On 19/09/2019 16.54, Christian Imhorst wrote:

Hi,

I think this is a big issue, because if you visit connect.o.o it looks like a big mess and massive insecure. In this state you cannot want that someone should logon to this website and maybe it's a security risk.

Carlos, thank you for your cry to help. I don't think that you have any chance to fight the spam only with two people. I am willing to help but what can we do to clean connect.o.o from the spam and to make the plattform more secure? How can we seperate real users from spam bots? And how can we implement a 2FA?

We cannot leave connect.o.o in this state.

As far as I know, there is currently no spam in that platform. There are some attempts per day, but at least once a day we remove it, it just takes a few minutes. Of course, a spammer may be alive some hours. We do not remove them: instead the default action is "ban". The reasoning is that a removed user comes back, while a banned one has to create a new one with different name. Which means that their names remain visible, and some times the name itself is the spam action. You can click on those names, but no action happens. Examples: KSP Chartered Surveyors Area Dental Clinic IBC Carpentry ... But I'm worried most about real people writing private information there and spammers collecting it. If registration wouldn't be automatic, but had to be human reviewed first... Help is welcomed, but I think it is more important to replace it with something else. I do not participate in that, not my skill set. There was a thread about it months ago, and other people can fill you in on the current state of things. The basic requirement is hold a list of members, that's all. With some features. Not a friendship platform. -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.1 (Legolas))

On 20/09/2019 05.36, Fraser_Bell wrote:

On 9/19/19 1:14 AM, Carlos E. R. wrote:

Hi, Carlos:

As I recall, I had tried to get something going to get a replacement for Connect that would make a better, more secure Membership list for the purposes of votes and other openSUSE activities.

A couple of people started something, but nothing ever got anywhere. Without enough motivated help, and after an excruciating experience with the Elections and the Elections Committee (others were Ish and Edwin, who pulled their weight admirably) unable to get decent assistance with the last Board Elections, I was not about to go ahead with it on my own.

I decided to instead devote my time to my Recordings and subsequently dropped out of that failed attempt to replace Connect.

This is not aimed at you, I want to be clear, as you and another stepped up and have done a nice job at reducing the spam and similar activity, and I admire your resolve to help with that.

But, this would all be a moot point, now, if I had received the full assistance with the move away from Connect months ago.

Thanks for bringing this up, Carlos, as it *DOES* need to be addressed.

Thanks. I was rather hopping to move the membership procedure, perhaps with some urgency, to a limited distribution mail list, that the membership committee read. On the other hand, that becomes "not open" :-( -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.1 (Legolas))

On 20/09/2019 11.38, Simon Lees wrote:

...

I was rather hopping to move the membership procedure, perhaps with some urgency, to a limited distribution mail list, that the membership committee read. On the other hand, that becomes "not open" :-(

This is the longer term plan, but its also not the hard part, the harder part is storing the list of members usernames and email addresses in a manner that only the people who really need to access the data can access it.

What about making connect not admit new registrations automatically? But delayed by a human inspecting them? Let them register but only have access to their own profile, not published till after inspection. And yes, I do volunteer for that human inspector. I am already doing it, but after the fact. That would impede spammers getting access to email addresses. -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.1 (Legolas))

On 20/09/2019 12.20, Simon Lees wrote:

On 9/20/19 7:26 PM, Carlos E. R. wrote:

...

On 20/09/2019 11.38, Simon Lees wrote:

...

...

I was rather hopping to move the membership procedure, perhaps with some urgency, to a limited distribution mail list, that the membership committee read. On the other hand, that becomes "not open" :-(

This is the longer term plan, but its also not the hard part, the harder part is storing the list of members usernames and email addresses in a manner that only the people who really need to access the data can access it.

What about making connect not admit new registrations automatically? But delayed by a human inspecting them? Let them register but only have access to their own profile, not published till after inspection.

And yes, I do volunteer for that human inspector. I am already doing it, but after the fact.

That would impede spammers getting access to email addresses.

At this stage modifying connect to do anything different, especially given its using the same account system as all other openSUSE infra is almost certainly harder then writing its replacement.

The replacement has blocked, stopped. -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.1 (Legolas))

Le vendredi 20 septembre 2019 à 20:29 +0930, Simon Lees a écrit :

On 9/20/19 8:13 PM, Carlos E. R. wrote:

...

On 20/09/2019 12.20, Simon Lees wrote:

...

At this stage modifying connect to do anything different, especially given its using the same account system as all other openSUSE infra is almost certainly harder then writing its replacement.

The replacement has blocked, stopped.

Yep, and finding someone to work on connect would be even harder.

Carlos' suggestion from a few mails before was to simply move the membership procedure outside of connect (he gave the example of a restricted mailing list). We've been through that discussion a few months ago, there are solutions to handle the list of members without connect and without building a new tool. Some of them require manual management, most of them are not great, probably none of them are good for the long term. But I do believe they're still better than the current state of things. We do not have to stay with connect while we wait for people to step up and find a good long-term solution. Cheers, Vincent -- Les gens heureux ne sont pas pressés. -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

Le 20 septembre 2019 12:14:30 GMT+01:00, Vincent Untz a écrit :

Le vendredi 20 septembre 2019 à 20:29 +0930, Simon Lees a écrit :

...

