[Bug web/72856] Trottle bug creation for newly created accounts (to limit spam)

["LpSolit at netscape dot net" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72856

--- Comment #4 from Frédéric Buclin <LpSolit at netscape dot net> ---
(In reply to Manuel López-Ibáñez from comment #3)
> I wonder about the effort required to do such a thing. Some of those emails
> seem fake, is there some kind of confirmation email for newly created
> accounts?

Yes. When a user requests a new account, an email is sent to that email
address, and the user must click on the link which is in the email to confirm
that 1) the email address is valid, and 2) it belongs to the user who wants to
create the bugzilla account. Clicking on this link will display a page where
the user must type his new password, and only after that is the bugzilla
account activated. It is not possible to create bugzilla accounts automatically
using the API (to prevent such problems).


> Limiting the number of bug reports per new account seems a good measure, but
> also easily circumvented as long as someone can create as many new users as
> they wish and each user stays below the limit.

I agree, that's a problem. But I think there isn't one single solution which
fixes all cases, but rather multiple solutions which, when combined together,
can give a reasonable level of spam prevention.