Savannah Administration - News: Trackers spam

Group

Main
- Main
- View members
- Search
Homepage
Download
Support
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Mailing lists
Source code
Tasks
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
News
- Browse
- Atom feed
- ~~Submit~~
- ~~Manage~~

Trackers spam

Item posted by Sylvain Beucler <Beuc> on Thu 24 Nov 2005 07:14:44 AM UTC.

Although we do not provide blogs, we are more and more often hit by splog / wikispam in the trackers that allow anonymous submissions or anonymous comments.
(which, of course, include the administration tracker - if somebody can't login (s)he needs to be able to post a support request :))

This is not yet really widespread, but it's time to start working on it. What do you think about this? What kind of protection would be the most efficient?

To my understanding, those spam bots must browse the web looking for web <form>s, and try to submit spam.

Solutions I heard of include turing tests ("type that number"), enforcing registration (not always wanted by casual bug reporters), ability to quickly hide content (makes the spamming useless, but does that prevent spammers from starting again?), and block IPs (very upsetting for false positives). Maybe also the ability to block anonymous comments once a tracker item is closed.

Anything else?

Starting points:
http://en.wikipedia.org/wiki/Splog
http://en.wikipedia.org/wiki/Link_spam
http://c2.com/cgi/wiki?MoreAboutCodes
http://www.markcarey.com/spamdb/

Any news on this front? (posted by Paul D. Smith, Wed 28 Dec 2005 04:53:13 AM UTC)

Anything going on here? Code? Decisions about what to code? Thinking about decisions about what to code? :-)

A little late but here is my 2c (posted by Dave Hall, Mon 12 Dec 2005 08:08:50 AM UTC)

As Beuc knows this frustrates the hell out of me.

Currently the tide has subsided (around 1 per week), but I am sure there is another tsunami building.

Turing test for non registered users has been my preference for some time. My reasons are similar to Paul Smith's.

Seems straightforward...? (posted by Paul D. Smith, Mon 28 Nov 2005 08:25:56 AM UTC)

I think the solution is pretty straightforward: we should require a Turing test for anonymous posters (both for comments AND new artifacts) and let registered users add comments without needing to pass one (although having such a test to create a new account is not a bad idea, since the infrastructure will be there already). Surely there are freely-available and relatively easily-integrated testers so this shouldn't be a huge amount of effort. CAPTCHAs have issues (for visually impaired users for example) but those who have such issues could just log in first and not be subject to them once the account was created.

As for the rest, providing the ability to disallow anonymous comments is fine with me but this should not be the only solution: many of us (like me) will not disallow anonymous comments. In my experience black lists, etc. are difficult to administer and maintain and they are never fully up-to-date.

Also, I understand some folks' concerns about being able to delete comments BUT I do think that capability should be available to administrators. Being an administrator gives you the right and responsibility to delete stuff in your project, IMO. Being able to hide comments is OK but doesn't replace being able to delete them.

Solutions (posted by Sylvain Beucler, Fri 25 Nov 2005 08:56:16 AM UTC)

For bots, I like c2's solution (a simple number to rewrite) very much. This may be just enough to stop almost all anonymous posts.

Mathieu (from the Savane development) suggested:
https://mail.gna.org/public/savane-dev/2005-11/msg00146.html
to block anonymous posts by default, which I feel is a bit too much, then to add a turing/captcha test for new accounts and a way to tag an account as spammer.

As for existing posts, I don't think destroying them is a good option: the ability to irremediably remove history is problematic, especially in projects with several admins. You can already tag a whole submission as "private"; I think we could provide more granularity and offer to hide/privatize a comment.

Moderation (posted by Sylvain Beucler, Fri 25 Nov 2005 09:07:46 AM UTC)

Joerg Wunsch suggested disabling disabling anonymous posts by default; not everybody is willing to create a single-serving account for reporting a bug (I received another complaint this week).

He also suggested moderating anonymous posts. While this prevents the post from being displayed (no spamdexing), it doesn't prevent mail notifications (spamming); plus the report loses some visibility (so you can get the same bug report from different people, namely).

automatic *and* manual moderation (posted by Jim Meyering, Fri 25 Nov 2005 09:36:42 AM UTC)

Use a system like what we use for some mailman lists:
First vet a message using some sort of Bayesian filter,
hard-coded rules, etc., sort of like spamassassin does.
If it is safely classifiable as spam or non-spam, act
on it automatically. Otherwise, put it in the queue
until a human moderator can approve or discard.

RE: automatic *and* manual moderation (posted by Sylvain Beucler, Fri 25 Nov 2005 10:16:33 AM UTC)

This sounds good; Mailman's moderation avoids spamming as well. Maybe it would be possible to pipe the post to spamassassin.

All this is time and resource consuming though. One avantage with the tracker is that it currently requires attended interaction - so we can introduce a straightforward turing test.

The Savane devs plan to add a mail interface to the tracker though, so apparently we'll have to implement this kind of filtering anyway. Authentication is likely to happen via GPG mail signatures though, which would restrict the filtering to truly anonymous mails, if allowed.

Spam and jokers (posted by Enrique D. Bosch, Fri 25 Nov 2005 07:26:30 AM UTC)

In my case is not spam what I receive in a bug report (see support request #104853 I opened about this), I have a message from an anonymous joker (is a person, not a bot), but really I want a real anonymous occasional tester can report a bug without registration.

For spam from bots the number image check I think is a good idea.

For non-spam jokers I suggest the bug tracker administrator (usually project administrator) should have the option to delete a post (not only mark it as invalid).

RE: Spam and jokers (posted by Joerg Wunsch, Fri 25 Nov 2005 09:39:03 PM UTC)

> I want a real anonymous occasional tester can report
> a bug without registration.

Me too, but I guess most projects innocently everything
at a default level, that's why I'd rather avoid being
completely open as a default. After all, that's the
trend in operating systems for the past years as well.
Years ago, the systems as shipped were completely open
(see telnetd.conf), now they typically don't allow
anything by default, so the decision to open up some
service is a deliberate one by the respective admin.

For me, I left the option to submit a bug report by
everyone, but required any followup-comments to be
made by logged-in users.

Spam (posted by Baruch Even, Thu 24 Nov 2005 11:26:30 AM UTC)

I just got my first spam on a bug report, and it ain't pretty.

Another relatively simple option is to keep a list of forbidden links or forbidden keywords in links. It works pretty well on some Wikis like MoinMoin.