Re: [OSM-talk] Anonymous comments on notes now disabled

[Mateusz Konieczny]

1 Sep 2019, 17:53 by oleksiy.muzal...@bluewin.ch:

> On 9/1/19 09:50, joost schouppe wrote:
>
>>
>>
>> Op vr 30 aug. 2019 13:15  schreef Oleksiy Muzalyev <>> 
>> oleksiy.muzal...@bluewin.ch >> >:
>>
>>> I think in future when there will be more space on servers  it 
>>> would be a 
>>>  good idea to add a possibility to attach an optional image  to 
>>> a note for 
>>>  the registered users.
>>>
>>
>> Images are a really useful addition to a written  Note. But it could 
>> be handled without having to host the  actual images. A user 
>> interface could just upload them  somewhere, and add the url to the 
>> note.
>>
>>>
>>>
>
> It certainly could be done like this. Though there will be more  clicks 
> for a note. I do not remember the exact statistics figures,  - something 
> like each excessive click drops about 20% of potential  users. That is 
> why organizations, which could afford usability  studies, implement 
> various "one-click buying" solutions.
>
>
> Images could be uploaded and stored on a separate server. There  will be 
> no other connection to production serves except HTML IMG  tags in notes. 
> An image file size could be limited at first to say  100 KB. Even if an 
> attacker manages to pass the security filters  and upload a pseudo-image 
> file with a malicious code (what is  unlikely) nothing dramatic would 
> happen. There will be no images  in notes for several hours until the OS 
> is reinstalled on the  server and the files restored from a backup.
>
>
> I was recently asked to participate in mapping of a small town in  a 
> region several thousand kilometers from my location. I could not  
> understand what kind of threes they have there. Are they  broad-leaved or 
> needle-leaved, - I could not see it from satellite  images. There were no 
> photos in its Wikipedia page. I could  neither see what type of paths 
> they have. One or two 100 KB  survey-style photos would be enough.
>
>
> ref.: > https://en.wikipedia.org/wiki/1-Click 
> 
>
>
Note that StreetComplete already has
well working version of
"Create note with linked image"
(bottom left icon allows to create note
and attach image - note also that 
StreetComplete will ask for login 
info after making about 10 edits).___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Oleksiy Muzalyev]

On 9/1/19 09:50, joost schouppe wrote:



Op vr 30 aug. 2019 13:15 schreef Oleksiy Muzalyev 
mailto:oleksiy.muzal...@bluewin.ch>>:


I think in future when there will be more space on servers it
would be a
good idea to add a possibility to attach an optional image to a
note for
the registered users.


Images are a really useful addition to a written Note. But it could be 
handled without having to host the actual images. A user interface 
could just upload them somewhere, and add the url to the note.


It certainly could be done like this. Though there will be more clicks 
for a note. I do not remember the exact statistics figures, - something 
like each excessive click drops about 20% of potential users. That is 
why organizations, which could afford usability studies, implement 
various "one-click buying" solutions.


Images could be uploaded and stored on a separate server. There will be 
no other connection to production serves except HTML IMG tags in notes. 
An image file size could be limited at first to say 100 KB. Even if an 
attacker manages to pass the security filters and upload a pseudo-image 
file with a malicious code (what is unlikely) nothing dramatic would 
happen. There will be no images in notes for several hours until the OS 
is reinstalled on the server and the files restored from a backup.


I was recently asked to participate in mapping of a small town in a 
region several thousand kilometers from my location. I could not 
understand what kind of threes they have there. Are they broad-leaved or 
needle-leaved, - I could not see it from satellite images. There were no 
photos in its Wikipedia page. I could neither see what type of paths 
they have. One or two 100 KB survey-style photos would be enough.


ref.: https://en.wikipedia.org/wiki/1-Click

brgds

O.

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[joost schouppe]

Op vr 30 aug. 2019 13:15 schreef Oleksiy Muzalyev <
oleksiy.muzal...@bluewin.ch>:

> I think in future when there will be more space on servers it would be a
> good idea to add a possibility to attach an optional image to a note for
> the registered users.
>

Images are a really useful addition to a written Note. But it could be
handled without having to host the actual images. A user interface could
just upload them somewhere, and add the url to the note.

>
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Michał Brzozowski]

Hi,

It seems a reasonable option, but we better make sure that users are aware
they need to log in! For now judging from the patch I don't see any new
messages, but I stand to be corrected.

