Spammers are now closing bugs

Spammers are now closing bugs

[Glenn Morris]

As far I am aware, this:

http://emacsbugs.donarmstrong.com/cgi-bin/bugreport.cgi?msg=38;bug=1407

is the first instance of spam closing a bug.

I have to say again that the state of the bug tracker with regards to
spam accumulating in real bug reports is embarrassing.

Re: Spammers are now closing bugs

[Sven Joachim]

On 2009-04-19 21:20 +0200, Glenn Morris wrote:

> As far I am aware, this:
>
> http://emacsbugs.donarmstrong.com/cgi-bin/bugreport.cgi?msg=38;bug=1407
>
> is the first instance of spam closing a bug.

Note that this will only happen to bugs that had been closed (and
reopened) before, since this is necessary for the spammers to pick up
the nnnn-done address.  In Debian, this issue had been discussed many
times already, AFAICT without any solution.

> I have to say again that the state of the bug tracker with regards to
> spam accumulating in real bug reports is embarrassing.

I can only concur. :-(

Sven

Re: Spammers are now closing bugs

[Jason Rumney]

Sven Joachim wrote:
> On 2009-04-19 21:20 +0200, Glenn Morris wrote:
>
>   
>> As far I am aware, this:
>>
>> http://emacsbugs.donarmstrong.com/cgi-bin/bugreport.cgi?msg=38;bug=1407
>>
>> is the first instance of spam closing a bug.
>>     
>
> Note that this will only happen to bugs that had been closed (and
> reopened) before, since this is necessary for the spammers to pick up
> the nnnn-done address.  In Debian, this issue had been discussed many
> times already, AFAICT without any solution.
>   

There is a very simple solution. Restrict bug closure and other 
administrative tasks to people on a list of emacs contributors and the 
original submitter. It is not a perfect solution, but it should deal 
with the problem of random spammers.

Re: Spammers are now closing bugs

[Samuel Bronson]

On Sun, Apr 19, 2009 at 7:41 PM, Jason Rumney <jasonr@gnu.org> wrote:

> There is a very simple solution. Restrict bug closure and other
> administrative tasks to people on a list of emacs contributors and the
> original submitter. It is not a perfect solution, but it should deal with
> the problem of random spammers.

Another possibility would involve a confirmation code -- but that
would be kind of a pain for regular contributors, so should probably
be used as an additional validation method, not the only one.

Re: Spammers are now closing bugs

[Stefan Monnier]

>> There is a very simple solution. Restrict bug closure and other
>> administrative tasks to people on a list of emacs contributors and the
>> original submitter. It is not a perfect solution, but it should deal with
>> the problem of random spammers.
> Another possibility would involve a confirmation code -- but that
> would be kind of a pain for regular contributors, so should probably
> be used as an additional validation method, not the only one.

The incoming messages should be filtered the same way that messages to
emacs-devel get filtered (i.e. they need to be moderated).


        Stefan

Re: Spammers are now closing bugs

[Glenn Morris]

Sven Joachim wrote:

> Note that this will only happen to bugs that had been closed (and
> reopened) before, since this is necessary for the spammers to pick up
> the nnnn-done address.

Oh, I see.

Do they get the addresses from the bug web-pages?
I can't think of a single reason to have unobscured email addresses
visible on the bug web pages, as they are at present.

I see a spammer has just closed bug 1407 again.
How annoying for the person who opened this bug.

Re: Spammers are now closing bugs

[Glenn Morris]

Stefan Monnier wrote:

> The incoming messages should be filtered the same way that messages to
> emacs-devel get filtered (i.e. they need to be moderated).

The moderation must already be being done, but at the wrong point.

gnu-emacs-bug is moderated (many thanks to those who do so), and
almost no spam gets through to the list. All the spam that gets sent
to the bug tracker gets passed on to the bug list, but does not appear
there, so people must be moderating it out. But at this stage, it's
already entered the tracker.

