's and not on the form inputs them selves. Cascading works the best. A text input and a text area together are best. Make sure the inputs have names like "description" or "info", something attractive to a bot. If you see any data submitted in these fields, reject the post. Aggressive: ----------- Add a hidden field (in the classic type="hidden" sense) which has an encoded value for the page rendering time, or a unique id which can be connected back to a rendering time. If the post occurs within 4 seconds, reject the post. Integrate with a spam detection service like akismet: http://akismet.com/ Sample python code (django specific): http://www.djangosnippets.org/snippets/107/ I have used the 3rd solution on a high google ranked site to allow for anonymous posting. In the past year, only 1 spam post got through. -Doug -----Original Message----- From: tracker-discuss-bounces at python.org [mailto:tracker-discuss-bounces at python.org] On Behalf Of Paul Dubois Sent: Tuesday, March 20, 2007 6:04 PM To: tracker-discuss at python.org Subject: [Tracker-discuss] [issue105] Dealing with spam Paul Dubois added the comment: I did a 'retire' on the user and this issue. While it doesn't take the issue out of the database, it does make it not show up in searches and displays of issues. It appears you can still see it if you ask for it by number, at least I could but I was logged as administrator. I defer to someone more knowing as to how one could obliterate any traces of it, if one can. Somebody had to go to some trouble to do this, registering and then confirming by email. On 3/20/07, A.M. Kuchling wrote: > > New submission from A.M. Kuchling: > > The first spammy issue report has arrived in the Python tracker. Issue 1002 > attaches an HTML file with spam links. It looks to me like the spammer > registered for a user ID (or are IDs created automatically on receipt of an e-mail)? > > Admins should have the ability to delete issues and files completely; just > closing them isn't sufficient. > > ---------- > messages: 503 > nosy: amk > priority: feature > status: unread > title: Dealing with spam > > _______________________________________________________ > Meta Tracker > > _______________________________________________________ > _______________________________________________ > Tracker-discuss mailing list > Tracker-discuss at python.org > http://mail.python.org/mailman/listinfo/tracker-discuss > _______________________________________________________ Meta Tracker _______________________________________________________ _______________________________________________ Tracker-discuss mailing list Tracker-discuss at python.org http://mail.python.org/mailman/listinfo/tracker-discuss From skip at pobox.com Tue Mar 20 23:58:44 2007 From: skip at pobox.com (skip at pobox.com) Date: Tue, 20 Mar 2007 17:58:44 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: References: <1174422502.6.0.765978079996.issue105@psf.upfronthosting.co.za> <17920.19869.708493.922417@montanaro.dyndns.org> Message-ID: <17920.26404.783856.821891@montanaro.dyndns.org> Paul> If you contribute to an item you'll be added to the nosy list. Okay, so now I'm on the nosy list for this ticket I guess. However, when I visited that item I still only see amk on the nosy list. The header looks like this Title Dealing with spam Priority feature Status chatting Superseder Nosy List amk Assigned To Topics and none of the fields are sensitive to the mouse. Which brings me to the next question: I can't tell how to create a new ticket. This strikes me as something that should be immediately obvious from just about anywhere. I see no "create new" button. The links to the docs take me offsite and contain nothing specific to our tracker. (Andrew, I apologize for scribbling all over your ticket, but I don't see how to communicate with Roundup in any other fashion.) Skip From metatracker at psf.upfronthosting.co.za Tue Mar 20 23:58:50 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Tue, 20 Mar 2007 22:58:50 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: Message-ID: <17920.26404.783856.821891@montanaro.dyndns.org> Skip Montanaro added the comment: Paul> If you contribute to an item you'll be added to the nosy list. Okay, so now I'm on the nosy list for this ticket I guess. However, when I visited that item I still only see amk on the nosy list. The header looks like this Title Dealing with spam Priority feature Status chatting Superseder Nosy List amk Assigned To Topics and none of the fields are sensitive to the mouse. Which brings me to the next question: I can't tell how to create a new ticket. This strikes me as something that should be immediately obvious from just about anywhere. I see no "create new" button. The links to the docs take me offsite and contain nothing specific to our tracker. (Andrew, I apologize for scribbling all over your ticket, but I don't see how to communicate with Roundup in any other fashion.) Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 00:01:07 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Tue, 20 Mar 2007 23:01:07 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A82BE1@BN-EXCH01.nuance.com> Message-ID: <17920.26542.764655.95268@montanaro.dyndns.org> Skip Montanaro added the comment: Doug> There are a few ways of dealing with this: Doug> 1. have the confirmation e-mail have the activation code separate, Doug> and make the person enter the data in a form. Doug> 2. Use captcha everywhere (yuck). Doug> 3. Use spambot detections on your forms. 4. Validate your form submissions with something like SpamBayes. (Is that the similar to your #3?). I used it for the Mojam/Musi-Cal submission forms with great success. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From skip at pobox.com Wed Mar 21 00:01:02 2007 From: skip at pobox.com (skip at pobox.com) Date: Tue, 20 Mar 2007 18:01:02 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A82BE1@BN-EXCH01.nuance.com> References: <1174422502.6.0.765978079996.issue105@psf.upfronthosting.co.za> <2AB5541EB33172459EE430FFB66B1EE903A82BE1@BN-EXCH01.nuance.com> Message-ID: <17920.26542.764655.95268@montanaro.dyndns.org> Doug> There are a few ways of dealing with this: Doug> 1. have the confirmation e-mail have the activation code separate, Doug> and make the person enter the data in a form. Doug> 2. Use captcha everywhere (yuck). Doug> 3. Use spambot detections on your forms. 4. Validate your form submissions with something like SpamBayes. (Is that the similar to your #3?). I used it for the Mojam/Musi-Cal submission forms with great success. Skip From Doug.Napoleone at nuance.com Wed Mar 21 00:07:23 2007 From: Doug.Napoleone at nuance.com (Doug Napoleone) Date: Tue, 20 Mar 2007 19:07:23 -0400 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <17920.26542.764655.95268@montanaro.dyndns.org> References: <2AB5541EB33172459EE430FFB66B1EE903A82BE1@BN-EXCH01.nuance.com> <17920.26542.764655.95268@montanaro.dyndns.org> Message-ID: <2AB5541EB33172459EE430FFB66B1EE903A82C6D@BN-EXCH01.nuance.com> Skip Montanaro wrote: > 4. Validate your form submissions with something like SpamBayes. (Is that > the similar to your #3?). I used it for the Mojam/Musi-Cal submission > forms with great success. Yes, that is part of the #3 approach. I went with http://akismet.com/ over SpamBayes because a friend claimed they were better with forum spam and he had sample PHP code. I have no first hand knowledge of which is better. -Doug From martin at v.loewis.de Wed Mar 21 00:22:40 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Wed, 21 Mar 2007 00:22:40 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A82C6D@BN-EXCH01.nuance.com> References: <2AB5541EB33172459EE430FFB66B1EE903A82BE1@BN-EXCH01.nuance.com> <17920.26542.764655.95268@montanaro.dyndns.org> <2AB5541EB33172459EE430FFB66B1EE903A82C6D@BN-EXCH01.nuance.com> Message-ID: <46006CC0.3020206@v.loewis.de> It seems that the spammers have now successully located bugs.python.org. Issues 1003..1009 are all spam. Martin From metatracker at psf.upfronthosting.co.za Wed Mar 21 00:22:44 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Tue, 20 Mar 2007 23:22:44 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A82C6D@BN-EXCH01.nuance.com> Message-ID: <46006CC0.3020206@v.loewis.de> Martin v. L?wis added the comment: It seems that the spammers have now successully located bugs.python.org. Issues 1003..1009 are all spam. Martin _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 01:12:51 2007 From: metatracker at psf.upfronthosting.co.za (Brett C.) Date: Wed, 21 Mar 2007 00:12:51 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174435971.88.0.487018600943.issue105@psf.upfronthosting.co.za> Brett C. added the comment: I just explicitly added you to the nosy list, Skip. When you are logged in you can just click the '(list)' link, search for yourself, click the checkbox next to your account, and press Apply. And as for new issues, there is a link in the left column named "Create New" for creating new issues. ---------- nosy: +skip at pobox.com _______________________________________________________ Meta Tracker _______________________________________________________ From skip at pobox.com Wed Mar 21 04:47:39 2007 From: skip at pobox.com (skip at pobox.com) Date: Tue, 20 Mar 2007 22:47:39 -0500 Subject: [Tracker-discuss] On spammish submissions Message-ID: <17920.43739.3665.113423@montanaro.dyndns.org> Okay, now that Brett straightened me out on access to the tracker I think I might actually be able to use bugs.python.org. (It looks a lot different after successfully logging in.) On the topic of suppressing spammy form submissions, I implemented a simple scheme using SpamBayes for the Mojam and Musi-Cal sites. The basic idea is pretty simple. The first thing that happens for any submission is that the contents are converted to a stream of tokens (generally the "words" of the submission), with synthetic tokens added which indicate something about the quality of the submission. For example, in my case the spammers were