3 ms·

I work for an e-mail provider. This is very painful part of our work. Part of our services are free and ad supported. We are disabling, queueing thousands of ma

I work for an e-mail provider. This is very painful part of our work. Part of our services are free and ad supported. We are disabling, queueing thousands of mailboxes per day. Captchas and user scoring does not help that much. There are very cheap services were people manually will solve recaptchas/hcaptchas. Even required phone numbers (normal users are pissed when we ask for a phone number to use account fully but we don't have much choice...). There are phone number farms which are used for account verification also

jdsalaro 6y ago
> This is very painful part of our work GitLabSec team-member here, ^ this 100%. Our Trust and Safety team works really hard to keep up with spam. For those interested in how they do so, you can read more here[1]. We are also working on making our spam detection engine more effective at mitigating high-volume spam incidents such as this. For current, working product improvements to detect and mitigate spam you and others can check out MRs labeled "spam fighting"[2]. We've had quite a few internal conversations about strategies and best-practices. For more information on how to contact our Trust & Safety Team, including tips on how to deal with abuse in your own instance or steps to suggest spam/abuse related features, see our handbook[3] [1] https://about.gitlab.com/blog/2020/10/29/how-we-work-to-detect-and-mitigate-spam/ https://about.gitlab.com/blog/2020/10/29/how-we-work-to-dete... [2] https://gitlab.com/gitlab-org/gitlab/-/merge_requests?scope=all&utf8=%E2%9C%93&state=merged&label_name[]=spam%20fighting https://gitlab.com/gitlab-org/gitlab/-/merge_requests?scope=... [3] https://about.gitlab.com/handbook/engineering/security/security-operations/trustandsafety/#contact-us https://about.gitlab.com/handbook/engineering/security/secur....
- zoomablemind 6y ago
  Maybe introduce a Moderator role to the multi-user projects? That would require the project's moderator to clear the newly posted issues (whatever is possibly a spamming route there) before they propagate. As this is an additional friction point, some bad actors may be intercepted there (say, trying to clear a million issues at once or other equally ridiculous actions). Of course, by itself it won't stop someone from clearing a single issue to a million of "users". But may still help in id'ing such actors.

jdsalaro 6y ago

> This is very painful part of our work GitLabSec team-member here, ^ this 100%. Our Trust and Safety team works really hard to keep up with spam. For those interested in how they do so, you can read more here[1]. We are also working on making our spam detection engine more effective at mitigating high-volume spam incidents such as this. For current, working product improvements to detect and mitigate spam you and others can check out MRs labeled "spam fighting"[2]. We've had quite a few internal conversations about strategies and best-practices. For more information on how to contact our Trust & Safety Team, including tips on how to deal with abuse in your own instance or steps to suggest spam/abuse related features, see our handbook[3] [1] https://about.gitlab.com/blog/2020/10/29/how-we-work-to-detect-and-mitigate-spam/ https://about.gitlab.com/blog/2020/10/29/how-we-work-to-dete... [2] https://gitlab.com/gitlab-org/gitlab/-/merge_requests?scope=all&utf8=%E2%9C%93&state=merged&label_name[]=spam%20fighting https://gitlab.com/gitlab-org/gitlab/-/merge_requests?scope=... [3] https://about.gitlab.com/handbook/engineering/security/security-operations/trustandsafety/#contact-us https://about.gitlab.com/handbook/engineering/security/secur....

zoomablemind 6y ago
Maybe introduce a Moderator role to the multi-user projects? That would require the project's moderator to clear the newly posted issues (whatever is possibly a spamming route there) before they propagate. As this is an additional friction point, some bad actors may be intercepted there (say, trying to clear a million issues at once or other equally ridiculous actions). Of course, by itself it won't stop someone from clearing a single issue to a million of "users". But may still help in id'ing such actors.