Hi Régis and Denis Thank you for the input. I agree that shifting to authenticated ratings with a proper comment system makes the most sense given the current situation.
With that change, I wonder if it wouldn't be simpler to start with clean rating records for all plugins rather than migrating those who rated with an account from the current obsolete ones. This will prevent recalculating all ratings based on the new rule or considering removing any rating based on abuse (which is difficult to determine) if we even choose to keep the obsolete records. With clean records, we could easily add the mandatory constructive comments feature as Denis suggested. On the QGIS Desktop side, this change will most likely require a QEP first because the existing feature in current and previous versions will break and I am not familiar with how to handle that. I can also prepare a detailed plan for the changes and announcement accordingly. Best regards, Lova Andriarimalala *QGIS Full Stack Developer * *T *: +27(0) 87 809 2702 *E *: [email protected] *W* : kartoza.com *This email and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you * *have received this email in error, please notify the sender immediately and delete it from your system. Unauthorised use, disclosure, or copying* *of the contents is prohibited.* On Wed, 19 Aug 2026 at 10:43, Régis Haubourg <[email protected]> wrote: > Hi, and thanks for the very clear situation overview Lova! > > Firefox requires to log to be able to rate. I concur with Denis. > Anonymous voting is now obsolete to me, as the ecosystem has grown and many > companies rely on this ecosystem. > > I would have no problem with a communication campaign announcing that > rating is no more authorized for anonymous accounts, and should only be > done from the website, as I don't think we want to add a sign in feature > from QGIS desktop itself. This feature would open the gate to a bunch of > security / privacy /compliance issues that I don't thing we want to add > complexity right now, as this is one strength of QGIS, to have no link with > our public infrastructure and no personal data collection. > > So, I guess that would mean that we remove the rating feature from QGIS > desktop and that the voting button only opens the web app at the right > place. > > > Best regards > > Régis > > > > On 19/08/2026 09:16, Denis Rouzaud via QGIS-Developer wrote: > > Hi, > > We switch to osgeo logged-in users only and force to have a (constructive) > comment? > Otherwise votes are meaningless and useless I'd say. > > Cheers, > Denis > > Le mer. 19 août 2026 à 09:07, Lova Andriarimalala via QGIS-Developer < > [email protected]> a écrit : > >> Hello everyone, >> >> Following the plugin rating abuse issue reported at >> https://github.com/qgis/QGIS-Plugins-Website/issues/416 and >> https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if >> someone could help or share some thoughts about it. >> >> We have released some fixes to enforce throttles ( >> https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged >> cookies and add a cap votes per address ( >> https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is >> not fully working because every IP recorded against a vote is a Cloudflare >> edge IP, not a real user IP. I checked 100 recent votes against >> Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is >> counting Cloudflare's proxy pool, which rotates per request. So, storing >> real client IPs would probably require some discussions regarding GDPR and >> retention angle. >> >> The reporter also asks us to (a) purge the fake votes and recompute the >> affected plugin scores, and (b) require a logged-in account to vote. Both >> are policy calls, not just code. And noting that the latter will probably >> break how the QGIS Desktop plugin manager submits ratings anonymously over >> XML-RPC. >> >> Thanks so much in advance for any input. >> >> Lova Andriarimalala >> >> >> *QGIS Full Stack Developer * >> *T *: +27(0) 87 809 2702 *E *: [email protected] *W* : >> kartoza.com >> >> _______________________________________________ >> QGIS-Developer mailing list >> [email protected] >> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer >> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer >> > > _______________________________________________ > QGIS-Developer mailing [email protected] > List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer > Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer > >
_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