The moderation step should be shifted to be _before_ things reach the
tracker, rather than after. (Though this found no favour the last time
I suggested it;
http://lists.gnu.org/archive/html/emacs-devel/2008-08/msg00889.html)

Re: Spammers are now closing bugs

[Sven Joachim]

On 2009-04-20 20:14 +0200, Glenn Morris wrote:

> Sven Joachim wrote:
>
>> Note that this will only happen to bugs that had been closed (and
>> reopened) before, since this is necessary for the spammers to pick up
>> the nnnn-done address.
>
> Oh, I see.
>
> Do they get the addresses from the bug web-pages?

I suspect so, although a few mailinglist archives may also have them.

> I can't think of a single reason to have unobscured email addresses
> visible on the bug web pages, as they are at present.

I concur, but for Debian the debbugs maintainers have always rejected
address obfuscation.  See http://bugs.debian.org/63995 and siblings.

> I see a spammer has just closed bug 1407 again.
> How annoying for the person who opened this bug.

He might not have the highest opinion of the Emacs bug tracker now, yes.

Sven

Re: Spammers are now closing bugs

[Glenn Morris]

Sven Joachim wrote:

>> I can't think of a single reason to have unobscured email addresses
>> visible on the bug web pages, as they are at present.
>
> I concur, but for Debian the debbugs maintainers have always rejected
> address obfuscation.  See http://bugs.debian.org/63995 and siblings.

I can't say I'm surprised, but I am disappointed.
GNU mailman gets this right.

Our only hope seems to be that when/if emacsbugs transits to a gnu
server, someone will be willing and able to modify the behaviour.

>> I see a spammer has just closed bug 1407 again.

BTW, I'm not going to reopen it, since it will just get closed again.

>> How annoying for the person who opened this bug.
>
> He might not have the highest opinion of the Emacs bug tracker now, yes.

He might not be alone.

Re: Spammers are now closing bugs

[Stefan Monnier]

>> The incoming messages should be filtered the same way that messages to
>> emacs-devel get filtered (i.e. they need to be moderated).
> The moderation must already be being done, but at the wrong point.

Indeed.


        Stefan

Re: Spammers are now closing bugs

[Stephen J. Turnbull]

Glenn Morris writes:

 > BTW, I'm not going to reopen it, since it will just get closed again.

Someone could open a new bug which explains the circumstance and
points to the old bug, and add information to the old bug pointing to
the new one.  A lot of effort for someone, but it would probably make
the OP feel loved.

Re: Spammers are now closing bugs

[Glenn Morris]

"Stephen J. Turnbull" wrote:

> Glenn Morris writes:
>
>  > BTW, I'm not going to reopen it, since it will just get closed again.
>
> Someone could open a new bug which explains the circumstance and
> points to the old bug, and add information to the old bug pointing to
> the new one.  A lot of effort for someone, but it would probably make
> the OP feel loved.

I already cloned it as bug 3061. It was not much effort, and I doubt
it spread any love.

I hope someone who can will fix the underlying problem.

Re: Spammers are now closing bugs

[Miles Bader]

Glenn Morris <rgm@gnu.org> writes:
> I hope someone who can will fix the underlying problem.

Kill all spammers?

-Miles

-- 
"Though they may have different meanings, the cries of 'Yeeeee-haw!' and
 'Allahu akbar!' are, in spirit, not actually all that different."

Re: Spammers are now closing bugs

[Alan Mackenzie]

Hi, Glenn,

On Mon, Apr 20, 2009 at 02:18:21PM -0400, Glenn Morris wrote:
> Stefan Monnier wrote:

> > The incoming messages should be filtered the same way that messages to
> > emacs-devel get filtered (i.e. they need to be moderated).

> The moderation must already be being done, but at the wrong point.

> gnu-emacs-bug is moderated (many thanks to those who do so), and
> almost no spam gets through to the list. All the spam that gets sent
> to the bug tracker gets passed on to the bug list, but does not appear
> there, so people must be moderating it out. But at this stage, it's
> already entered the tracker.

> The moderation step should be shifted to be _before_ things reach the
> tracker, rather than after. (Though this found no favour the last time
> I suggested it;
> http://lists.gnu.org/archive/html/emacs-devel/2008-08/msg00889.html)

I missed that thread last August.  The argument (from Eli) was that
having the bug-gnu-emacs moderators also moderate the bug tracker email
would be too much of a burden for them.  As one of the bug-gnu-emacs
moderators, I don't believe this would be the case.  To me, it is
scarcely more effort to moderate 10 messages than 1; indeed, finding only
1 message is an anti-climax, and finding none at all is a major let down.
;-).  At least one of my colleagues on b-g-e is super efficient, since I
rarely see much on the moderation page.

