[aur-dev] Fighting spam on the AUR

[Lukas Fleischer]

On Mon, Mar 18, 2013 at 01:33:54PM -0400, Daniel Wallace wrote:
> On Thu, Mar 14, 2013 at 10:33:39PM -0400, Dave Reisner wrote:
> > On Wed, Mar 13, 2013 at 11:33:18AM +0100, Lukas Fleischer wrote:
> > > Status quo:
> > > 
> > >     06:54 < gtmanfred> ok, it really is time for something else
> > >     06:54 < gtmanfred> the spammer is now creating a new account for
> > >     every comment and flag out of date
> > > 
> > > The account suspension feature does not help here.
> > > 
> > > Options:
> > > 
> > > * Allow package maintainers to block the "Flag package out-of-date"
> > >   feature for a certain amount of time. Note that this might eventually
> > >   cripple the "out-of-date" function. Also, this does not work for
> > >   comments.
> > > 
> > > * Use CAPTCHAs during account registration. We could either use MAPTCHAs
> > >   ("What is 1 + 1?") or something like reCAPTCHA [1].
> > > 
> > > * Moderate new accounts. Might be a lot of work. We need some TUs that
> > >   review and unlock accounts. Also, it might be hard to distinguish a
> > >   spam bot from a regular user. If we require a short application text,
> > >   this might result in less users joining the AUR.
> > > 
> > > * Block IP addresses. Bye-bye, Tor users!
> > 
> > Please just do this. We aren't dealing with some "spam epidemic" so much
> > as we are dealing with a small number of bored idiots who are hiding
> > behind Tor exit nodes.
> > 
> > > 
> > > Comments and suggestions welcome! We need to find a proper solution as
> > > soon as possible!
> > > 
> > > [1] http://www.google.com/recaptcha
> 
> PLEASE DO THIS
> 
> https://aur.archlinux.org/packages/
> 
> now he is vote spamming

I will take care of this today, as I already said before in another
reply.

> -- 
> Daniel Wallace
> Archlinux Trusted User (gtmanfred)
> Georgia Institute of Technology