Another thing on top of my head - having commented/fixed many MAPS.ME
notes, it seems that people using maps.me have a hard time logging in -
even though they have an account!
My "conspiracy theory" is they receive an e-mail on a smartphone and then
the rather suboptimal mobile UX of osm.org doesn't help them log in.

Another part of the theory trying to explain their overall low response
rate is their Gmail puts it in "Notifications" category (which without
explicit setting won't make a push message). They're somehow conditioned to
ignore it.

Michał

On Thu, Aug 29, 2019 at 11:49 PM Frederik Ramm  wrote:

> Hi,
>
> after two years of discussing the pros and cons, a decision has now been
> reached to disallow anonymous comments on notes.
>
> Up until two days ago, anonymous (i.e. not logged-in) users could create
> notes and comment on existing notes; the only thing they could not do
> was close a note.
>
> Now, anonymous users can *still* create notes, but they cannot comment
> on or close existing notes.
>
> In the long discussions leading up to this decision (see
> https://github.com/openstreetmap/openstreetmap-website/issues/1543 and
> https://github.com/openstreetmap/openstreetmap-website/pull/1926) we
> agreed that anonymous comments on notes are rarely useful, and when they
> are, they come mostly from users who have just forgotten to log in. This
> was weighed against recent massive spam and vandalism activities which
> rendered the notes system near unusuable in some regions. Perversely, it
> is much easier to fight a vandal creating new, useless notes (by just
> closing them) than it is to clean up their droppings from existing notes.
>
> Bye
> Frederik
>
> --
> Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"
>
> ___
> talk mailing list
> talk@openstreetmap.org
> https://lists.openstreetmap.org/listinfo/talk
>
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Mateusz Konieczny]

30 Aug 2019, 19:58 by oleksiy.muzal...@bluewin.ch:

> On 8/30/19 15:47, Mateusz Konieczny  wrote:
>
>>
>>
>>
>> 30 Aug 2019, 15:16 by >> talk@openstreetmap.org 
>> >> :
>>
>>> On 29/08/2019 22:46,  Frederik Ramm wrote:
>>>
 Perversely, it is mucheasier to fight a vandal creating new, 
 useless notes (byjust

 closing them) than it isto clean up their droppings from 
 existing notes.

>>>
>>> I don't understand the logic  of that. Whether a note is 5 seconds 
>>> or 5 years old, it's  still "existing"  & it's content, irrelevant 
>>> or no.t will  not change over time.
>>>
>> Spam in otherwise useful notes(typically it was vandal adding 
>> multiple single letter comments
>> in all notes within region)makes using them more frustrating and 
>> generates notifications
>> to all earlier contributors. Iwas forced to autodelete all 
>> notifications about anonymouscomments,
>> so many were useless "a" spam.
>>
>> Useless note can be closed andis quickly gone (afaik within 2 weeks 
>> by default - both in JOSM
>> and on the website). Whilemany notes with useful reports remain open 
>> for months and litterthere affects
>> more people.
>>
>
> Maybe it was not the vandalism but people trying to understand  the 
> functioning of the notes & comments system? Posting single  letters does 
> not look like a malicious vandalism.
>
>
Repeated spamming waves of single letter comments
multiple times for every note in a broad region
is clearly malicious.

Eastern Europe was especially affected.

>
> Anyway it is not relevant anymore since there will be no more  anonymous 
> notes & comments.
>
>
Anonymous notes are not disabled.
Only anonymous comments are. 
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Oleksiy Muzalyev]

On 8/30/19 15:47, Mateusz Konieczny wrote:




30 Aug 2019, 15:16 by talk@openstreetmap.org:

On 29/08/2019 22:46, Frederik Ramm wrote:

Perversely, it is much easier to fight a vandal creating new,
useless notes (by just

closing them) than it is to clean up their droppings from
existing notes.


I don't understand the logic of that. Whether a note is 5 seconds
or 5 years old, it's still "existing"  & it's content, irrelevant
or no.t will not change over time.

Spam in otherwise useful notes (typically it was vandal adding 
multiple single letter comments
in all notes within region) makes using them more frustrating and 
generates notifications
to all earlier contributors. I was forced to autodelete all 
notifications about anonymous comments,

so many were useless "a" spam.

Useless note can be closed and is quickly gone (afaik within 2 weeks 
by default - both in JOSM
and on the website). While many notes with useful reports remain open 
for months and litter there affects

more people.


Maybe it was not the vandalism but people trying to understand the 
functioning of the notes & comments system? Posting single letters does 
not look like a malicious vandalism.


