* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
@ 2016-08-10 2:44 ` LpSolit at netscape dot net
2016-08-10 5:50 ` trippels at gcc dot gnu.org
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: LpSolit at netscape dot net @ 2016-08-10 2:44 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Frédéric Buclin <LpSolit at netscape dot net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2016-08-10
Ever confirmed|0 |1
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
2016-08-10 2:44 ` [Bug web/72856] " LpSolit at netscape dot net
@ 2016-08-10 5:50 ` trippels at gcc dot gnu.org
2016-08-10 8:33 ` gerald at pfeifer dot com
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: trippels at gcc dot gnu.org @ 2016-08-10 5:50 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |trippels at gcc dot gnu.org
--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
> GCC Bugzilla suffered vandalism again between July 25 and 27. 709 spam bugs have been filed during this 48 hours window.
All of these would have been easily detected by a simple Bayes spam filter.
So why not run all new bugs and all new comments thru one?
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
2016-08-10 2:44 ` [Bug web/72856] " LpSolit at netscape dot net
2016-08-10 5:50 ` trippels at gcc dot gnu.org
@ 2016-08-10 8:33 ` gerald at pfeifer dot com
2016-08-10 11:46 ` manu at gcc dot gnu.org
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: gerald at pfeifer dot com @ 2016-08-10 8:33 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Gerald Pfeifer <gerald at pfeifer dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gerald at pfeifer dot com
--- Comment #2 from Gerald Pfeifer <gerald at pfeifer dot com> ---
Thanks for looking into this, Frédéric!
As for rate throttling, how about only allowing for a single bug
report per day until a bug report has been "processed" (for some
suitable definition of "processed" - perhaps even any action that
is different from simply marking it as spam)?
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (2 preceding siblings ...)
2016-08-10 8:33 ` gerald at pfeifer dot com
@ 2016-08-10 11:46 ` manu at gcc dot gnu.org
2016-08-10 12:04 ` LpSolit at netscape dot net
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: manu at gcc dot gnu.org @ 2016-08-10 11:46 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Manuel López-Ibáñez <manu at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |manu at gcc dot gnu.org
--- Comment #3 from Manuel López-Ibáñez <manu at gcc dot gnu.org> ---
(In reply to Frédéric Buclin from comment #0)
> GCC Bugzilla suffered vandalism again between July 25 and 27. 709 spam bugs
> have been filed during this 48 hours window. 103 different email addresses
> have been used to avoid being blocked too quickly. This gives a ratio on
> average of 7 spam per account.
I wonder about the effort required to do such a thing. Some of those emails
seem fake, is there some kind of confirmation email for newly created accounts?
Limiting the number of bug reports per new account seems a good measure, but
also easily circumvented as long as someone can create as many new users as
they wish and each user stays below the limit.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (3 preceding siblings ...)
2016-08-10 11:46 ` manu at gcc dot gnu.org
@ 2016-08-10 12:04 ` LpSolit at netscape dot net
2016-08-10 12:33 ` LpSolit at netscape dot net
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: LpSolit at netscape dot net @ 2016-08-10 12:04 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #4 from Frédéric Buclin <LpSolit at netscape dot net> ---
(In reply to Manuel López-Ibáñez from comment #3)
> I wonder about the effort required to do such a thing. Some of those emails
> seem fake, is there some kind of confirmation email for newly created
> accounts?
Yes. When a user requests a new account, an email is sent to that email
address, and the user must click on the link which is in the email to confirm
that 1) the email address is valid, and 2) it belongs to the user who wants to
create the bugzilla account. Clicking on this link will display a page where
the user must type his new password, and only after that is the bugzilla
account activated. It is not possible to create bugzilla accounts automatically
using the API (to prevent such problems).
> Limiting the number of bug reports per new account seems a good measure, but
> also easily circumvented as long as someone can create as many new users as
> they wish and each user stays below the limit.
I agree, that's a problem. But I think there isn't one single solution which
fixes all cases, but rather multiple solutions which, when combined together,
can give a reasonable level of spam prevention.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (4 preceding siblings ...)
2016-08-10 12:04 ` LpSolit at netscape dot net
@ 2016-08-10 12:33 ` LpSolit at netscape dot net
2016-08-10 12:41 ` fche at redhat dot com
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: LpSolit at netscape dot net @ 2016-08-10 12:33 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #5 from Frédéric Buclin <LpSolit at netscape dot net> ---
(In reply to Gerald Pfeifer from comment #2)
> As for rate throttling, how about only allowing for a single bug
> report per day until a bug report has been "processed"
Isn't one bug per day a bit rude for legit users? I would be tempted to say
that above 2 or 3 new bug reports, it's reasonable to question if the user is
trying to spam Bugzilla or not. This is why I made the proposal in comment 0 to
use something exponential. This would give us something like:
3**n-1 5**n
====== ====
T0 : account created T0 : account created
T0 : 1st bug created T0+1min : 1st bug created
T0+2min : 2nd bug created T0+6min : 2nd bug created
T0+10min: 3rd bug created T0+31min: 3rd bug created
T0+36min: 4th bug created T0+2.5h : 4th bug created
T0+2h : 5th bug created T0+13h : 5th bug created
T0+6h : 6th bug created T0+65h : 6th bug created
T0+18h : 7th bug created etc...
