin, flagged spams will be used to improves bayesian filtering.
This recipe comes from Savannah User Docs
Audience and Context
(As there is at least one of the Audience/Feature/Action context information not set, this recipe will not show up in related recipes links)