On 9/20/19 8:13 PM, Carlos E. R. wrote:

...

On 20/09/2019 12.20, Simon Lees wrote:

...

At this stage modifying connect to do anything different, especially given its using the same account system as all other openSUSE infra is almost certainly harder then writing its replacement.

The replacement has blocked, stopped.

Yep, and finding someone to work on connect would be even harder.

Carlos' suggestion from a few mails before was to simply move the membership procedure outside of connect (he gave the example of a restricted mailing list).

We've been through that discussion a few months ago, there are solutions to handle the list of members without connect and without building a new tool. Some of them require manual management, most of them are not great, probably none of them are good for the long term. But I do believe they're still better than the current state of things.

We do not have to stay with connect while we wait for people to step up and find a good long-term solution.

Cheers,

Vincent

https://en.opensuse.org/openSUSE_talk:Membership_officials is the place to work. since February, little have been done. I keep thinking using "galette" is the best way, as this free software is easy to use and do exactly what we need, that is managing subscribers. any user can manage it's data. the user test session is still working, and I'm pretty sure I can have a free session for opensuse by a group that already gives one to my Linux user group. sent from Easdale island 😄, as I'm touring... -- Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté. -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 9/20/19 1:13 PM, Knurpht-openSUSE wrote:

jdd, that would be awesome. A bit off-topic: Could this be installed/ implemented in the openSUSE infra?

Not so off-topic, IMHO. Yes, this would be the ideal move, as all things like this going forward should be under full control of the Project/Community. -- -Gerry Makaro openSUSE Member openSUSE Contributor YaST Contributor aka Fraser_Bell on the Forums, OBS, IRC, and mail at openSUSE.org Fraser-Bell on Github -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 9/20/19 1:08 PM, jdd wrote:

Le 20 septembre 2019 12:14:30 GMT+01:00, Vincent Untz a écrit :

...

Le vendredi 20 septembre 2019 à 20:29 +0930, Simon Lees a écrit :

...

On 9/20/19 8:13 PM, Carlos E. R. wrote:

...

On 20/09/2019 12.20, Simon Lees wrote:

...

At this stage modifying connect to do anything different, especially given its using the same account system as all other openSUSE infra is almost certainly harder then writing its replacement.

The replacement has blocked, stopped.

Yep, and finding someone to work on connect would be even harder.

Carlos' suggestion from a few mails before was to simply move the membership procedure outside of connect (he gave the example of a restricted mailing list).

We've been through that discussion a few months ago, there are solutions to handle the list of members without connect and without building a new tool. Some of them require manual management, most of them are not great, probably none of them are good for the long term. But I do believe they're still better than the current state of things.

We do not have to stay with connect while we wait for people to step up and find a good long-term solution.

Cheers,

Vincent

https://en.opensuse.org/openSUSE_talk:Membership_officials

is the place to work. since February, little have been done. I keep thinking using "galette" is the best way, as this free software is easy to use and do exactly what we need, that is managing subscribers. any user can manage it's data. the user test session is still working, and I'm pretty sure I can have a free session for opensuse by a group that already gives one to my Linux user group.

sent from Easdale island 😄, as I'm touring...

Thanks, jdd. Maybe this can still get done. I know you (and a couple of others) put some work into it back then, but got very little feedback. As for me, at this time, I am about to start up the very early (pre-)stages of the next Board Elections, again along with Ish Sookun and Edwin Zakaria -- who have also confirmed this to me -- and with the help of anyone else willing to step up and help out. At the same time, I am in the middle of Recording and Releasing Singles and an upcoming Album, so a lot of time is tied up there. One caveat: Anyone else stepping up to help out with the elections absolutely *must* be prepared to commit to work on it, not just volunteer in order to get a badge on their shoulder, then sit back and let everyone else on the team do the work. But, the three of us certainly *would* appreciate any *real* help we can get. Edwin, Ish, and I hope to raise the bar even higher with this next Board Election. -- -Gerry Makaro openSUSE Member openSUSE Contributor YaST Contributor aka Fraser_Bell on the Forums, OBS, IRC, and mail at openSUSE.org Fraser-Bell on Github -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 9/23/19 10:08 AM, jdd@dodin.org wrote:

Le 21/09/2019 à 02:29, Fraser_Bell a écrit :

...

But, the three of us certainly *would* appreciate any *real* help we can get.

Edwin, Ish, and I hope to raise the bar even higher with this next Board Election.

of course, I can (co)manage an opensuse galette session if necessary, it's very little work :-)

jdd (returned :-)

That would be very much appreciated, jdd. We will keep you posted when we get into the planning stages. Thank you, -- -Gerry Makaro openSUSE Member openSUSE Contributor YaST Contributor aka Fraser_Bell on the Forums, OBS, IRC, and mail at openSUSE.org Fraser-Bell on Github -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org