hitting the concert submission form. Whether or not I could find lat/long coordinates for the "city" was a pretty good differentiator of valid and spammy submissions. Also, the presence of URLs in most spammy submissions allowed SpamBayes to pick them apart and generate various useful tokens. Once tokenized, the submission was scored by SpamBayes on a scale from 0.0 (definitely valid) to 1.0 (definitely spam). If it fell under my predefined ham threshold (0.15 worked fine) I accepted it. If not, I mailed the original input along to myself for later review. If it scored less than the spam threshold (I chose 0.60) I would add it to the spam data for later retraining. If above, I just tossed it out. Similarly, if something scored above 0.15 but was actually okay (often with an input error) I would correct any errors, toss the input into the ham data, retrain and resubmit it. The same basic approach would work here. Admins would get emails for anything above the "okay" threshold and could decide what, if anything, needed doing. In the Admin menu you might have "Edit Spam", "Edit Ham" and "Retrain" items. If necessary you'd add the questionable input to the spam or ham data and poke the retrain button. If there's interest in the technique I can work up some more concrete code which can be integrated into the tracker. Skip From metatracker at psf.upfronthosting.co.za Wed Mar 21 07:07:02 2007 From: metatracker at psf.upfronthosting.co.za (Brett C.) Date: Wed, 21 Mar 2007 06:07:02 -0000 Subject: [Tracker-discuss] [issue106] Change Help link to wiki docs Message-ID: <1174457222.9.0.437457290187.issue106@psf.upfronthosting.co.za> New submission from Brett C.: I think Skip's confusion (ignoring the mix-up over the meta/test tracker dichotomy) partially stemmed from the help docs linking to the Roundup docs. I think it would be better to remove that link and put in one that initially points to http://wiki.python.org/moin/TrackerDocs and can eventually be changed to more permanent docs. ---------- messages: 511 nosy: brettcannon priority: bug status: unread title: Change Help link to wiki docs _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 07:09:08 2007 From: metatracker at psf.upfronthosting.co.za (Brett C.) Date: Wed, 21 Mar 2007 06:09:08 -0000 Subject: [Tracker-discuss] [issue107] Mention SF account recovery in a reasonable place Message-ID: <1174457348.62.0.259533833431.issue107@psf.upfronthosting.co.za> New submission from Brett C.: Perhaps in the page where one creates a new account we should put a note saying that if you have ever worked on an issue for Python at SF you can use your SF account name. Then link to docs explaining how to recover the password for the account. ---------- messages: 512 nosy: brettcannon priority: bug status: unread title: Mention SF account recovery in a reasonable place _______________________________________________________ Meta Tracker _______________________________________________________ From nnorwitz at gmail.com Wed Mar 21 07:43:18 2007 From: nnorwitz at gmail.com (Neal Norwitz) Date: Tue, 20 Mar 2007 23:43:18 -0700 Subject: [Tracker-discuss] On spammish submissions In-Reply-To: <17920.43739.3665.113423@montanaro.dyndns.org> References: <17920.43739.3665.113423@montanaro.dyndns.org> Message-ID: Thanks Skip! I think it would be great to have a spam solution. -- n On 3/20/07, skip at pobox.com wrote: > Okay, now that Brett straightened me out on access to the tracker I think I > might actually be able to use bugs.python.org. (It looks a lot different > after successfully logging in.) > > On the topic of suppressing spammy form submissions, I implemented a simple > scheme using SpamBayes for the Mojam and Musi-Cal sites. The basic idea is > pretty simple. The first thing that happens for any submission is that the > contents are converted to a stream of tokens (generally the "words" of the > submission), with synthetic tokens added which indicate something about the > quality of the submission. For example, in my case the spammers were > hitting the concert submission form. Whether or not I could find lat/long > coordinates for the "city" was a pretty good differentiator of valid and > spammy submissions. Also, the presence of URLs in most spammy submissions > allowed SpamBayes to pick them apart and generate various useful tokens. > Once tokenized, the submission was scored by SpamBayes on a scale from 0.0 > (definitely valid) to 1.0 (definitely spam). If it fell under my predefined > ham threshold (0.15 worked fine) I accepted it. If not, I mailed the > original input along to myself for later review. If it scored less than the > spam threshold (I chose 0.60) I would add it to the spam data for later > retraining. If above, I just tossed it out. Similarly, if something scored > above 0.15 but was actually okay (often with an input error) I would correct > any errors, toss the input into the ham data, retrain and resubmit it. > > The same basic approach would work here. Admins would get emails for > anything above the "okay" threshold and could decide what, if anything, > needed doing. In the Admin menu you might have "Edit Spam", "Edit Ham" and > "Retrain" items. If necessary you'd add the questionable input to the spam > or ham data and poke the retrain button. > > If there's interest in the technique I can work up some more concrete code > which can be integrated into the tracker. > > Skip > _______________________________________________ > Tracker-discuss mailing list > Tracker-discuss at python.org > http://mail.python.org/mailman/listinfo/tracker-discuss > From brett at python.org Wed Mar 21 07:56:05 2007 From: brett at python.org (Brett Cannon) Date: Tue, 20 Mar 2007 23:56:05 -0700 Subject: [Tracker-discuss] On spammish submissions In-Reply-To: <17920.43739.3665.113423@montanaro.dyndns.org> References: <17920.43739.3665.113423@montanaro.dyndns.org> Message-ID: On 3/20/07, skip at pobox.com wrote: > Okay, now that Brett straightened me out on access to the tracker I think I > might actually be able to use bugs.python.org. (It looks a lot different > after successfully logging in.) > > On the topic of suppressing spammy form submissions, I implemented a simple > scheme using SpamBayes for the Mojam and Musi-Cal sites. The basic idea is > pretty simple. The first thing that happens for any submission is that the > contents are converted to a stream of tokens (generally the "words" of the > submission), with synthetic tokens added which indicate something about the > quality of the submission. For example, in my case the spammers were > hitting the concert submission form. Whether or not I could find lat/long > coordinates for the "city" was a pretty good differentiator of valid and > spammy submissions. Also, the presence of URLs in most spammy submissions > allowed SpamBayes to pick them apart and generate various useful tokens. > Once tokenized, the submission was scored by SpamBayes on a scale from 0.0 > (definitely valid) to 1.0 (definitely spam). If it fell under my predefined > ham threshold (0.15 worked fine) I accepted it. If not, I mailed the > original input along to myself for later review. If it scored less than the > spam threshold (I chose 0.60) I would add it to the spam data for later > retraining. If above, I just tossed it out. Similarly, if something scored > above 0.15 but was actually okay (often with an input error) I would correct > any errors, toss the input into the ham data, retrain and resubmit it. > > The same basic approach would work here. Admins would get emails for > anything above the "okay" threshold and could decide what, if anything, > needed doing. In the Admin menu you might have "Edit Spam", "Edit Ham" and > "Retrain" items. If necessary you'd add the questionable input to the spam > or ham data and poke the retrain button. > > If there's interest in the technique I can work up some more concrete code > which can be integrated into the tracker. Hmm, sounds reasonable. And the Bayesian network thing should work out well here since the subject matter, as a whole, is rather specific. =) Otherwise we are going to need captchas or something for activating accounts or something. Plus a Python solution is just nice. -Brett From martin at v.loewis.de Wed Mar 21 08:05:05 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Wed, 21 Mar 2007 08:05:05 +0100 Subject: [Tracker-discuss] On spammish submissions In-Reply-To: <17920.43739.3665.113423@montanaro.dyndns.org> References: <17920.43739.3665.113423@montanaro.dyndns.org> Message-ID: <4600D921.8020909@v.loewis.de> > The same basic approach would work here. Admins would get emails for > anything above the "okay" threshold and could decide what, if anything, > needed doing. In the Admin menu you might have "Edit Spam", "Edit Ham" and > "Retrain" items. If necessary you'd add the questionable input to the spam > or ham data and poke the retrain button. I'm somewhat skeptical that an approach involving manual review by administrators could work. I'd rather find a means to not let spambots register in the first place. OTOH, allowing issue submission to proceed, but adding a SPAM button (accessible to developers) might work. This button would expire the issue, disable the poster's account, and add the data to the spam database. However, I would hope it would rarely happen if we can manage to not let spambots register in the first place. So it might be a lot of effort for little gain (OTOH, it might also be useful to other roundup installations if sufficiently generalized). Regards, Martin From metatracker at psf.upfronthosting.co.za Wed Mar 21 08:18:14 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Wed, 21 Mar 2007 07:18:14 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174461494.74.0.594942783463.issue105@psf.upfronthosting.co.za> Martin v. L?wis added the comment: Promoting the issue to "bug". I think we need _some_ spam protection before going into production use. I like the proposal of rejecting submissions that arrive within 4s of form generation. Another