So, yes, let's moderate the bug-tracker.  How easy is this to set up?
What does Don say?

-- 
Alan Mackenzie (Nuremberg, Germany).

Re: Spammers are now closing bugs

[Glenn Morris]

Alan Mackenzie wrote:

> I missed that thread last August.  The argument (from Eli) was that
> having the bug-gnu-emacs moderators also moderate the bug tracker email
> would be too much of a burden for them.  As one of the bug-gnu-emacs
> moderators, I don't believe this would be the case.  To me, it is
> scarcely more effort to moderate 10 messages than 1; indeed, finding only
> 1 message is an anti-climax, and finding none at all is a major let down.

Thanks for being a moderator.

My point is, that unless I misunderstand how things work, the total
number of messages to be moderated would not change. All mail for
bug-gnu-emacs goes through emacsbugs first, which does some stuff,
then sends it all on to bug-gnu-emacs. So, you're already seeing all
the spam, just too late to stop it getting into emacsbugs.


In other words, I think the current setup is:

ham+spam            ham+spam            ham
------->  emacsbugs -------> moderators ---> bug-gnu-emacs


I'm suggesting moving the moderation step:

ham+spam            ham
-------> moderators ---> emacsbugs ---> bug-gnu-emacs



I have no idea if it is possible, or who could set it up.

Re: Spammers are now closing bugs

[Stephen J. Turnbull]

Glenn Morris writes:

 > In other words, I think the current setup is:
 > 
 > ham+spam            ham+spam            ham
 > ------->  emacsbugs -------> moderators ---> bug-gnu-emacs
 > 
 > 
 > I'm suggesting moving the moderation step:
 > 
 > ham+spam            ham
 > -------> moderators ---> emacsbugs ---> bug-gnu-emacs

That is not possible.  AIUI, bug-gnu-emacs is an open-post list.
Thus, this *would* double the burden, since the moderators would be
asked to moderate both lists.  (At least for Alan it would double,
since for him the cost is almost entirely in opening the moderation
page, and he'd have to do it once for each list.)

I don't see any way around this, because b-g-e needs to be open-post,
while I believe the BTS wants to see the bug posts before b-g-e does,
so that the b-g-e archives will have appropriate bug IDs.

The best I can think of is for Don to install Mailman, and have an
a router in his MTA that sends the bug posts to a single Mailman list,
where the moderation (and optionally other spamtrapping and content
filtering) is done.  This list would have one subscriber: Don's
debbugs for Emacs installation.  It would not accept nor deliver mail
off his site.

Re: Spammers are now closing bugs

[Eli Zaretskii]

> From: "Stephen J. Turnbull" <stephen@xemacs.org>
> Date: Wed, 22 Apr 2009 12:14:51 +0900
> Cc: Alan Mackenzie <acm@muc.de>, Stefan Monnier <monnier@IRO.UMontreal.CA>,
> 	Don Armstrong <don@donarmstrong.com>, emacs-devel@gnu.org
> 
> AIUI, bug-gnu-emacs is an open-post list.

No, it's moderated (as all GNU lists).

Re: Spammers are now closing bugs

[Glenn Morris]

Bug 753 (which is riddled with spam) has now been closed by spam.

Re: Spammers are now closing bugs

[Stephen J. Turnbull]

Glenn Morris writes:

 > Bug 753 (which is riddled with spam) has now been closed by spam.

Are you asking for volunteers to clean it up?  AFAICT, that's the only
reason emacs-devel needs to hear about this.

We know there's a problem, we know some ways to address it ... but Don
evidently doesn't consider them "solutions".  If you do, the answer is
to volunteer to implement them.  That is admittedly likely to be a big
job, as (unless Don is more free with accounts on his system than I
am) it probably involves migration to a GNU-maintained host.  I'm
certainly not willing to do it myself.

OTOH, the BTS with spam is better than we had before, no?

You-could-be-using-the-MacPorts-tracker-which-is-how-I-spell-pain-ly y'rs,