T0+55h : 8th bug created
etc...
So a spammer could file at most 6-8 bugs in a week, but a legit user could
still easily file his first 2-3 bugs in a half hour. Of course, this rate limit
would only apply to users without editbugs privileges, so e.g. @gcc.gnu.org
accounts would not be affected.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (5 preceding siblings ...)
2016-08-10 12:33 ` LpSolit at netscape dot net
@ 2016-08-10 12:41 ` fche at redhat dot com
2016-08-11 11:58 ` joseph at codesourcery dot com
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: fche at redhat dot com @ 2016-08-10 12:41 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #6 from Frank Ch. Eigler <fche at redhat dot com> ---
Per-account rate limits seem so easy to overcome, with spammers already
creating numerous verified junk accounts with ease.
I would suggest focusing on spam-prevention content analysis (spamassassin
style), and post-spam cleanup (blacklisting, history editing, bug hiding?)
efforts.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (6 preceding siblings ...)
2016-08-10 12:41 ` fche at redhat dot com
@ 2016-08-11 11:58 ` joseph at codesourcery dot com
2016-08-15 19:57 ` redi at gcc dot gnu.org
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: joseph at codesourcery dot com @ 2016-08-11 11:58 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #7 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
Are lots of the spam bugs coming from the same IP address, or from lots of
different IP addresses - is it readily possibly to tell what IP address
created a given bug? (If lots come from the same IP address, hooking
Bugzilla up to something like fail2ban to block connections from the IP
address that created a bug marked as spam could help.)
Much the same question applies to spam account creations (throttle account
creations from the same IP address).
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (7 preceding siblings ...)
2016-08-11 11:58 ` joseph at codesourcery dot com
@ 2016-08-15 19:57 ` redi at gcc dot gnu.org
2016-08-16 14:41 ` LpSolit at netscape dot net
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2016-08-15 19:57 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #9 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Frank Ch. Eigler from comment #6)
> Per-account rate limits seem so easy to overcome, with spammers already
> creating numerous verified junk accounts with ease.
They're using a new account for every bug today, because I'm closing the bugs
as spam as soon as they create them. It isn't stopping them.
> I would suggest focusing on spam-prevention content analysis (spamassassin
> style), and post-spam cleanup (blacklisting, history editing, bug hiding?)
> efforts.
This this this this.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (8 preceding siblings ...)
2016-08-15 19:57 ` redi at gcc dot gnu.org
@ 2016-08-16 14:41 ` LpSolit at netscape dot net
2016-08-22 20:10 ` bernd.edlinger at hotmail dot de
2016-08-23 6:07 ` [Bug web/72856] Throttle " gerald at pfeifer dot com
11 siblings, 0 replies; 13+ messages in thread
From: LpSolit at netscape dot net @ 2016-08-16 14:41 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
--- Comment #10 from Frédéric Buclin <LpSolit at netscape dot net> ---
(In reply to Frank Ch. Eigler from comment #6)
> Per-account rate limits seem so easy to overcome, with spammers already
> creating numerous verified junk accounts with ease.
I banned several ranges of IP addresses, and also permanently banned some
domain names. Logs show that all evil attempts made today have been
successfully blocked (for how long?).
> I would suggest focusing on spam-prevention content analysis (spamassassin
> style), and post-spam cleanup (blacklisting, history editing, bug hiding?)
> efforts.
Content analysis has been (partially) implemented today. If the bug report is
considered to be spam, the bug report is automatically rejected and the user
account automatically disabled.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (9 preceding siblings ...)
2016-08-16 14:41 ` LpSolit at netscape dot net
@ 2016-08-22 20:10 ` bernd.edlinger at hotmail dot de
2016-08-23 6:07 ` [Bug web/72856] Throttle " gerald at pfeifer dot com
11 siblings, 0 replies; 13+ messages in thread
From: bernd.edlinger at hotmail dot de @ 2016-08-22 20:10 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Bernd Edlinger <bernd.edlinger at hotmail dot de> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |bernd.edlinger at hotmail dot de
--- Comment #11 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
Are the user accounts created by bots?
if yes, would an anti robot security code (captcha) help?
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug web/72856] Throttle bug creation for newly created accounts (to limit spam)
2016-08-10 2:43 [Bug web/72856] New: Trottle bug creation for newly created accounts (to limit spam) LpSolit at netscape dot net
` (10 preceding siblings ...)
2016-08-22 20:10 ` bernd.edlinger at hotmail dot de
@ 2016-08-23 6:07 ` gerald at pfeifer dot com
11 siblings, 0 replies; 13+ messages in thread
From: gerald at pfeifer dot com @ 2016-08-23 6:07 UTC (permalink / raw)
To: overseers
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856
Gerald Pfeifer <gerald at pfeifer dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Trottle bug creation for |Throttle bug creation for
|newly created accounts (to |newly created accounts (to
|limit spam) |limit spam)
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 13+ messages in thread