[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <56E17B10.1090800@igalia.com>
Date: Thu, 10 Mar 2016 14:48:00 +0100
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: oss-security@...ts.openwall.com
Subject: Re: RE: Concerns about CVE coverage shrinking - direct
impact to researchers/companies
On 10/03/16 07:23, Alan Coopersmith wrote:
> On 03/ 9/16 04:22 PM, Carlos Alberto Lopez Perez wrote:
>> On 06/03/16 19:46, Alan Coopersmith wrote:
>>> On 03/ 4/16 04:07 PM, Tim wrote:
>>>> * No moderation required. Let the public decide if they believe the
>>>> researcher or vendor. If a moderator does bother to look over the
>>>> content, they could deduplicate/link issues together and address
>>>> any
>>>> confusion, but beyond that, it isn't their job to decide what is a
>>>> vulnerability and what isn't.
>>>
>>> If the site displays *any* user-submitted text, you need at least enough
>>> moderation to filter out spammers & trolls.
>>>
>>
>> I don't think you need that level of moderation if you implement basic
>> measures against spammers like requiring the creation of an account with
>> e-mail verification.
>>
>> Just look to all the public bugzillas out there that allow commenting
>> (mozilla, webkit, redhat, gnome, etc). I don't think they have a problem
>> with spam. But you have to create an account first to do any comment.
>
> I'm one of the admins of the public bugzilla at bugs.freedesktop.org, and
> I've had to deal with spam there, and I've seen reports of spams in other
> public bugzillas for open source projects.
>
> github requires account creation as well, and I'm sure we've all seen out
> of control comment threads there that had to be locked down to stop abuse.
>
Then the next level is to require not only e-mail validation but also to
solve a captcha for creating a new account.
Or even harder, to require any account with less than 10 comments to
solve a captcha for any new comment. That way the annoyance for legit
users is temporal (up to the 10th comment), meanwhile for spammers is
not, because their account is probably going to be blocked before they
reach the 10th comment and have to start again with a new account.
I'm not saying that some level of moderation is required. Of course it
is. But I think that if proper antispam measures are implemented, then
the level of moderation required is relatively low, and can be done by
the bugzilla admins without much effort.
Download attachment "signature.asc" of type "application/pgp-signature" (884 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
