Fighting Spam in Trackers

Savane provides several ways to protect trackers from spam.

Preventing Spam

Note: as of 2023, Savannah gets relatively low amount of spam in its trackers; the spammers seem to concentrate on adding unused accounts that are automatically deleted a few days later. The measures listed in this section may exclude potential contributions, so you shouldn't take them unless the real volume of spam you get is high.

There are a few options for group admins to prevent spam.

  • A starting point to avoid spam is first to set tracker Posting Restrictions to a tough policy:

    • On every tracker that you feel dedicated to manage the group workflow, without end user's interaction, like the task tracker, set group membership as the minimal level of authentication.
    • On every tracker that need input from non-members, like the support tracker and the bug tracker, set logged-in user as the minimal authentication level (it means that external contributors will have to create an account). As of 2022, most spam comments come from logged-in users, though.

  • Another idea is to use the special Lock Discussion field. This field, that can be modified only by tracker managers, is complementary to the Posting Restrictions. When an item is set as Locked, only technicians and managers are still be able to post further comments. While it may be used to end a flamewar, it will obviously reduce the number of targets available to spam robots if you set one (or more) automatic transition update so whenever an item is closed, the item get additionnally locked. Obviously, this is useless on trackers where only group members can post.

Removing Spam, Spam Scores

Spam Scores

Any logged-in user is able to flag as spam comments and items that the user believes to be spam. This will increment the spam score of the item, and a notification is sent to $sys_mail_admin is notified.

  • If the reporter is group admin on which the suspected spam have been posted, the spam score of the post will grow of 5. If the reporter is a member of the group on which the suspected spam have been posted, the spam score of the post will grow of 3. If the reporter is not member of the group on which the suspected spam have been posted, the spam score of the comment will grow of 1.

Any item with a spam score greater than 4 is considered to be spam.

All users also have their own spam scores. When users get one of their posts flagged as spam (spam score > 4), their score grows by 1. User's spam score is used to determine the spam score of any new post. In other words, someone caught 5 times posting spam will get all further posts automatically flagged as spam as soon as posted.

Site administrators have a specific interface that will allow them to check if spam reports against a user were legitimate and will be able to take necessary actions accordingly (like removing accounts used to post spam or to mark valid posts as spam).

It is also possible for group admins and site admins to unflag posts, which means they can reset the spam score of some post if they think there is a mistake.

Removing Spam

When a post is considered to be spam (spam score > 4), it is not removed from the database. We do not want to lose data in case of false positives.

However, comments that are spam are not shown, only a link remains for checking.

Likewise, when browsing items, spam isn't shown unless you change the corresponding display criteria.

If spam is posted as an item, it is automatically set to Locked so further posts are blocked.

Any posts marked as spam are only viewable for logged-in users.

Post-moderating

When $sys_watch_anon_posts isn't empty, copies of anonymous posts are sent to $sys_mail_admin; when $sys_new_user_watch_days is set, copies of posts of new users are likewise forwarded to $sys_mail_admin. As of 2024-08-28, $sys_mail_admin points to savannah-reports-private, $sys_watch_anon_posts is true, and $sys_new_user_watch_days is 34.

Banned domains

Ineiev is used to check the log of automatically removed idle accounts. When many accounts are created from certain email domains, and exactly no active accounts in those domains exist, the domain may be banned, which means that such accounts are removed twice an hour without further delay. Many in this context means that the numbers are comparable to the number of acounts from the gmail.com domain within the same period. As of 2024-08-28, we have identified three sources of such accounts listed in $sys_banned_email_domains.

Additionally, it turned out that valid users occasionally register with the same email domains as two spam account sources; however, the latter use clearly identifiable patterns for user_name. In 2024-08-28, we listed those sources in %sys_banned_email_names, with the same effect as $sys_banned_domains, but only for those user_name patterns.