I agree we should come up with a better technical way of dealing with this.
I recall some had come up, but I can’t remember what they are.
There is the usual captcha but those have a habit of not working well.
Even with real humans I’ve run into some who were clearly just SEO folks wanting to post ads on our sites.
There also seem to be quite a few people wanting accounts cause they confuse us with some other org or think they need an account to use QGIS software.
I haven’t figured out if it’s just some plugins asking for some sort of registration or what.
Note sure how to make it clear to these folks they don’t need one.
Trac is the least of our concerns in protecting.
The following things require OSGeo LDAP account and I’d want to be careful about
QGIS plugin registration
Being able to set up a profile on osgeo.org
Being able to setup or edit a page on wiki.osgeo.org
Yes being able to post trac tickets
Being able to put files on nextcloud.osgeo.org
Translating using Weblate.osgeo.org
Logging into OSGeo servers – though granted that requires you being in a special group as well.
Adding videos to video.osgeo.org
Being able to start a meeting on meet.osgeo.org
Regarding Jody’s comment I suppose we can setup at least a routine to trust all .edu and .gov addresses, cause those I just give them the mantra anyway without asking.
We could also just code discobot in discourse I think so that if a person has reached a certain level in discourse they will be granted the mantra if they ask or we preemptively give them the mantra at a certain level.
From: Jody Garnett jody.garnett@gmail.com
Sent: Thursday, September 26, 2024 7:50 PM
To: Even Rouault even.rouault@spatialys.com
Cc: System Administration Committee Discussion/OSGeo sac@lists.osgeo.org
Subject: Re: Mantra, mon joli mantra, dis moi qui est la plus belle ?
A popular alternative, and one available as a default in the discourse software we started using, is to trust email addresses from specific domains.
A university or employer email address would serve the same purpose: do we have someone we can contact about your behaviour if needful?
We could start by trusting domain names from osgeo partners (for example).
Such a thing would not help folks using hotmail or gmail, but it would be something.
Jody Garnett
On Sep 26, 2024 at 3:17:27 PM, Even Rouault <even.rouault@spatialys.com> wrote:
Hi,
at the risk of being perceived as a trouble maker, is there really
really no alternative to that … odd… (I highly edited my original
wording) OSGeo initiation custom?
I mean: if you add together all the hours volunteers are spending
repeating again and again the same question (“please share a link to a
public page”, et blabla et blabla), maybe a viable technical alternative
could have been found instead.
Or do we think that we are really doing “community bonding” by requiring
OSGeo incumbents to have to succeed in that step?
What are we trying to protect exactly? Spam to Trac wiki ? Well, easy,
let’s kill Trac wiki. Hint: I just did it to GDAL. Problem solved here.
Even
–
http://www.spatialys.com
My software is free, but my time generally not.