Jonathan Wakely <[email protected]> writes: > On Sun, 11 Oct 2026 at 22:23, Sam James via Gcc <[email protected]> wrote: >> >> Hi, >> >> This has come up on IRC a few times. I think we should re-enable >> self-account signup on Bugzilla. >> >> Andrea and I at least have seen people put off by having to email to get >> an account and they end up just not filing a bug at all and only >> complaining on social media, or not even that. > > Yes, this is a real problem. Another is that some people do try to > request an account, and their request is just rejected by spamassassin > or some other part of the infra, and we never receive the request > email. Then they think we just ignored them, and they give up trying > to report a bug. I don't know how often it happens, because not many > people persist in trying to get an account.
100%. > >> I did volunteer along with Arsen to help with the account requests but I >> don't believe this handles the problem in full. I myself have been put >> off when I have to email to get an account on someone's self-hosted >> gitlab. >> >> I already read most Bugzilla activity and I'm happy to tag comments as >> spam and ban accounts. > > The reason we put the restrictions in place was that the attacks we > got were too large and too fast for humans to handle. Hundreds of new > bugs filed per minute, full of SEO spam. I would much rather prevent > that from being filed rather than spend time cleaning it up later (we > do have the contrib/mark_spam.py script to semi-automate marking > entire bugs as spam). OK, I didn't realise the volume was so bad. I agree we'll need at least one measure then first. > > >> On the Gentoo side, we have had similar problems but it's not too >> bad. We have a Bugzilla extension [0] which bans URLs from new accounts for >> 24 hours: we could possibly bring that over here but exempt some >> sites like stackoverflow, standard reference sites, and godbolt. > > If we had that extension than I'd be happy to re-enable account > registration. I don't think spammers would bother waiting 24h and > coming back to post their links. This one should be easy: https://gitweb.gentoo.org/fork/bugzilla.git/tree/extensions/NewAcctAntiSpam it doesn't currently take a whitelist but it would be trivial to extend it to do so: https://gitweb.gentoo.org/fork/bugzilla.git/tree/extensions/NewAcctAntiSpam/Extension.pm#n43 I can help the overseers get this done easily in an hour or two. > >> Another option would be to implement moderation in Bugzilla [1] which both >> Bugzilla instances would benefit from. IMO neither of these should be >> blockers to begin with, and we can revisit as we go if it turns out to >> not work out. > > Allowing moderation so that bugs and comments from new accounts aren't > visible until approved would be great, but I agree that doesn't need > to be a blocker. > I do think blocking URLs from new accounts should be considered a > blocker though. ACK. > >> [0] https://sourceware.org/PR32270 >> [1] >> https://public-inbox.gentoo.org/gentoo-dev/[email protected]/T/#u >> >> thanks, >> sam sam
signature.asc
Description: PGP signature
