Bug 6429

Summary:	Find a way to allow people with GMail addresses to become contributors and report bugs
Product:	Infrastructure	Reporter:	Kamil Páral <kparal>
Component:	Bugzilla	Assignee:	Emmanuel Seyman <emmanuel>
Status:	NEW ---
Severity:	enhancement	CC:	kwizart, lxtnow
Priority:	P1
Version:	NA
Hardware:	x86_64
OS:	GNU/Linux
namespace:

Description Kamil Páral 2022-10-04 10:39:19 CEST

In multiple occasions, I've asked a user to report a bug against RPMFusion, and they said they can't register in order to file a bug. That's because RPMFusion Bugzilla bans GMail addresses, and of course 99% of users has those. The latest occurrence is here:
https://ask.fedoraproject.org/t/nvidia-powerd-service-and-related-boot-time-errors/26995/6

I believe this is a death sentence for RPMFusion, if nothing changes. Gradually, old timers will leave and newcomers will not flow in, because they're not allowed to register. RPMFusion Bugzilla will become a ghost town. When technically skilled and knowledgeable people give up on reporting bugs to RPMFusion, as in the example above, I believe the situation is very serious.

I know that spam is annoying, but please reconsider the current GMail ban. Is there some solution which can be taken from RH Bugzilla? Captcha? What about an alternative registration process which can be requested somewhere (a ticket in Gitlab/Pagure saying "I want to register in Bugzilla and my email is...")? Or replacing the whole Bugzilla with Gitlab or similar?

I'm sure there can be *something* done which is better than "Due to SPAM, gmail.com domain account are now disabled" error.

Thanks for consideration.

Comment 1 Nicolas Chauvet 2022-10-04 18:00:22 CEST

@Emmanuel.
Do we have a mean to use captcha or any other challenge in our bugzilla ?

Comment 2 Nicolas Chauvet 2022-10-04 18:04:30 CEST

@kamil
Please do your best not to use unneeded emphasis when reporting issue.

Comment 3 Emmanuel Seyman 2022-10-04 23:51:27 CEST

TLDR: There's no existing mechanism inside Bugzilla that does this. It might be worthwile to look at external software like Crowdsec...

The relevant log from the Bugzilla IRC channel:
19:01 < justdave[m]> ntp.org has exactly the same problem
19:03 < justdave[m]> BMO has a mechanism in place for users to report comments as spam, and 3 reports automatically locks out the offending account
19:03 < justdave[m]> BMO is also a high traffic site with enough people watching it to effectively keep up with that
19:07 < justdave[m]> Might be nice to have some sort of actual moderation system where you can set new accounts to be moderated and after you've seen enough to ensure they're real you can set a flag that unmoderates the user.
19:07 < justdave[m]> But then that requires you have someone to deal with the moderator queue
19:07 < justdave[m]> Which wouldn't be unlike moderating a mailing list or blog comments
19:47 < eseyman> I suspect RPMFusion could round up enough people for that to work

Comment 4 Nicolas Chauvet 2022-10-05 10:40:58 CEST

Another way would be to have OpenIDC/SAML2
https://bugzilla.rpmfusion.org/show_bug.cgi?id=4296

And to request a rpmfusion account for any bugzilla users.


But it's middle/long term, for the short term I will see if I can re-enable gmail on bugzilla/lists.

Comment 5 Kamil Páral 2022-10-05 14:40:49 CEST

I have no idea how many people register in rpmfusion bugzilla on average per month, but if that number is sufficiently low, I wonder if the manual registration process for gmail users could be the easiest solution. Perhaps creating 10 accounts per month manually would be a better tradeoff than dealing with 20+ or 100+ spam comments per month? (I have no idea about the actual numbers). All that is needed is some Pagure/Github/Gitlab/etc repo where people can open a ticket. (At the same time I do understand that anything requiring manual work is far from ideal).