Re: getting spammed on bugzilla

[Andrew Pinski <pinskia@gmail.com>]

On Wed, Nov 10, 2021 at 7:29 PM Joel Brobecker via Overseers
<overseers@sourceware.org> wrote:
>
> Hello,
>
> Our bugzilla instance is being used as a spamming platform.
> Spammers do so by just posting answers to random PRs.
>
> As a result of this:
>
>    - The PRs gets polluted with these annoying messages that
>      we cannot remove (just mark as spam, which is a game of
>      wack-a-mole and personally a waste of our precious time);
>
>    - People on the Cc: list get emails about them.
>
>      I wouldn't be exagerating if I said that 95% of emails I am
>      getting from bugzilla, at the moment, is spam.
>
> I think the problem is that spammers can create their account
> without any form of validation.
>
> Is there something we could do about this?
>
> Pedro tells us that:
> > LLVM has solved this by disabling new user self-registration:
> >
> >   https://bugs.llvm.org/enter_bug.cgi
> >
> > "New user self-registration is disabled due to spam. For an account please email
> > bugs-admin@lists.llvm.org
> > with your e-mail address and full name."
>
> I'm happy to help with answering those legitimate account
> creations, if that makes a differnce.
>
> Any other ideas, perhaps?

GCC already disables new account creation; while sourceware does not.
I know the gcc bugzilla did get some spam last week and even at that
point, the account had been created manually too (GCC has had new
accounts disable for over a few years now even).
So what looked like a legitimate request and turned out not to be, did
slip through.  Fixing that is hard really.

Thanks,
Andrew Pinski

>
> Thank you!
> --
> Joel