Sysop: | Amessyroom |
---|---|
Location: | Fayetteville, NC |
Users: | 26 |
Nodes: | 6 (0 / 6) |
Uptime: | 60:51:49 |
Calls: | 481 |
Files: | 1,072 |
Messages: | 96,084 |
Debian has certainly done many things right in the past 30 years, but treatment of new contributors is currently pretty harsh, considering
how many cracks and false turns they need to overcome on to become
regular contributors.
I would first try to improve the Salsa registration process. I
understand the need to prevent recurrent abuse, but the current manual approval process with its delay and lack of feedback when things go
wrong is likely to discourage casual contributors, as what could have
been done in a few minutes now requires attention over multiple hours or days.
I would be worried about dropping the manual approval due to the sheer
volume of sophisticated automated spam account creation attacks on any
sort of authentication process with automatic sign-up.
Right now, we are in the enviable position where there is essentially no
spam via Salsa. I have seen what the level of spam looks like with an >automated sign-up process, and it would probably make me disable all of my >Salsa notifications, which would be a shame for other reasons. The only
way that companies like GitHub claw their way back from that is by having
a substantial anti-abuse team and a lot of constantly-tweaked automation
to detect and defeat spam. It is very, very easy for anything on the
Internet with public automated registration to immediately drown in SEO
spam.
Maybe there are more effective defenses than I am aware of (captcha
methods are definitely not sufficient in my experience) that we would fall >back on, and if the Salsa admins feel like this wouldn't be a problem, I >would definitely yield to their much greater experience. But it's real bad >out there in ways that I think the larger sites mostly hide because they
put a lot of resources into spam detection and prevention that we don't
have.
Debian has certainly done many things right in the past 30 years, but treatment of new contributors is currently pretty harsh, considering
how many cracks and false turns they need to overcome on to become
regular contributors.
The impact successive roadblocks can have on new contributors motivation
and retention is likely to be underestimated by many long-time
developers as a consequence of survivor bias.
I would first try to improve the Salsa registration process. I
understand the need to prevent recurrent abuse, but the current manual approval process with its delay and lack of feedback when things go
wrong is likely to discourage casual contributors, as what could have
been done in a few minutes now requires attention over multiple hours or days.
I would be worried about dropping the manual approval due to the sheer
volume of sophisticated automated spam account creation attacks on any
sort of authentication process with automatic sign-up.
THANKS. Indeed, it is annoying us a lot, Salsa users too, but anyone
sending us a quick email always receives a reply in due time. This
indeed is better than having bots spamming all of Salsa.
I like the invitation from a DD idea, that would avoid the pending
approval phase for a new account, but I have no clue how to implement
it.
I'm not suggesting that we simply drop manual approval, as I don't know
of any automated and accurate method that could be used to prevent such abuse.
I'm rather proposing giving all DDs the power to approve pending
requests, and giving all registered Debian contributors a way to
generate invitation links that would not require further manual approval
(iow these registrations would be "pre-approved" by the contributor generating the link, and they would be accountable in case of abuse). I believe this could help to reduce the approval delay in many cases.
Please do contribute this upstream, so we get it on our next upgrade !
The delay is only a part of the issue, the other part is the lack of feedback that would allow the user to know if her registration is
still
pending or has been rejected.
I like the invitation from a DD idea, that would avoid the pendingI would rather implement a dedicated UI on signup.salsa.d.o
approval phase for a new account, but I have no clue how to implement
it.
(gitlab-newuser) that would use GitLab's API to create and enable the
new account. Or maybe try to have something more integrated into
GitLab's registration UI, but I don't know if it's possible.