On Sun, 11 Oct 2026 at 22:23, Sam James via Gcc <[email protected]> wrote: > > Hi, > > This has come up on IRC a few times. I think we should re-enable > self-account signup on Bugzilla. > > Andrea and I at least have seen people put off by having to email to get > an account and they end up just not filing a bug at all and only > complaining on social media, or not even that.
Yes, this is a real problem. Another is that some people do try to request an account, and their request is just rejected by spamassassin or some other part of the infra, and we never receive the request email. Then they think we just ignored them, and they give up trying to report a bug. I don't know how often it happens, because not many people persist in trying to get an account. > I did volunteer along with Arsen to help with the account requests but I > don't believe this handles the problem in full. I myself have been put > off when I have to email to get an account on someone's self-hosted > gitlab. > > I already read most Bugzilla activity and I'm happy to tag comments as > spam and ban accounts. The reason we put the restrictions in place was that the attacks we got were too large and too fast for humans to handle. Hundreds of new bugs filed per minute, full of SEO spam. I would much rather prevent that from being filed rather than spend time cleaning it up later (we do have the contrib/mark_spam.py script to semi-automate marking entire bugs as spam). > On the Gentoo side, we have had similar problems but it's not too > bad. We have a Bugzilla extension [0] which bans URLs from new accounts for > 24 hours: we could possibly bring that over here but exempt some > sites like stackoverflow, standard reference sites, and godbolt. If we had that extension than I'd be happy to re-enable account registration. I don't think spammers would bother waiting 24h and coming back to post their links. > Another option would be to implement moderation in Bugzilla [1] which both > Bugzilla instances would benefit from. IMO neither of these should be > blockers to begin with, and we can revisit as we go if it turns out to > not work out. Allowing moderation so that bugs and comments from new accounts aren't visible until approved would be great, but I agree that doesn't need to be a blocker. I do think blocking URLs from new accounts should be considered a blocker though. > [0] https://sourceware.org/PR32270 > [1] > https://public-inbox.gentoo.org/gentoo-dev/[email protected]/T/#u > > thanks, > sam
