manSavannah Administration - Cookbook: recipe #140, Fighting Spam


You are not allowed to post comments on this tracker with your current authentication level.

recipe #140: Fighting Spam

Submitter:  None
Submitted:  Tue 29 Nov 2005 08:32:43 AM UTC
Category:  None Importance:  3 - Normal
Status:  Approved Privacy:  Public
Assigned to:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:
       No canned response available


Tue 29 Nov 2005 08:32:43 AM UTC, recipe preview:  

Savane provides several ways to protect trackers from spam.

Preventing Spam

Savane runs DNS blacklists checks on all forms submitted by non-project members (NB: not activated at Savannah).

Apart from that, there are a few options that can allow a project admin to prevent many spams.

Spam are usually caused by anonymous robots.

  • A good starting point to avoid spam is first to set trackers Posting Restrictions to a tough policy:
    • On every trackers that you feel dedicated to manage the project workflow, without end-users interaction, like the task manager, set project membership as minimal level of authentication.
    • On every trackers that need input from non-members, like the support manager and the bug tracker, set logged-in user as minimal level of authentication, if you can afford to forbid anonymous post (it means that external contributors will have to create an account)
  • Another good idea is too use the special Lock Discussion field. This field, that can be modified only by trackers managers, is complementary to the Posting Restrictions. When an item is set as Locked, only technicians and managers are still be able to post further comments. While it may be used to end a flamewar, it will obviously reduce the number of targets available to spam robots if you set one (or more) automatic transition update so whenever an item is closed, the item get additionnally locked. Obviously, this is useless on trackers where only project members can post.

Automatically Checking Potential Spam

Savane allows to automatically check posted content with SpamAssassin. (NB: not activated at Savannah).

Any post that Savane feels needs to be crosschecked automatically by SpamAssassin (depends on site configuration) will be delayed, temporarily flagged as spam, when posted until it is checked in the following minutes. If it is found to be spam, no notification will ever be sent, it will stay flagged as spam.

Removing Spam, Spam Scores

Spam Scores

Any logged-in user is able, when he sees content (comment or item) that he believes to be spam, to flag it as spam. This will increment the spam score of the item.

  • If the reporter is project admin on which the suspected spam have been posted, the spam score of the content will grow of 5
  • If the reporter is project member on which the suspected spam have been posted, the spam score of the content will grow of 3
  • If the reporter is not project member on which the suspected spam have been posted, the spam score of the content will grow of 1

Any content with a spam score superior or equal to 5 is considered to be spam.

Each user have also his own spam score. Each time an user got one of his post flagged as spam (spam score > 4), his own score grows of 1. User own spam score is used to determine the spam score of any new post. In other words, someone caught 5 times posting spam will get all his further post automatically flagged as spam as soon as posted.

Site administrators have a specific interface that will allow them to check if spam reports against a user were legitimate and will be able to take necessary actions accordingly (like banning account used to spam or to maliciously report as spam perfectly valid content).

It is also possible to project admins and site admins to unflag content, which means they can reset the spam score of some content if they think there is a mistake.

Removing Spam

When content is considered to be spam (spam score > 4), it is not removed from the database. We do not want to risk loosing data in case of false positives.

However, comments that are spam are automatically removed from items pages, only a link remains for checking purpose.

Also, when browsing items, items that are spams are not shown, unless you change the related display criteria.

If the content is an item, it is automatically set to Locked so further post are impossible.

If your site runs checks with SpamAssassin, flagged spams will be used to improves bayesian filtering.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by Beuc (Updated the item)




    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2006-11-28 Beuc RecipeSavane provides several... +120 chars

    Back to the top

    Powered by Savane 3.9