5 ms·

There's been a gitlab bug for almost 3 years to stop relying on recaptcha, https://gitlab.com/gitlab-org/gitlab-foss/-/issues/45684 https://gitlab.com/gitlab-or

There's been a gitlab bug for almost 3 years to stop relying on recaptcha, https://gitlab.com/gitlab-org/gitlab-foss/-/issues/45684 https://gitlab.com/gitlab-org/gitlab-foss/-/issues/45684 Debian, KDE and Gnome have never wanted to make their users run Google's nonfree javascript blob to contribute on their gitlab instance. There's been interest, Gitlab has done very little about it. Edit: other bugs about this can be found here https://gitlab.com/gitlab-org/gitlab-foss/-/issues/46548 https://gitlab.com/gitlab-org/gitlab-foss/-/issues/46548

sytse 6y ago
I think the code of this problem is that it is hard to identify if a user is a bot or a human. I've not seen any elegant free solutions to this.
- ran3824692 6y ago
  That is not the core of the problem. Spammers are humans, and sometimes they will solve recaptchas in large quantities to get their spam through. Its about having a multipronged approach for administrators to stay ahead of them. For some examples of free solutions see https://www.mediawiki.org/wiki/Manual:Combating_spam https://www.mediawiki.org/wiki/Manual:Combating_spam. It's even possible to connect spamassassin to forms. Gitlab needs tools and automation that detects and rolls back spam, bans users, knobs to tune restrictions and rate limits based on how spammers are acting. Gitlab inc just hasn't seemed to care much to help people trying to use Gitlab and keep their software freedom.
  - sytse 6y ago
    I think the focus of our Trust and Safety team has been on GitLab.com and not on all GitLab instances. We'll discuss changing this.
    - ran3824692 6y ago
      Thank you.
      - edchan 6y ago
        GitLab team member here. We just added a new page to our Handbook where we share approaches to preventing, detecting and mitigating spam on self-managed instances of GitLab. https://about.gitlab.com/handbook/engineering/security/operations/trustandsafety/diy.html https://about.gitlab.com/handbook/engineering/security/opera... We want to hear from you! Instructions on how to contact us: https://about.gitlab.com/handbook/engineering/security/operations/trustandsafety/#contact-us https://about.gitlab.com/handbook/engineering/security/opera...
  - robotmay 6y ago
    I'm curious about the spamassassin integration. Do you know of any open source projects currently using it for a web application?
GLJHunt 6y ago
We have a team currently working on improving the detection and mitigation of spam. We continue to look for ways to improve the security and user experience of our product. Our product includes the Akismet Spam filter which you can read more about in our handbook: https://about.gitlab.com/handbook/support/workflows/managing_spam.html https://about.gitlab.com/handbook/support/workflows/managing.... Further, Gitlab.com includes the ability to report abuse directly to our trust & safety team here: https://about.gitlab.com/handbook/engineering/security/operations/abuse/#how-to-report-abuse https://about.gitlab.com/handbook/engineering/security/opera... however, the report abuse feature on self-managed reports back to the instance admin. We are also currently developing an anti-spam feature intended to further improve spam detection & mitigation. This is set to be enabled on GitLab.com within 3 months.
- mpol 6y ago
  (I already replied on a different thread but this might make more sense) A service like Stop Forum Spam might be a solution to this. It checks for IP address and email address and gives it a value based on how likely it is assumed to be a spammer. When they have to set up a new email account and maybe even a new IP address for every few accounts, it gets to be a lot of work soon. https://www.stopforumspam.com/ https://www.stopforumspam.com/ It has a very simple API and is not that hard to implement (really, I have done it myself :) )
  - GLJHunt 6y ago
    Appreciate the response - I'll look into now
    - mpol 6y ago
      Okay, thank you. I see Gitlab is mostly Ruby. Just to get a general idea of the code this is a simple PHP function to use it: https://plugins.trac.wordpress.org/browser/gwolle-gb/trunk/functions/gb-stop-forum-spam.php https://plugins.trac.wordpress.org/browser/gwolle-gb/trunk/f... That function can be called when the register form has been submitted. It will return true or false. Forget about the transient stuff, that is just WordPres caching stuff. You don't need an API key like with Akismet. You would only need it if you want to add or remove entries from the SFS database. It really is much simpler. Ofcourse you might want to have a checkbox in the settings. But still, in an afternoon you might be able to finish this :) Wish you the best.

sytse 6y ago

I think the code of this problem is that it is hard to identify if a user is a bot or a human. I've not seen any elegant free solutions to this.

ran3824692 6y ago
That is not the core of the problem. Spammers are humans, and sometimes they will solve recaptchas in large quantities to get their spam through. Its about having a multipronged approach for administrators to stay ahead of them. For some examples of free solutions see https://www.mediawiki.org/wiki/Manual:Combating_spam https://www.mediawiki.org/wiki/Manual:Combating_spam. It's even possible to connect spamassassin to forms. Gitlab needs tools and automation that detects and rolls back spam, bans users, knobs to tune restrictions and rate limits based on how spammers are acting. Gitlab inc just hasn't seemed to care much to help people trying to use Gitlab and keep their software freedom.
- sytse 6y ago
  I think the focus of our Trust and Safety team has been on GitLab.com and not on all GitLab instances. We'll discuss changing this.
  - ran3824692 6y ago
    Thank you.
    - edchan 6y ago
      GitLab team member here. We just added a new page to our Handbook where we share approaches to preventing, detecting and mitigating spam on self-managed instances of GitLab. https://about.gitlab.com/handbook/engineering/security/operations/trustandsafety/diy.html https://about.gitlab.com/handbook/engineering/security/opera... We want to hear from you! Instructions on how to contact us: https://about.gitlab.com/handbook/engineering/security/operations/trustandsafety/#contact-us https://about.gitlab.com/handbook/engineering/security/opera...
- robotmay 6y ago
  I'm curious about the spamassassin integration. Do you know of any open source projects currently using it for a web application?

GLJHunt 6y ago

We have a team currently working on improving the detection and mitigation of spam. We continue to look for ways to improve the security and user experience of our product. Our product includes the Akismet Spam filter which you can read more about in our handbook: https://about.gitlab.com/handbook/support/workflows/managing_spam.html https://about.gitlab.com/handbook/support/workflows/managing.... Further, Gitlab.com includes the ability to report abuse directly to our trust & safety team here: https://about.gitlab.com/handbook/engineering/security/operations/abuse/#how-to-report-abuse https://about.gitlab.com/handbook/engineering/security/opera... however, the report abuse feature on self-managed reports back to the instance admin. We are also currently developing an anti-spam feature intended to further improve spam detection & mitigation. This is set to be enabled on GitLab.com within 3 months.

mpol 6y ago
(I already replied on a different thread but this might make more sense) A service like Stop Forum Spam might be a solution to this. It checks for IP address and email address and gives it a value based on how likely it is assumed to be a spammer. When they have to set up a new email account and maybe even a new IP address for every few accounts, it gets to be a lot of work soon. https://www.stopforumspam.com/ https://www.stopforumspam.com/ It has a very simple API and is not that hard to implement (really, I have done it myself :) )
- GLJHunt 6y ago
  Appreciate the response - I'll look into now
  - mpol 6y ago
    Okay, thank you. I see Gitlab is mostly Ruby. Just to get a general idea of the code this is a simple PHP function to use it: https://plugins.trac.wordpress.org/browser/gwolle-gb/trunk/functions/gb-stop-forum-spam.php https://plugins.trac.wordpress.org/browser/gwolle-gb/trunk/f... That function can be called when the register form has been submitted. It will return true or false. Forget about the transient stuff, that is just WordPres caching stuff. You don't need an API key like with Akismet. You would only need it if you want to add or remove entries from the SFS database. It really is much simpler. Ofcourse you might want to have a checkbox in the settings. But still, in an afternoon you might be able to finish this :) Wish you the best.