783262 - [tracker] Add rate limiting to protect us from spammers

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect)

Description

[Kadir Topal [:atopal]]

There are a number of places where spammers and other attackers can attack us by using site functionality. We have two goals with rate limiting:
1. Protect our KPI
2. Protect our users/contributors

1. Our KPIs are at based on the data collected from the site. Since we make decisions based on them we need to be able to rely on the validity of the data.

2. Even if no KPIs are affected a flooded thread, discussion forum or article history page can make the site unusable for users and contributors. 

For KPIs rate limit:
* number of questions per day
* number of KB helpful votes per day
* number of forum helpful votes per day

For protection of users/contributors
* number of KB revisions (new, edit, localization) per day
* number of answers per hour

Comment 1

[Kadir Topal [:atopal]]

For protection of users/contributors:
* number of support forum threads and replies per hour
* number of KB forum threads and replies per hour
* number of article forum threads and replies per hour

Comment 2

[Kadir Topal [:atopal]]

This was discussed further and notes are kept in https://etherpad.mozilla.org/sumo-rate-limiting

While this bug will be used as a tracker we'll spin off new bugs for individual items to be rate limited

Comment 3

[John Hesling [:John99] (NeedInfo me)]

(In reply to Kadir Topal [:atopal] from comment #2)
> This was discussed further and notes are kept in
> https://etherpad.mozilla.org/sumo-rate-limiting
> 
> While this bug will be used as a tracker we'll spin off new bugs for
> individual items to be rate limited

Do we need to consider rate limiting posting original questions. And if possible rate limiting account creation. Spammers actively exploit this. Detail added to etherpad.

Comment 4

[Kadir Topal [:atopal]]

Yeah, it makes sense to limit that too.

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

Q1 is in the past. Moving to the future.

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

Looks like are done here \o/