idea is to mangle the field names so that the spambot doesn't know what fields to enter the email address in (and add some honeypot fields for the email address so we know a bot has filled them). Richard, is there anything like that already done in roundup? ---------- nosy: +richard priority: feature -> bug _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 09:07:40 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Wed, 21 Mar 2007 08:07:40 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174461494.74.0.594942783463.issue105@psf.upfronthosting.co.za> Message-ID: Richard Jones added the comment: On 21/03/2007, at 6:18 PM, Martin v. L?wis wrote: > I like the proposal of rejecting submissions that arrive within 4s > of form > generation. > > Another idea is to mangle the field names so that the spambot > doesn't know what > fields to enter the email address in (and add some honeypot fields > for the email > address so we know a bot has filled them). > > Richard, is there anything like that already done in roundup? Nothing on the form side that I'm aware of - generally trackers just require a login if spam is ever an issue. On the email side the best thing to do would be to disallow email access for anonymous users. If anonymous email submission is allowed then human triage is the general method of filtering as automatic systems are error-prone and difficult to maintain (I'm actually unaware of anyone using the latter). _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 09:40:36 2007 From: metatracker at psf.upfronthosting.co.za (Georg Brandl) Date: Wed, 21 Mar 2007 08:40:36 -0000 Subject: [Tracker-discuss] [issue100] show link to tracker docs Message-ID: <1174466436.79.0.156239652735.issue100@psf.upfronthosting.co.za> Georg Brandl added the comment: Superseded by issue100. ---------- status: chatting -> resolved _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 09:45:45 2007 From: metatracker at psf.upfronthosting.co.za (Georg Brandl) Date: Wed, 21 Mar 2007 08:45:45 -0000 Subject: [Tracker-discuss] [issue100] show link to tracker docs Message-ID: <1174466745.06.0.62295670938.issue100@psf.upfronthosting.co.za> Georg Brandl added the comment: issue106, I meant :) ---------- status: resolved -> chatting _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 10:17:04 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Wed, 21 Mar 2007 09:17:04 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: Message-ID: <4600F80E.9030808@v.loewis.de> Martin v. L?wis added the comment: > Nothing on the form side that I'm aware of - generally trackers just > require a login if spam is ever an issue. In this specific case, this didn't help. The spammers would create an account, confirm the email, and then add spam to the tracker. That way, 7 issues where created under 7 different accounts within half an hour. _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Wed Mar 21 11:45:50 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Wed, 21 Mar 2007 10:45:50 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174473950.62.0.205709119995.issue105@psf.upfronthosting.co.za> Martin v. L?wis added the comment: Attached is a patch that replaces the register action with one that requires a response time by the new user of more than 4s. _______________________________________________________ Meta Tracker _______________________________________________________ -------------- next part -------------- A non-text attachment was scrubbed... Name: timestamp.diff Type: application/octet-stream Size: 1563 bytes Desc: not available Url : http://mail.python.org/pipermail/tracker-discuss/attachments/20070321/d382cc5f/attachment.obj From metatracker at psf.upfronthosting.co.za Wed Mar 21 12:00:32 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Wed, 21 Mar 2007 11:00:32 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: Message-ID: <17921.4172.733070.81239@montanaro.dyndns.org> Skip Montanaro added the comment: Richard> On the email side the best thing to do would be to disallow Richard> email access for anonymous users. If anonymous email submission Richard> is allowed then human triage is the general method of filtering Richard> as automatic systems are error-prone and difficult to maintain Richard> (I'm actually unaware of anyone using the latter). Right. Most/all of these spammers are trying to get their links on blogs. We are just independent bystanders caught in the crossfire. If honeypot fields were added it would be a good idea to name them the same as the common comment textarea fields on popular blog hosting sites. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From Doug.Napoleone at nuance.com Wed Mar 21 15:52:21 2007 From: Doug.Napoleone at nuance.com (Doug Napoleone) Date: Wed, 21 Mar 2007 10:52:21 -0400 Subject: [Tracker-discuss] [issue105] Dealing with spam References: <17921.4172.733070.81239@montanaro.dyndns.org> Message-ID: <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> I would once again recommend using a service like akismet.com for new bug creation (comments should be less of an issue). The honey pot system I outlined works well and catches 90% of the bots out there. For the remaining 10% (~75 posts a month on average for the anime forum) a spam filter really is needed. When the PyCon website/wiki rose in the google ranks, it was getting hit with 10 spam posts a day until PMWiki was updated to use a spam filter. We were very lucky that only a few pages were targeted so it was mostly spam bots replacing spam with more spam. e.g.: http://us.pycon.org/TX2007/Vendors?action=diff I guess that got them mad because we later got hit with 10K+ attempts over 4 days. Once you get on a bot networks list, things go south fast. -Doug -----Original Message----- From: tracker-discuss-bounces at python.org on behalf of Skip Montanaro Sent: Wed 3/21/2007 7:00 AM To: tracker-discuss at python.org Subject: [Tracker-discuss] [issue105] Dealing with spam Skip Montanaro added the comment: Richard> On the email side the best thing to do would be to disallow Richard> email access for anonymous users. If anonymous email submission Richard> is allowed then human triage is the general method of filtering Richard> as automatic systems are error-prone and difficult to maintain Richard> (I'm actually unaware of anyone using the latter). Right. Most/all of these spammers are trying to get their links on blogs. We are just independent bystanders caught in the crossfire. If honeypot fields were added it would be a good idea to name them the same as the common comment textarea fields on popular blog hosting sites. Skip _______________________________________________________ Meta Tracker _______________________________________________________ _______________________________________________ Tracker-discuss mailing list Tracker-discuss at python.org http://mail.python.org/mailman/listinfo/tracker-discuss From martin at v.loewis.de Wed Mar 21 16:20:34 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Wed, 21 Mar 2007 16:20:34 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> References: <17921.4172.733070.81239@montanaro.dyndns.org> <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> Message-ID: <46014D42.9050400@v.loewis.de> Doug Napoleone schrieb: > I would once again recommend using a service like akismet.com I'm skeptical, for two reasons: - somebody will have to write the code to integrate roundup with this service. - It's not clear to me what license to purchase. Clearly, the standard "free" license doesn't apply, as this is not the personal blog of somebody. Instead, one of the commercial licenses would have to be purchased. So it's either the "per-blog" one (how many blogs do we have in roundup?), or the access API key (with $50/month for up to 50,000 calls per month). Perhaps the non-profit license may apply ($25/month for up to 5 blogs), or perhaps we can negotiate the free option. In that case, somebody would have to do the negotiation. Regards, Martin From metatracker at psf.upfronthosting.co.za Wed Mar 21 16:20:36 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Wed, 21 Mar 2007 15:20:36 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> Message-ID: <46014D42.9050400@v.loewis.de> Martin v. L?wis added the comment: Doug Napoleone schrieb: > I would once again recommend using a service like akismet.com I'm skeptical, for two reasons: - somebody will have to write the code to integrate roundup with this service. - It's not clear to me what license to purchase. Clearly, the standard "free" license doesn't apply, as this is not the personal blog of somebody. Instead, one of the commercial licenses would have to be purchased. So it's either the "per-blog" one (how many blogs do we have in roundup?), or the access API key (with $50/month for up to 50,000 calls per month). Perhaps the non-profit license may apply ($25/month for up to 5 blogs), or perhaps we can negotiate the free option. In that case, somebody would have to do the negotiation. Regards, Martin _______________________________________________________ Meta Tracker _______________________________________________________ From forsberg at efod.se Wed Mar 21 18:00:52 2007 From: forsberg at efod.se (Erik Forsberg) Date: Wed, 21 Mar 2007 18:00:52 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <17920.26404.783856.821891@montanaro.dyndns.org> (skip@pobox.com's message of "Tue, 20 Mar 2007 17:58:44 -0500") References: <1174422502.6.0.765978079996.issue105@psf.upfronthosting.co.za> <17920.19869.708493.922417@montanaro.dyndns.org> <17920.26404.783856.821891@montanaro.dyndns.org> Message-ID: <87slbycz0b.fsf@uterus.efod.se> skip at pobox.com writes: > and none of the fields are sensitive to the mouse. Sounds to me like you're not logged in. > Which brings me to the next question: I can't tell how to create a new > ticket. Also requires that you're logged in. \EF -- Erik Forsberg http://efod.se GPG/PGP Key: 1024D/0BAC89D9 From seefeld at sympatico.ca Wed Mar 21 18:06:06 2007 From: seefeld at sympatico.ca (Stefan Seefeld) Date: Wed, 21 Mar 2007 13:06:06 -0400 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <87slbycz0b.fsf@uterus.efod.se> References: <1174422502.6.0.765978079996.issue105@psf.upfronthosting.co.za> <17920.19869.708493.922417@montanaro.dyndns.org> <17920.26404.783856.821891@montanaro.dyndns.org> <87slbycz0b.fsf@uterus.efod.se> Message-ID: <460165FE.7080501@sympatico.ca> Erik Forsberg wrote: > skip at pobox.com writes: > >> and none of the fields are sensitive to the mouse. > > Sounds to me like you're not logged in. ...which would explain why you aren't added to the 'nosy' list; that requires a user (with a real email address !). -- ...ich hab' noch einen Koffer in Berlin... From skip at pobox.com Wed Mar 21 18:44:06 2007 From: skip at pobox.com (skip at pobox.com) Date: Wed, 21 Mar 2007 12:44:06 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <460165FE.7080501@sympatico.ca> References: <1174422502.6.0.765978079996.issue105@psf.upfronthosting.co.za> <17920.19869.708493.922417@montanaro.dyndns.org> <17920.26404.783856.821891@montanaro.dyndns.org> <87slbycz0b.fsf@uterus.efod.se> <460165FE.7080501@sympatico.ca> Message-ID: <17921.28390.107399.460119@montanaro.dyndns.org> >>>>> "Stefan" == Stefan Seefeld writes: Stefan> Erik Forsberg wrote: >> skip at pobox.com writes: >> >>> and none of the fields are sensitive to the mouse. >> >> Sounds to me like you're not logged in. Stefan> ...which would explain why you aren't added to the 'nosy' list; Stefan> that requires a user (with a real email address !). You are both correct, however as I pointed out to Brett in private email, my frustration stemmed from a) not being able to do anything and b) not being able to figure out how to do anything. Brett opened a ticket about the missing doc link. That was my fundamental roadblock. The link that was there was to the Roundup docs, which I believe are more suited to someone wanting to develop a Roundup instance than to users of a Roundup instance. Skip From pfdubois at gmail.com Wed Mar 21 19:32:56 2007 From: pfdubois at gmail.com (Paul Dubois) Date: Wed, 21 Mar 2007 11:32:56 -0700 Subject: [Tracker-discuss] On spammish submissions In-Reply-To: <4600D921.8020909@v.loewis.de> References: <17920.43739.3665.113423@montanaro.dyndns.org> <4600D921.8020909@v.loewis.de> Message-ID: For my 2 cents worth, preventing registration (even including a manual review) is a much narrower job with less activity. Manual screening of submissions is not practical. One should also add defenses on the mailing lists that are the TARGET of the mail from the tracker, since they need those anyway irregardless of the tracker. On 3/21/07, "Martin v. L?wis" wrote: > > The same basic approach would work here. Admins would get emails for > > anything above the "okay" threshold and could decide what, if anything, > > needed doing. In the Admin menu you might have "Edit Spam", "Edit Ham" and > > "Retrain" items. If necessary you'd add the questionable input to the spam > > or ham data and poke the retrain button. > > I'm somewhat skeptical that an approach involving manual review by > administrators could work. I'd rather find a means to not let spambots > register in the first place. > > OTOH, allowing issue submission to proceed, but adding a SPAM button > (accessible to developers) might work. This button would expire the > issue, disable the poster's account, and add the data to the spam > database. However, I would hope it would rarely happen if we > can manage to not let spambots register in the first place. So it > might be a lot of effort for little gain (OTOH, it might also be > useful to other roundup installations if sufficiently generalized). > > Regards, > Martin > > _______________________________________________ > Tracker-discuss mailing list > Tracker-discuss at python.org > http://mail.python.org/mailman/listinfo/tracker-discuss > From skip at pobox.com Wed Mar 21 20:04:49 2007 From: skip at pobox.com (skip at pobox.com) Date: Wed, 21 Mar 2007 14:04:49 -0500 Subject: [Tracker-discuss] On spammish submissions In-Reply-To: References: <17920.43739.3665.113423@montanaro.dyndns.org> <4600D921.8020909@v.loewis.de> Message-ID: <17921.33233.967294.489316@montanaro.dyndns.org> Paul> For my 2 cents worth, preventing registration (even including a Paul> manual review) is a much narrower job with less activity. Manual Paul> screening of submissions is not practical. I didn't mean to imply that all submissions should be manually reviewed in the SpamBayes-based system I proposed, only those that don't pass muster. When SpamBayes is properly trained (knows a bit about what you think is and is not acceptable) the distribution of its scores tend to be bimodal and quite accurate. You generally have obviously valid submissions (which no human would normally need to review) or obviously spammy submissions (which you would just delete and forget about. The only cases I encountered which required manual intervention were those where the submission was incorrectly submitted (e.g., city misspelled, date omitted) or where the filter wasn't sure about the submission (e.g., spam which is significantly different in structure from previously seen spams). In the former case someone else suggested adding a SPAM button to the ticket page (only visible to admins). In fact, unsure and spam submissions could (in theory) be accepted but not displayed in lists or located by searches except by logged in admins. Based on the classification as an admin you would see: Classified as Button(s) displayed ------------- ------------------- Valid (score <= 0.15) SPAM Unsure (0.15 < score < 0.60) OKAY, SPAM Spam (0.60 <= score) OKAY, DELETE The OKAY button would classify the ticket as okay, retrain the database and release the ticket for viewing by the general public. The DELETE button would ban the user who submitted the ticket then delete the ticket. The SPAM button would do the DELETE operation but also classify the submission as spam and retrain the database. Paul> One should also add defenses on the mailing lists that are the Paul> TARGET of the mail from the tracker, since they need those anyway Paul> irregardless of the tracker. That's the original use for which SpamBayes was designed. I see no particular reason you couldn't front those lists using it. Many other lists hosted on python.org are already filtered that way. Just ask postmaster at python.org to set things up. Skip From Doug.Napoleone at nuance.com Wed Mar 21 20:15:07 2007 From: Doug.Napoleone at nuance.com (Doug Napoleone) Date: Wed, 21 Mar 2007 15:15:07 -0400 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <46014D42.9050400@v.loewis.de> References: <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> <46014D42.9050400@v.loewis.de> Message-ID: <2AB5541EB33172459EE430FFB66B1EE903B1E561@BN-EXCH01.nuance.com> Martin v. L?wis added the comment: > Doug Napoleone schrieb: >> I would once again recommend using a service like akismet.com > > I'm skeptical, for two reasons: > - somebody will have to write the code to integrate roundup with > this service. > - It's not clear to me what license to purchase. Clearly, the > standard "free" license doesn't apply, as this is not the > personal blog of somebody. Instead, one of the commercial > licenses would have to be purchased. So it's either the > "per-blog" one (how many blogs do we have in roundup?), > or the access API key (with $50/month for up to 50,000 > calls per month). Perhaps the non-profit license may apply > ($25/month for up to 5 blogs), or perhaps we can negotiate > the free option. In that case, somebody would have to do the > negotiation. > > Regards, > Martin Martin, I did not mean that it had to be akismet, just that a service 'like' akismet should be used. I only mentioned it because it's the one I have experience with (and code for). Skip has detailed a solution he wrote based on SpamBayes in a different thread ([Tracker-discuss] On spammish submissions). That seems like the best option to go with, and it sounds like a roundup integration is eminent. -Doug From martin at v.loewis.de Wed Mar 21 20:43:04 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Wed, 21 Mar 2007 20:43:04 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <2AB5541EB33172459EE430FFB66B1EE903B1E561@BN-EXCH01.nuance.com> References: <2AB5541EB33172459EE430FFB66B1EE903A01CB9@BN-EXCH01.nuance.com> <46014D42.9050400@v.loewis.de> <2AB5541EB33172459EE430FFB66B1EE903B1E561@BN-EXCH01.nuance.com> Message-ID: <46018AC8.50009@v.loewis.de> > Martin, I did not mean that it had to be akismet, just that a service > 'like' akismet should be used. I only mentioned it because it's the > one I have experience with (and code for). Unfortunately, this is precisely the situation we always run into when somebody brings up a commercial service. It's the one they had experience with, so they recommend it. An often-mentioned advantage of using a commercial service over a self-managed one is that the commercial service requires less volunteer resources. In my (little) experience, this is not true. To actually get in contact with the commercial service, and to acquire their services, a lot of volunteer time is needed. So if somebody suggests to use a certain service, if they don't simultaneously offer to work with that specific company on getting things set up, such an offer has zero chance of getting considered. In the case of the Roundup tracker itself, it was actually that the company (Roche) came to us and offered to do everything for free. So they are actually volunteers here, although they use company resources - this is exceptional. In all other cases, you need a volunteer to interface to the company. So if you volunteer to make integrate some such service into roundup, that might be useful. Without a clear commitment, it's likely that we will have to use what is available at the time the service goes life (I'd like to see this issue as blocking production-mode, though - *something* has to be done). Regards, Martin From metatracker at psf.upfronthosting.co.za Thu Mar 22 00:36:12 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Wed, 21 Mar 2007 23:36:12 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174520172.95.0.580540848352.