1550406 - Automatically restrict comments after a certain number of spam/abusive etc tags

Status: NEW

(bugzilla.mozilla.org :: Extensions, enhancement)

Description

[Robert Longson [:longsonr]]

After a certain number of comments (3 perhaps?) have been tagged as spam/abusive etc should automatically restrict comments on that bug so bugs can't be permanent spam magnets.

See bug 358452 for something this would fix.

Comment 1

[Kohei Yoshino [:kohei]]

Another example reported on Slack: Bug 716579

Comment 2

[Wayne Mery (:wsmwk)]

bug 936509 handled the spam bits. But not "abuse" or other tags?

Comment 3

[David Lawrence [:dkl]]

(In reply to Wayne Mery (:wsmwk) from comment #2)

bug 936509 handled the spam bits. But not "abuse" or other tags?

Currently an account should be automatically deactivated if their comments get 3 or more tags for 'spam', 'abuse', or 'abusive'. We can look at making the tag names more configurable. I agree that it would be good if the comments are restricted once one or more users have been disabled.

Comment 4

[Bob Clary [:bc] (inactive)]

(In reply to Wayne Mery (:wsmwk) from comment #2)

bug 936509 handled the spam bits. But not "abuse" or other tags?

This bug was about restricting comments on a bug rather than disabling a spammer's account. I still see fairly frequent spam comments on old bugs some of which have many spam comments already. Bug 1394586 is a prime example.

If you don't want to automatically restrict comments based on a number of spam comments, then perhaps allowing users who are adding spam tags to a bug to also mark the bug restricted. The restriction could be either for all users or just for new users. Just for new users should be sufficient since the spammers would hopefully have been disabled before they graduated from "New to Bugzilla" status.

Comment 5

[Daniel Veditz [:dveditz]]

Looking at, for example, bug 463377 and bug 1394586 it appears the persistent spammers are well aware of the bug 936509 fix. The accounts involved were created and made just that one spam comment, or rarely two. From comment 0 here, bug 358452 suggests they had adapted to this by 2016 at the latest (that one spam comment was all that account ever did).

Given that adaptation, I would expect the same to happen to the "restrict comments after X spam comments". There are lots of bugs to spread into if that stops working.

I had imagined that some of the link spammers were pursuing a strategy of hitting the same bug repeatedly figuring they found a place where no one notices them, but https://bugzilla.mozilla.org/show_activity.cgi?id=1394586 shows that even when the comments are tagged spam within minutes and hours of being posted, the spammers kept hitting that one bug for a year and a half. I have no clue what they're doing.

==> alternate suggestion:

Restrict commenting to editbugs on ALL bugs 3-4 months after they are resolved.

• It shouldn't be immediate because we do want feedback on unexpected impacts of a fix
• a fix can take 2 months from landing on nightly to hitting Release (ignoring features that are held back)
• it can take at least two weeks to get uptake out to the people who don't browse much, and might browse some niche sites
• 3 months seems a pretty hard minimum. Longer gives more room for spammers to find success

Think of it as "Archiving" an issue. If a bug has been resolved for a while it's generally bad to keep commenting in that bug anyway. who's going reliably see it? The fix is baked in now so even a backout really needs a new bug. If there's a real problem people can file a new bug using the handy new/clone button to link the two, or they can go to https://support.mozilla.org/ and those helpful folks will be able to file a new bug if it's called for.

Of course that could drive link-spam into open bugs :-(

Comment 6

[Daniel Veditz [:dveditz]]

Glob pointed out my suggestion in comment 5 is pretty much bug 1196291, just a different set of reasons to reach that request.