It was still possible to give an anonymous visitor a possibility to 
delete his/her test notes (comments) by recording in the browser's 
cookie file an unique ID code of this visitor from say 32 digits and 
characters. And only if the ID code in the browser coincides, only then 
the "delete" button is displayed to the visitor.


Anyway it is not relevant anymore since there will be no more anonymous 
notes & comments.


Best regards,

O.

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Mateusz Konieczny]

30 Aug 2019, 15:16 by talk@openstreetmap.org:

> On 29/08/2019 22:46, Frederik Ramm wrote:
>
>> Perversely, it is much easier to fight a vandal creating new, useless notes 
>> (by just
>>
>> closing them) than it is to clean up their droppings from existing notes.
>>
>
> I don't understand the logic of that. Whether a note is 5 seconds or 5 years 
> old, it's still "existing"  & it's content, irrelevant or no.t will not 
> change over time.
>
Spam in otherwise useful notes (typically it was vandal adding multiple single 
letter comments
in all notes within region) makes using them more frustrating and generates 
notifications
to all earlier contributors. I was forced to autodelete all notifications about 
anonymous comments,
so many were useless "a" spam.

Useless note can be closed and is quickly gone (afaik within 2 weeks by default 
- both in JOSM
and on the website). While many notes with useful reports remain open for 
months and litter there affects
more people.
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Frederik Ramm]

Hi,

On 8/30/19 3:16 PM, Dave F via talk wrote:
> Can they close their own notes?

They never could. Being anonymous, there was no way to verify that the
user wanting to close something was also the user who created it in the
first place.

Bye
Frederik

-- 
Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Dave F via talk]

On 29/08/2019 22:46, Frederik Ramm wrote:

Now, anonymous users can *still* create notes, but they cannot comment
on or close existing notes.


Can they close their own notes?


Perversely, it is much easier to fight a vandal creating new, useless notes (by 
just
closing them) than it is to clean up their droppings from existing notes.


I don't understand the logic of that. Whether a note is 5 seconds or 5 
years old, it's still "existing"  & it's content, irrelevant or no.t 
will not change over time.


Cheers
DaveF

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Oleksiy Muzalyev]

Good afternoon,

I think in future when there will be more space on servers it would be a 
good idea to add a possibility to attach an optional image to a note for 
the registered users.


Nowadays a lot of people do have a good camera in their pockets. After 
the note is closed down the JPG file could be deleted from the server.


For example, opening hours, the number of levels of a building, the name 
of a bus stop, etc. could be demonstrated effectively and unequivocally 
by a 100 KB image.


The modern programming languages are capable to check not only a file 
extension but to verify that it is actually the JPG or the PNG image 
file, so it is possible to create more or less effective protection 
against unlikely attacks.


I know that there are websites where street-view images could be 
uploaded, but I mean an image to illustrate the specific point of a note.


Best regards,

Oleksiy (Alex-7@OSM)


On 29-Aug-19 23:46, Frederik Ramm wrote:

Hi,

after two years of discussing the pros and cons, a decision has now been
reached to disallow anonymous comments on notes.

Up until two days ago, anonymous (i.e. not logged-in) users could create
notes and comment on existing notes; the only thing they could not do
was close a note.

Now, anonymous users can *still* create notes, but they cannot comment
on or close existing notes.

In the long discussions leading up to this decision (see
https://github.com/openstreetmap/openstreetmap-website/issues/1543 and
https://github.com/openstreetmap/openstreetmap-website/pull/1926) we
agreed that anonymous comments on notes are rarely useful, and when they
are, they come mostly from users who have just forgotten to log in. This
was weighed against recent massive spam and vandalism activities which
rendered the notes system near unusuable in some regions. Perversely, it
is much easier to fight a vandal creating new, useless notes (by just
closing them) than it is to clean up their droppings from existing notes.

Bye
Frederik




___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Tom Hughes]

On 30/08/2019 10:14, marc marc wrote:


So an anonymous user now is unable to answer to a note he
create himself unless he decides to create an account to answer? ?
since most anonymous notes lack information, we will be able
to close nearly all anonymous notes. we will see if this pushes people
to register or if there are so many people who forget to identify
themselves.


In reality anonymous users pretty much never come back to answer
a question anyway because they have no way of knowing that anybody
has asked a question unless they monitor the note themselves by
visiting the web site to check on it.

Tom

--
Tom Hughes (t...@compton.nu)
http://compton.nu/

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[Frederik Ramm]

Hi,

On 8/30/19 11:14 AM, marc marc wrote:
> So an anonymous user now is unable to answer to a note he
> create himself unless he decides to create an account to answer? ?