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: I just had a look at the spam entry mentioned at the start of this issue (1002) and unfortunately it looks like the user record has been expired as I can't find out more detail. Does the tracker currently accept anonymous email submissions? It would seem that's the most likely vector for this submission since the incoming mail address is out in the wild. _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 00:41:29 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Wed, 21 Mar 2007 23:41:29 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174520489.11.0.287561326276.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: Sorry, I'm not on the tracker-discuss list and I've just reviewed the discussion there via the archive. I see you've got this discussion - including possible remedies - in hand already. _______________________________________________________ Meta Tracker _______________________________________________________ From pfdubois at gmail.com Thu Mar 22 01:56:16 2007 From: pfdubois at gmail.com (Paul Dubois) Date: Wed, 21 Mar 2007 17:56:16 -0700 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174520172.95.0.580540848352.issue105@psf.upfronthosting.co.za> References: <1174520172.95.0.580540848352.issue105@psf.upfronthosting.co.za> Message-ID: The tracker does not accept anonymous email submissions, and requires mail confirmation for registration. There was no user-entered data associated with the user before I retired it, other than name and the yahoo address. It is important in my mind that this discussion not focus just on the "issues" and messages, since it is only a rogue user that can cause trouble. If no rogue users get registered, no trouble. And a rogue user can cause other trouble, not just spam. Now in fact we don't have to give anonymous users ANY permissions, including the ability to register. We could have them fill out an application form, for example, that a human would review, or with the character recognition stuff. Here's some excepts from config.ini: # Register new users instantly, or require confirmation via # email? # Allowed values: yes, no # Default: no instant_registration = no # Offer registration confirmation by email or only through the web? # Allowed values: yes, no # Default: yes email_registration_confirmation = yes And from the security section of schema.py: # Assign the appropriate permissions to the anonymous user's Anonymous # Role. Choices here are: # - Allow anonymous users to register db.security.addPermissionToRole('Anonymous', 'Create', 'user') # Allow anonymous users access to view issues (and the related, linked # information) for cl in 'issue', 'file', 'msg', 'severity', 'status', 'resolution': db.security.addPermissionToRole('Anonymous', 'View', cl) On 3/21/07, Richard Jones wrote: > > Richard Jones added the comment: > > I just had a look at the spam entry mentioned at the start of this issue (1002) > and unfortunately it looks like the user record has been expired as I can't find > out more detail. > > Does the tracker currently accept anonymous email submissions? > > It would seem that's the most likely vector for this submission since the > incoming mail address is out in the wild. > > _______________________________________________________ > Meta Tracker > > _______________________________________________________ > _______________________________________________ > Tracker-discuss mailing list > Tracker-discuss at python.org > http://mail.python.org/mailman/listinfo/tracker-discuss > From metatracker at psf.upfronthosting.co.za Thu Mar 22 01:56:18 2007 From: metatracker at psf.upfronthosting.co.za (Paul Dubois) Date: Thu, 22 Mar 2007 00:56:18 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174520172.95.0.580540848352.issue105@psf.upfronthosting.co.za> Message-ID: Paul Dubois added the comment: The tracker does not accept anonymous email submissions, and requires mail confirmation for registration. There was no user-entered data associated with the user before I retired it, other than name and the yahoo address. It is important in my mind that this discussion not focus just on the "issues" and messages, since it is only a rogue user that can cause trouble. If no rogue users get registered, no trouble. And a rogue user can cause other trouble, not just spam. Now in fact we don't have to give anonymous users ANY permissions, including the ability to register. We could have them fill out an application form, for example, that a human would review, or with the character recognition stuff. Here's some excepts from config.ini: # Register new users instantly, or require confirmation via # email? # Allowed values: yes, no # Default: no instant_registration = no # Offer registration confirmation by email or only through the web? # Allowed values: yes, no # Default: yes email_registration_confirmation = yes And from the security section of schema.py: # Assign the appropriate permissions to the anonymous user's Anonymous # Role. Choices here are: # - Allow anonymous users to register db.security.addPermissionToRole('Anonymous', 'Create', 'user') # Allow anonymous users access to view issues (and the related, linked # information) for cl in 'issue', 'file', 'msg', 'severity', 'status', 'resolution': db.security.addPermissionToRole('Anonymous', 'View', cl) On 3/21/07, Richard Jones wrote: > > Richard Jones added the comment: > > I just had a look at the spam entry mentioned at the start of this issue (1002) > and unfortunately it looks like the user record has been expired as I can't find > out more detail. > > Does the tracker currently accept anonymous email submissions? > > It would seem that's the most likely vector for this submission since the > incoming mail address is out in the wild. > > _______________________________________________________ > Meta Tracker > > _______________________________________________________ > _______________________________________________ > Tracker-discuss mailing list > Tracker-discuss at python.org > http://mail.python.org/mailman/listinfo/tracker-discuss > _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 02:17:56 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Thu, 22 Mar 2007 01:17:56 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> Skip Montanaro added the comment: I'm happy to take a stab at trying my SpamBayes submission filter. I have no idea how to get at the Roundup code or how to deal with the website user interface. Pointers appreciated. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From martin at v.loewis.de Thu Mar 22 07:49:45 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Thu, 22 Mar 2007 07:49:45 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> References: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> Message-ID: <46022709.7080807@v.loewis.de> > I'm happy to take a stab at trying my SpamBayes submission filter. I have no idea > how to get at the Roundup code or how to deal with the website user interface. > Pointers appreciated. http://svn.python.org/projects/tracker/ The learning curve for hacking roundup is pretty high. Martin From metatracker at psf.upfronthosting.co.za Thu Mar 22 07:49:51 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 06:49:51 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> Message-ID: <46022709.7080807@v.loewis.de> Martin v. L?wis added the comment: > I'm happy to take a stab at trying my SpamBayes submission filter. I have no idea > how to get at the Roundup code or how to deal with the website user interface. > Pointers appreciated. http://svn.python.org/projects/tracker/ The learning curve for hacking roundup is pretty high. Martin _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 07:57:29 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 06:57:29 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174546649.23.0.991467817933.issue105@psf.upfronthosting.co.za> Martin v. L?wis added the comment: More spam: somebody (gohger at rabidturtle.com) posted a follow-up to issue1000. The user was created at 2007-03-22 05:34:19, the posting was made at 2007-03-22 05:38:04. I'd like to know whether my code would have prevented him from registering. _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 08:05:16 2007 From: metatracker at psf.upfronthosting.co.za (Izak Burger) Date: Thu, 22 Mar 2007 07:05:16 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: Message-ID: <46022A91.7070005@upfrontsystems.co.za> Izak Burger added the comment: Richard Jones wrote: > On the email side the best thing to do would be to disallow email > access for anonymous users. This is already the case, quite a bit of spam bounces to the postmaster address because the sender is not a registered user. This is instead a case where someone specifically creates an account, ie similar to wiki spam. We've found that spammers adapt whenever you put in simple measures (like form trickery). Not sure how to get arround that one, I particularly like the two step idea of 1) Find spammers, and 2) break fingers. Not very executable though :-) Cheers, Izak _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 08:46:52 2007 From: metatracker at psf.upfronthosting.co.za (Izak Burger) Date: Thu, 22 Mar 2007 07:46:52 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: Message-ID: <46023466.6010509@upfrontsystems.co.za> Izak Burger added the comment: Paul Dubois wrote: > It is important in my mind that this discussion not focus just on the > "issues" and messages, since it is only a rogue user that can cause > trouble. If no rogue users get registered, no trouble. And a rogue > user can cause other trouble, not just spam. Agreed. Something else I felt I should mention is that rogue users can also harvest email addresses. I see this sort of thing on the debian bugtracker: I accidentally posted a bug report from the wrong email account a couple of months ago and almost immediately started receiving spam on that address. Just another reason to keep them out. _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 09:03:26 2007 From: metatracker at psf.upfronthosting.co.za (Georg Brandl) Date: Thu, 22 Mar 2007 08:03:26 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174546649.23.0.991467817933.issue105@psf.upfronthosting.co.za> Message-ID: <4602384C.4070703@gmx.net> Georg Brandl added the comment: Martin v. L?wis schrieb: > Martin v. L?wis added the comment: > > More spam: somebody (gohger at rabidturtle.com) posted a follow-up to issue1000. The > user was created at 2007-03-22 05:34:19, the posting was made at 2007-03-22 > 05:38:04. I'd like to know whether my code would have prevented him from > registering. I really think it would help to manually review user registration requests. There shouldn't be too many of them (perhaps at the beginning), and it's really important, as Paul said, that there are no "rogue" users registered. Perhaps we should send a message to users trying to register "to complete registration, please answer to this message, stating why you want to use the tracker (this is to prevent spam)". _______________________________________________________ Meta Tracker _______________________________________________________ From martin at v.loewis.de Thu Mar 22 09:34:59 2007 From: martin at v.loewis.de (=?UTF-8?B?Ik1hcnRpbiB2LiBMw7Z3aXMi?