oss-sec mailing list archives
Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies
From: Tim <tim-security () sentinelchicken org>
Date: Thu, 10 Mar 2016 09:07:11 -0800
I'm one of the admins of the public bugzilla at bugs.freedesktop.org, and I've had to deal with spam there, and I've seen reports of spams in other public bugzillas for open source projects. github requires account creation as well, and I'm sure we've all seen out of control comment threads there that had to be locked down to stop abuse.Then the next level is to require not only e-mail validation but also to solve a captcha for creating a new account. Or even harder, to require any account with less than 10 comments to solve a captcha for any new comment. That way the annoyance for legit users is temporal (up to the 10th comment), meanwhile for spammers is not, because their account is probably going to be blocked before they reach the 10th comment and have to start again with a new account. I'm not saying that some level of moderation is required. Of course it is. But I think that if proper antispam measures are implemented, then the level of moderation required is relatively low, and can be done by the bugzilla admins without much effort.
Right, this is my thinking as well. If you create very high barriers to automated spamming, and protect against DDoS, then the level of manual spam should be low enough that minimal moderation would be required. Of course you could also start white listing people who have posted more than N approved comments, etc. And apply some bayesian filters on new postings from unknown people. It's all doable, and likely less work than what the CVE moderators have to do now. The hard work is building the system initially and finding a way to get enough volunteers involved for distributed hosting and moderation. tim
Current thread:
- RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies, (continued)
- RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Mike Prosser (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Adam Caudill (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Tim (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Zach W. (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies mark (Mar 05)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Larry Cashdollar (Mar 05)
- RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Mike Prosser (Mar 04)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Alan Coopersmith (Mar 06)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Carlos Alberto Lopez Perez (Mar 09)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Alan Coopersmith (Mar 09)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Carlos Alberto Lopez Perez (Mar 10)
- Re: RE: Concerns about CVE coverage shrinking - direct impact to researchers/companies Tim (Mar 10)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies Adam Caudill (Mar 05)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies Solar Designer (Mar 05)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies Tim (Mar 05)
- Re: Concerns about CVE coverage shrinking - direct impact to researchers/companies me (Mar 06)
- CVE Replacement Via Blockchains (was: Concerns about CVE coverage shrinking - direct impact to researchers/companies) Tim (Mar 07)