Re-enabling account signup on Bugzilla

[Sam James]

Jonathan Wakely <jwakely.gcc@gmail.com> writes:

> On Sun, 11 Oct 2026 at 22:23, Sam James via Gcc <gcc@gcc.gnu.org> wrote:
>>
>> Hi,
>>
>> This has come up on IRC a few times. I think we should re-enable
>> self-account signup on Bugzilla.
>>
>> Andrea and I at least have seen people put off by having to email to get
>> an account and they end up just not filing a bug at all and only
>> complaining on social media, or not even that.
>
> Yes, this is a real problem. Another is that some people do try to
> request an account, and their request is just rejected by spamassassin
> or some other part of the infra, and we never receive the request
> email. Then they think we just ignored them, and they give up trying
> to report a bug. I don't know how often it happens, because not many
> people persist in trying to get an account.

100%.

>
>> I did volunteer along with Arsen to help with the account requests but I
>> don't believe this handles the problem in full. I myself have been put
>> off when I have to email to get an account on someone's self-hosted
>> gitlab.
>>
>> I already read most Bugzilla activity and I'm happy to tag comments as
>> spam and ban accounts.
>
> The reason we put the restrictions in place was that the attacks we
> got were too large and too fast for humans to handle. Hundreds of new
> bugs filed per minute, full of SEO spam. I would much rather prevent
> that from being filed rather than spend time cleaning it up later (we
> do have the contrib/mark_spam.py script to semi-automate marking
> entire bugs as spam).

OK, I didn't realise the volume was so bad. I agree we'll need at least
one measure then first.

>
>
>> On the Gentoo side, we have had similar problems but it's not too
>> bad. We have a Bugzilla extension [0] which bans URLs from new accounts for
>> 24 hours: we could possibly bring that over here but exempt some
>> sites like stackoverflow, standard reference sites, and godbolt.
>
> If we had that extension than I'd be happy to re-enable account
> registration. I don't think spammers would bother waiting 24h and
> coming back to post their links.


This one should be easy:
https://gitweb.gentoo.org/fork/bugzilla.git/tree/extensions/NewAcctAntiSpam

it doesn't currently take a whitelist but it would be trivial to extend
it to do so:
https://gitweb.gentoo.org/fork/bugzilla.git/tree/extensions/NewAcctAntiSpam/Extension.pm#n43

I can help the overseers get this done easily in an hour or two.

>
>> Another option would be to implement moderation in Bugzilla [1] which both
>> Bugzilla instances would benefit from. IMO neither of these should be
>> blockers to begin with, and we can revisit as we go if it turns out to
>> not work out.
>
> Allowing moderation so that bugs and comments from new accounts aren't
> visible until approved would be great, but I agree that doesn't need
> to be a blocker.
> I do think blocking URLs from new accounts should be considered a
> blocker though.

ACK.

>
>> [0] https://sourceware.org/PR32270
>> [1] https://public-inbox.gentoo.org/gentoo-dev/740788d08facacdd8766ec4c58c8d99e1b9ce0ae.camel@gentoo.org/T/#u
>>
>> thanks,
>> sam

sam
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 418 bytes
Desc: not available
URL: <https://gcc.gnu.org/pipermail/gcc/attachments/20261018/ff27f6de/attachment.sig>