=) Date: Thu, 22 Mar 2007 09:34:59 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <4602384C.4070703@gmx.net> References: <4602384C.4070703@gmx.net> Message-ID: <46023FB3.3080900@v.loewis.de> > I really think it would help to manually review user registration requests. > There shouldn't be too many of them (perhaps at the beginning), and it's really > important, as Paul said, that there are no "rogue" users registered. > > Perhaps we should send a message to users trying to register "to complete > registration, please answer to this message, stating why you want to use the > tracker (this is to prevent spam)". I don't think there should be a manual review of tracker registrations, because that will shy away users trying to contribute. Response to registrations must be really quick. I'd still like to see my patch tried out which prevents registrations if the form submission comes too quickly. If that turns out to fail, I would upgrade to a CAPTCHA for user registration. If that still fails (which I consider unlikely), I'd propose a procedure where users get registered, can add their issues, but they don't get published until a project member has cleared the registration. This will complicate the workflow quite a lot, so I would only consider this if all else fails. I can never agree to a process that makes the prospective submitter wait until the registration is cleared before he can submit contributions. Regards, Martin From metatracker at psf.upfronthosting.co.za Thu Mar 22 09:35:03 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 08:35:03 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <4602384C.4070703@gmx.net> Message-ID: <46023FB3.3080900@v.loewis.de> Martin v. L?wis added the comment: > I really think it would help to manually review user registration requests. > There shouldn't be too many of them (perhaps at the beginning), and it's really > important, as Paul said, that there are no "rogue" users registered. > > Perhaps we should send a message to users trying to register "to complete > registration, please answer to this message, stating why you want to use the > tracker (this is to prevent spam)". I don't think there should be a manual review of tracker registrations, because that will shy away users trying to contribute. Response to registrations must be really quick. I'd still like to see my patch tried out which prevents registrations if the form submission comes too quickly. If that turns out to fail, I would upgrade to a CAPTCHA for user registration. If that still fails (which I consider unlikely), I'd propose a procedure where users get registered, can add their issues, but they don't get published until a project member has cleared the registration. This will complicate the workflow quite a lot, so I would only consider this if all else fails. I can never agree to a process that makes the prospective submitter wait until the registration is cleared before he can submit contributions. Regards, Martin _______________________________________________________ Meta Tracker _______________________________________________________ From skip at pobox.com Thu Mar 22 14:18:15 2007 From: skip at pobox.com (skip at pobox.com) Date: Thu, 22 Mar 2007 08:18:15 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <46023FB3.3080900@v.loewis.de> References: <4602384C.4070703@gmx.net> <46023FB3.3080900@v.loewis.de> Message-ID: <17922.33303.54985.480579@montanaro.dyndns.org> Martin> I'd still like to see my patch tried out which prevents Martin> registrations if the form submission comes too quickly. If that Martin> turns out to fail, I would upgrade to a CAPTCHA for user Martin> registration. I was thinking of using a CAPTCHA for the Mojam/Musi-Cal submission forms before I settled on the SpamBayes solution. I asked about them on python-list (I hadn't heard the CAPTCHA acronym at that point): http://groups.google.com/group/comp.lang.python/browse_thread/thread/6faccd251f672a49/54091a660f4b6fc0?lnk=st&q=random+image+text+generation&rnum=1 Steve D'Aprano's and Ben Finney's replies refer to limitations with CAPTCHAs. From my perspective the SpamBayes fix was simpler because I could make changes to just one place in my code and not have to edit multiple submission forms and their call entry points to add extra parameters. Skip From metatracker at psf.upfronthosting.co.za Thu Mar 22 14:18:21 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Thu, 22 Mar 2007 13:18:21 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <46023FB3.3080900@v.loewis.de> Message-ID: <17922.33303.54985.480579@montanaro.dyndns.org> Skip Montanaro added the comment: Martin> I'd still like to see my patch tried out which prevents Martin> registrations if the form submission comes too quickly. If that Martin> turns out to fail, I would upgrade to a CAPTCHA for user Martin> registration. I was thinking of using a CAPTCHA for the Mojam/Musi-Cal submission forms before I settled on the SpamBayes solution. I asked about them on python-list (I hadn't heard the CAPTCHA acronym at that point): http://groups.google.com/group/comp.lang.python/browse_thread/thread/6faccd251f672a49/54091a660f4b6fc0?lnk=st&q=random+image+text+generation&rnum=1 Steve D'Aprano's and Ben Finney's replies refer to limitations with CAPTCHAs. From my perspective the SpamBayes fix was simpler because I could make changes to just one place in my code and not have to edit multiple submission forms and their call entry points to add extra parameters. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 17:34:41 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 16:34:41 -0000 Subject: [Tracker-discuss] [issue98] Load problems? Message-ID: <1174581281.16.0.633586759051.issue98@psf.upfronthosting.co.za> Martin v. L?wis added the comment: Closing as fixed, then. Thanks for the analysis. ---------- status: chatting -> resolved ______________________________________________________ Meta Tracker ______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 17:36:11 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 16:36:11 -0000 Subject: [Tracker-discuss] [issue108] Break long lines Message-ID: <1174581371.4.0.169482822336.issue108@psf.upfronthosting.co.za> New submission from Martin v. L?wis: Please make the message display break long lines. Attached is the patch that achieves that for me, in Safari. ---------- messages: 533 nosy: loewis priority: urgent status: unread title: Break long lines _______________________________________________________ Meta Tracker _______________________________________________________ From seefeld at sympatico.ca Thu Mar 22 17:41:22 2007 From: seefeld at sympatico.ca (Stefan Seefeld) Date: Thu, 22 Mar 2007 12:41:22 -0400 Subject: [Tracker-discuss] [issue108] Break long lines In-Reply-To: <1174581371.4.0.169482822336.issue108@psf.upfronthosting.co.za> References: <1174581371.4.0.169482822336.issue108@psf.upfronthosting.co.za> Message-ID: <4602B1B2.3000903@sympatico.ca> Martin v. L?wis wrote: > Please make the message display break long lines. Attached is the patch that > achieves that for me, in Safari. Sorry, I can't see any attachment. -- ...ich hab' noch einen Koffer in Berlin... From metatracker at psf.upfronthosting.co.za Thu Mar 22 17:41:33 2007 From: metatracker at psf.upfronthosting.co.za (Stefan Seefeld) Date: Thu, 22 Mar 2007 16:41:33 -0000 Subject: [Tracker-discuss] [issue108] Break long lines In-Reply-To: <1174581371.4.0.169482822336.issue108@psf.upfronthosting.co.za> Message-ID: <4602B1B2.3000903@sympatico.ca> Stefan Seefeld added the comment: Martin v. L?wis wrote: > Please make the message display break long lines. Attached is the patch that > achieves that for me, in Safari. Sorry, I can't see any attachment. -- ...ich hab' noch einen Koffer in Berlin... ---------- status: unread -> chatting _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Thu Mar 22 19:36:34 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Thu, 22 Mar 2007 18:36:34 -0000 Subject: [Tracker-discuss] [issue108] Break long lines Message-ID: <1174588594.67.0.11243896226.issue108@psf.upfronthosting.co.za> Martin v. L?wis added the comment: Not sure what happened - it is attached now. _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Fri Mar 23 02:15:30 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Fri, 23 Mar 2007 01:15:30 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> Message-ID: <200703231215.19936.richard@commonground.com.au> Richard Jones added the comment: On Thu, 22 Mar 2007, Skip Montanaro wrote: > I'm happy to take a stab at trying my SpamBayes submission filter. I have > no idea how to get at the Roundup code or how to deal with the website user > interface. Pointers appreciated. The only existing information I have is in the Roundup wiki: http://www.mechanicalcat.net/tech/roundup/wiki/AntiSpam In slightly more concrete terms, you would have to make three modifications: 1. Pass all incoming email through spambayes to score it. I don't know enough about spambayes to really say, but I guess the simplest approach here would be to write a custom incoming-mail script that combines a spambayes scorer and a Roundup mail gateway. Both would be relatively simple scripts. I've included a sketch of that below. 