Yes. But it has never been something that happened frequently to begin with.

> since most anonymous notes lack information, we will be able
> to close nearly all anonymous notes. 

This probably varies from region to region; I've seen many anonymous
notes that did contain some useful information.

Bye
Frederik

-- 
Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[marc marc]

Hello,

So an anonymous user now is unable to answer to a note he
create himself unless he decides to create an account to answer? ?
since most anonymous notes lack information, we will be able
to close nearly all anonymous notes. we will see if this pushes people 
to register or if there are so many people who forget to identify 
themselves.

Regards,
Marc

29 Aug 2019 23:46, Frederik Ramm a écrit :

Hi,

after two years of discussing the pros and cons, a decision has now been
reached to disallow anonymous comments on notes.

Up until two days ago, anonymous (i.e. not logged-in) users could create
notes and comment on existing notes; the only thing they could not do
was close a note.

Now, anonymous users can *still* create notes, but they cannot comment
on or close existing notes.

In the long discussions leading up to this decision (see
https://github.com/openstreetmap/openstreetmap-website/issues/1543 and
https://github.com/openstreetmap/openstreetmap-website/pull/1926) we
agreed that anonymous comments on notes are rarely useful, and when they
are, they come mostly from users who have just forgotten to log in. This
was weighed against recent massive spam and vandalism activities which
rendered the notes system near unusuable in some regions. Perversely, it
is much easier to fight a vandal creating new, useless notes (by just
closing them) than it is to clean up their droppings from existing notes.

Bye
Frederik

-- 
Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"



--
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[joost schouppe]

Thanks, I think this is the correct decision.

Op do 29 aug. 2019 om 23:49 schreef Frederik Ramm :

> Hi,
>
> after two years of discussing the pros and cons, a decision has now been
> reached to disallow anonymous comments on notes.
>
> Up until two days ago, anonymous (i.e. not logged-in) users could create
> notes and comment on existing notes; the only thing they could not do
> was close a note.
>
> Now, anonymous users can *still* create notes, but they cannot comment
> on or close existing notes.
>
> In the long discussions leading up to this decision (see
> https://github.com/openstreetmap/openstreetmap-website/issues/1543 and
> https://github.com/openstreetmap/openstreetmap-website/pull/1926) we
> agreed that anonymous comments on notes are rarely useful, and when they
> are, they come mostly from users who have just forgotten to log in. This
> was weighed against recent massive spam and vandalism activities which
> rendered the notes system near unusuable in some regions. Perversely, it
> is much easier to fight a vandal creating new, useless notes (by just
> closing them) than it is to clean up their droppings from existing notes.
>
> Bye
> Frederik
>
> --
> Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"
>
> ___
> talk mailing list
> talk@openstreetmap.org
> https://lists.openstreetmap.org/listinfo/talk
>


-- 
Joost Schouppe
OpenStreetMap  |
Twitter  | LinkedIn
 | Meetup

___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk

Re: [OSM-talk] Anonymous comments on notes now disabled

[James]

I support this, I've even seen SEO services open notes just to have a "link
back to their site"

On Thu., Aug. 29, 2019, 5:49 p.m. Frederik Ramm, 
wrote:

> Hi,
>
> after two years of discussing the pros and cons, a decision has now been
> reached to disallow anonymous comments on notes.
>
> Up until two days ago, anonymous (i.e. not logged-in) users could create
> notes and comment on existing notes; the only thing they could not do
> was close a note.
>
> Now, anonymous users can *still* create notes, but they cannot comment
> on or close existing notes.
>
> In the long discussions leading up to this decision (see
> https://github.com/openstreetmap/openstreetmap-website/issues/1543 and
> https://github.com/openstreetmap/openstreetmap-website/pull/1926) we
> agreed that anonymous comments on notes are rarely useful, and when they
> are, they come mostly from users who have just forgotten to log in. This
> was weighed against recent massive spam and vandalism activities which
> rendered the notes system near unusuable in some regions. Perversely, it
> is much easier to fight a vandal creating new, useless notes (by just
> closing them) than it is to clean up their droppings from existing notes.
>
> Bye
> Frederik
>
> --
> Frederik Ramm  ##  eMail frede...@remote.org  ##  N49°00'09" E008°23'33"
>
> ___
> talk mailing list
> talk@openstreetmap.org
> https://lists.openstreetmap.org/listinfo/talk
>
___
talk mailing list
talk@openstreetmap.org
https://lists.openstreetmap.org/listinfo/talk