2. Add a "score" attribute onto the msg class attached to issues. This is a simple edit of the tracker's schema.py 3. Add a new web action that allows you to train UNSURE mail as HAM or SPAM. See the Roundup customisation doc for info about writing new actions, and there's also a bunch of examples in the Roundup wiki. Please don't hesitate to ask further questions here or on the roundup-users mailing list. Richard def process_mail(): # obtain a message (as a string) -- maybe re-purpose some code from # roundup.mailgw? message = obtain_mail() # faked command-line args args = [] # score with spambayes # store the score on the message in the tracker score = spambayes.score(message) if score is in the SPAM range: return else: args.append(('-S', 'score=%s'%score)) # open tracker import roundup.instance instance = roundup.instance.open(instance_home) db = instance.open('admin') handler = mailgw.MailGW(instance, db, args) handler.main(message) handler.db.close() _______________________________________________________ Meta Tracker _______________________________________________________ From skip at pobox.com Thu Mar 22 19:33:37 2007 From: skip at pobox.com (skip at pobox.com) Date: Thu, 22 Mar 2007 13:33:37 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <46022709.7080807@v.loewis.de> References: <1174526276.19.0.874068353673.issue105@psf.upfronthosting.co.za> <46022709.7080807@v.loewis.de> Message-ID: <17922.52225.440002.30700@montanaro.dyndns.org> Martin> The learning curve for hacking roundup is pretty high. That's unfortunate. Any tips? Cheat sheet, perhaps? Skip From metatracker at psf.upfronthosting.co.za Fri Mar 23 15:10:14 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Fri, 23 Mar 2007 14:10:14 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <46022709.7080807@v.loewis.de> Message-ID: <17922.52225.440002.30700@montanaro.dyndns.org> Skip Montanaro added the comment: Martin> The learning curve for hacking roundup is pretty high. That's unfortunate. Any tips? Cheat sheet, perhaps? Skip _______________________________________________________ Meta Tracker _______________________________________________________ From martin at v.loewis.de Fri Mar 23 16:36:09 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Fri, 23 Mar 2007 16:36:09 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <17922.52225.440002.30700@montanaro.dyndns.org> References: <17922.52225.440002.30700@montanaro.dyndns.org> Message-ID: <4603F3E9.9070004@v.loewis.de> > Martin> The learning curve for hacking roundup is pretty high. > > That's unfortunate. Any tips? Cheat sheet, perhaps? No - it just takes time to get used to it. I guess you can ask on the roundup mailing list. However, do try installing it first, and see for yourself. Regards, Martin From metatracker at psf.upfronthosting.co.za Fri Mar 23 23:28:13 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Fri, 23 Mar 2007 22:28:13 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174688893.91.0.319144898466.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: Did my post not help at all? _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 00:53:12 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Fri, 23 Mar 2007 23:53:12 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174688893.91.0.319144898466.issue105@psf.upfronthosting.co.za> Message-ID: <17924.26724.488990.122359@montanaro.dyndns.org> Skip Montanaro added the comment: Richard> Richard Jones added the comment: Richard> Did my post not help at all? I haven't really had a chance to look into it yet. I'll start working on it this weekend. Based on Martin's four-second delta-t patch I don't think it will be all that hard. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From martin at v.loewis.de Sat Mar 24 10:37:16 2007 From: martin at v.loewis.de (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?=) Date: Sat, 24 Mar 2007 10:37:16 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174688893.91.0.319144898466.issue105@psf.upfronthosting.co.za> References: <1174688893.91.0.319144898466.issue105@psf.upfronthosting.co.za> Message-ID: <4604F14C.90501@v.loewis.de> > Did my post not help at all? Re 1 (incoming email): Probably not a problem in the first place; I believe that all spam is coming in entirely through the Web. As for 2/3 (scoring each message): I think this is relevant for Skip's project, although we also get spam consisting entirely of file attachements, e.g. http://bugs.python.org/issue1014 So I would suppose the same approach needs to be applied to files as well. Regards, Martin From metatracker at psf.upfronthosting.co.za Sat Mar 24 10:37:19 2007 From: metatracker at psf.upfronthosting.co.za (=?utf-8?q?Martin_v._L=C3=B6wis?=) Date: Sat, 24 Mar 2007 09:37:19 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174688893.91.0.319144898466.issue105@psf.upfronthosting.co.za> Message-ID: <4604F14C.90501@v.loewis.de> Martin v. L?wis added the comment: > Did my post not help at all? Re 1 (incoming email): Probably not a problem in the first place; I believe that all spam is coming in entirely through the Web. As for 2/3 (scoring each message): I think this is relevant for Skip's project, although we also get spam consisting entirely of file attachements, e.g. http://bugs.python.org/issue1014 So I would suppose the same approach needs to be applied to files as well. Regards, Martin _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 19:07:02 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 18:07:02 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174759622.52.0.487603445844.issue105@psf.upfronthosting.co.za> Skip Montanaro added the comment: (Aside: Is it just me or are the roundup issue pages *way* too wide?) Regarding Richad's three points: 1. Like Martin said, email isn't a problem. If it becomes a problem just put the usual SpamBayes filter in place like the rest of the python.org mailing lists do. 2. Doesn't seem too hard. 3. In addition to training unsure as ham or spam you have to be able to also train ham as spam and spam as ham in case they are incorrectly classified. A delete button available to admins would also be helpful. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 20:30:22 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 19:30:22 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174764622.73.0.463281951233.issue105@psf.upfronthosting.co.za> Skip Montanaro added the comment: Richard> ... there's also a bunch of examples in the Roundup wiki Richard, I'm sorry, but I don't see anything that looks like a new action on the Roundup Wiki. Can you point me to a specific example? Thx, Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 21:17:45 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 20:17:45 -0000 Subject: [Tracker-discuss] [issue108] Break long lines Message-ID: <1174767465.45.0.716837369693.issue108@psf.upfronthosting.co.za> Erik Forsberg added the comment: Browsers.. *sigh* I thought I had this problem covered by use of the method on http://myy.helia.fi/~karte/pre-wrap-css3-mozilla-opera-ie.html, but Safari seems to be an exception. Patch applied. ---------- assignedto: -> forsberg nosy: +forsberg status: chatting -> resolved _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 21:31:04 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 20:31:04 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174759622.52.0.487603445844.issue105@psf.upfronthosting.co.za> (Skip Montanaro's message of "Sat, 24 Mar 2007 18:07:02 -0000") Message-ID: <87ps6ybczd.fsf@uterus.efod.se> Erik Forsberg added the comment: Skip Montanaro writes: > Skip Montanaro added the comment: > > (Aside: Is it just me or are the roundup issue pages *way* too wide?) Are you by any chance running Safari? If so, does the problem still persist? I just applied Martin's patch for issue108. Rgds, \EF -- Erik Forsberg http://efod.se GPG/PGP Key: 1024D/0BAC89D9 _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 21:44:38 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 20:44:38 -0000 Subject: [Tracker-discuss] [issue107] Mention SF account recovery in a reasonable place Message-ID: <1174769078.07.0.170141048504.issue107@psf.upfronthosting.co.za> Erik Forsberg added the comment: Done. Please review the information added. If you find that the information can be formulated in a better way, feel free to modify the text in svn (it's in tracker/instances/python-dev/html/user.register.html. ---------- assignedto: -> forsberg nosy: +forsberg status: unread -> resolved _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 21:48:26 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 20:48:26 -0000 Subject: [Tracker-discuss] [issue106] Change Help link to wiki docs Message-ID: <1174769306.25.0.887977928199.issue106@psf.upfronthosting.co.za> Erik Forsberg added the comment: Fixed by modifying tracker/instances/python-dev/html/page.html. ---------- assignedto: -> forsberg nosy: +forsberg status: unread -> resolved _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 22:19:25 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 21:19:25 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <87ps6ybczd.fsf@uterus.efod.se> Message-ID: <17925.38362.301833.154278@montanaro.dyndns.org> Skip Montanaro added the comment: >> (Aside: Is it just me or are the roundup issue pages *way* too wide?) Erik> Are you by any chance running Safari? If so, does the problem Erik> still persist? I just applied Martin's patch for issue108. Yes, I do use Safari. Issue 95 and Issue 101 looks okay now. Issue 105 is still very wide. In Issue 101 the various fields are fairly near together: msg492 (view) Author: gbrandl Date: 2007-03-15.18:07:45 while in Issue 105 the Date and items are off the right edge. I emptied my browser's cache. No improvement. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 22:22:37 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 21:22:37 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174771357.8.0.592403747143.issue105@psf.upfronthosting.co.za> Erik Forsberg added the comment: I agree that dealing with spam is important, and that we need some kind of solution before going live. However, I do not want this to be a blocker issue delaying the transition too long. Therefore, I suggest that we apply loewis "4 second form generation" patch (very interesting and simple idea, btw) now, and set the priority of this issue to 'feature', which means that we no longer consider it a blocker, but rather something that should be done as soon as possible to fight spam in a way that works even if the spambots start to fill forms slowly.. :-) Anybody against this solution? If so, please re-set the priority of this issue. Assigning to Skip, as he seems to be the Spambayes master :-). I've applied the "4 second delay" patch to http://bugs.python.org and restarted roundup. I've also retired the existing spam issues which means they will not appear on the frontpage nor in searches (but can be accessed via direct URL). This I did using the commandline tool. ---------- assignedto: -> montanaro priority: bug -> feature _______________________________________________________ Meta Tracker _______________________________________________________ From forsberg at efod.se Sat Mar 24 22:26:18 2007 From: forsberg at efod.se (Erik Forsberg) Date: Sat, 24 Mar 2007 22:26:18 +0100 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <17925.38362.301833.154278@montanaro.dyndns.org> (Skip Montanaro's message of "Sat, 24 Mar 2007 21:19:25 -0000") References: <17925.38362.301833.154278@montanaro.dyndns.org> Message-ID: <87k5x6baf9.fsf@uterus.efod.se> Skip Montanaro writes: >>> (Aside: Is it just me or are the roundup issue pages *way* too wide?) > > Erik> Are you by any chance running Safari? If so, does the problem > Erik> still persist? I just applied Martin's patch for issue108. > > Yes, I do use Safari. Issue 95 and Issue 101 looks okay now. Issue 105 is > still very wide. In Issue 101 the various fields are fairly near together: > > msg492 (view) Author: gbrandl Date: 2007-03-15.18:07:45 > > while in Issue 105 the Date and items are off the right edge. I > emptied my browser's cache. No improvement. Sorry, I forgot that the stylesheet changes were only applied on bugs.python.org, not on the meta tracker. I've fixed the meta tracker now, so please try again. \EF -- Erik Forsberg http://efod.se GPG/PGP Key: 1024D/0BAC89D9 From skip at pobox.com Sat Mar 24 22:28:32 2007 From: skip at pobox.com (skip at pobox.com) Date: Sat, 24 Mar 2007 16:28:32 -0500 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <87k5x6baf9.fsf@uterus.efod.se> References: <17925.38362.301833.154278@montanaro.dyndns.org> <87k5x6baf9.fsf@uterus.efod.se> Message-ID: <17925.38912.729134.612371@montanaro.dyndns.org> EF> Sorry, I forgot that the stylesheet changes were only applied on EF> bugs.python.org, not on the meta tracker. I've fixed the meta EF> tracker now, so please try again. Yup, looks good now. Skip From metatracker at psf.upfronthosting.co.za Sat Mar 24 22:32:26 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 21:32:26 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174771357.8.0.592403747143.issue105@psf.upfronthosting.co.za> Message-ID: <17925.39143.809771.553602@montanaro.dyndns.org> Skip Montanaro added the comment: Erik> .... I suggest that we ... set the priority of this issue to Erik> 'feature', which means that we no longer consider it a blocker ... Sounds good to me. Erik> Assigning to Skip, as he seems to be the Spambayes master :-). Thanks, I'll keep plugging away at this. Erik> I've applied the "4 second delay" patch to http://bugs.python.org Erik> and restarted roundup. I've also retired the existing spam issues Erik> which means they will not appear on the frontpage nor in searches Erik> (but can be accessed via direct URL). This I did using the Erik> commandline tool. Is there any content in them I might be interested in? If so, is there a way I can locate them? Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 22:36:02 2007 From: metatracker at psf.upfronthosting.co.za (Erik Forsberg) Date: Sat, 24 Mar 2007 21:36:02 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <17925.39143.809771.553602@montanaro.dyndns.org> (Skip Montanaro's message of "Sat, 24 Mar 2007 21:32:26 -0000") Message-ID: <87ps6y9vem.fsf@uterus.efod.se> Erik Forsberg added the comment: Skip Montanaro writes: > Is there any content in them I might be interested in? If so, is there a > way I can locate them? I retired the following issues: issue1020,issue2019,issue1021,issue1018,issue1017,issue1016,issue1015,issue1014,issue112,issue1011,issue1010,issue1000,issue1009,issue1008,issue1006,issue1007,issue105,issue1004,issue1003,issue1012,issue1019,issue1013,issue1005,issue1022 You can access them by URL - http://bugs.python.org/issue \EF -- Erik Forsberg http://efod.se GPG/PGP Key: 1024D/0BAC89D9 _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 23:00:59 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 22:00:59 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174773659.32.0.0686368394569.issue105@psf.upfronthosting.co.za> Skip Montanaro added the comment: I'm still figuring out how this is going to work, however... I think we have two scenarios: 1. Creation of a questionable (unsure or spam) item. I believe we want to accept it though "hide" it much the way Erik just hid those various spam tracker items. If it's approved by an admin it gets added to the set of tickets used for retraining. 2. Addition of questionable comment or file to an otherwise okay ticket. I'm unsure how such inputs should be handled. I suppose you can just add them and notify the admins. Do the buttons show only for admins? Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 23:49:51 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Sat, 24 Mar 2007 22:49:51 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174776591.08.0.578694818591.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: Here's a simple idea: reject all messages with attachments of file type text/html. How often are those valid uploads to the Python bug tracker? _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 23:55:46 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Sat, 24 Mar 2007 22:55:46 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174776946.04.0.17120556109.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: Here's the code. This should probably be added immediately to prevent the current lot of spam. It could probably also be extended to include all "image/*" as well. from roundup.exceptions import Reject def reject_html(db, cl, nodeid, newvalues): if newvalues['type'] == 'text/html': raise Reject, 'not allowed' def init(db): db.file.audit('create', reject_html) _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sat Mar 24 23:59:31 2007 From: metatracker at psf.upfronthosting.co.za (Richard Jones) Date: Sat, 24 Mar 2007 22:59:31 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam Message-ID: <1174777171.64.0.742609139118.issue105@psf.upfronthosting.co.za> Richard Jones added the comment: A simple extension to avoid the other most likely spam avenue: from roundup.exceptions import Reject def reject_html(db, cl, nodeid, newvalues): if newvalues['type'] == 'text/html': raise Reject, 'not allowed' def reject_manylinks(db, cl, nodeid, newvalues): content = newvalues['content'] if content.count('http://') > 2: raise Reject, 'not allowed' def init(db): db.file.audit('create', reject_html) db.msg.audit('create', reject_manylinks) _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sun Mar 25 00:37:22 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 23:37:22 -0000 Subject: [Tracker-discuss] [issue105] Dealing with spam In-Reply-To: <1174776591.08.0.578694818591.issue105@psf.upfronthosting.co.za> Message-ID: <17925.46639.333333.668978@montanaro.dyndns.org> Skip Montanaro added the comment: Richard> Here's a simple idea: reject all messages with attachments of Richard> file type text/html. How often are those valid uploads to the Richard> Python bug tracker? I'm hoping to create a diff to vanilla Roundup and not make it specific to the Python tracker. Skip _______________________________________________________ Meta Tracker _______________________________________________________ From metatracker at psf.upfronthosting.co.za Sun Mar 25 00:42:20 2007 From: metatracker at psf.upfronthosting.co.za (Skip Montanaro) Date: Sat, 24 Mar 2007 23:42:20 -0000 Subject: [Tracker-discuss] [issue109] javascript injection? Message-ID: <1174779740.45.0.810645660882.issue109@psf.upfronthosting.co.za> New submission from Skip Montanaro: Passing this along from comp.lang.python. I don't know if it's different than the other problems we are already dealing with or not. Skip From: John Bokma Sender: python-list-bounces+skip=pobox.com at python.org To: python-list at python.org Subject: bugs.python.org has been compromised (urgent) Date: 24 Mar 2007 22:34:38 GMT X-Spambayes-Classification: ham; 0.07 Just got comment spam in: http:// bugs.py thon.org/file7722/order-cialis.html http:// bugs.py thon.org/file7722/order-cialis.html order cialis http:// bugs.py thon.org/file7723/order-tramadol.html order tramadol Seems someone found a nice hole in python.org and someone should be severely spanked for allowing for JavaScript injection: