Process for new account requests

This is an OpenPGP/MIME signed message (RFC 4880 and 3156) ------enig2POCQRSKKCRFOPRCJONOK Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Thanks to Rydekull and dneary, we are now getting email for the new account requests to the wiki on ovirt.org. Yay! In the last few weeks, two of these accounts we approved have in fact been spammers. Boo! The problem I'm having is that we get new account requests from people and there is not enough information to tell at the beginning if it's a human or a bot. (Or a human spammer, which we can call bot for simplicity= =2E) Also, my attempts to figure out who is a human or not can lead to resisting or rejecting people who appear to come from generic domains, e.g qq.com or because of a sketchy bio. Sometimes I can tell the source email address seems to be professional, e.g. today it's http://axonpro.sk. Thus we introduce prejudice against individual contributors or people who use e.g. gmail.com instead, and cultural or linguistic bias against incomplete, inconsistent, or oddly worded bios. Some thoughts I've had for a process to follow when confirming an account= : * The email must be confirmed; that means that at least the address you see can receive account confirmation email. We aren't yet taking anonymous contributions, so having a way to reach out to people is a key to being a contributor. * Biography must not be nonsense; it's OK if it's a set of personal keywords, e.g. today we got "pmd85 commodore plus4 286 dos windows linux"= =2E ** FWIW, I think this is where the longer biography that we earlier shunned comes in useful - people have to write something real and appropriate, which is harder for a bot to do. ** Of course, the bio works against people for whom English is not a language they are very good writing in. (Thus, higher barriers due to language and/or culture.) * If there is anything suspicious looking or incomplete or otherwise just doesn't make you feel safe granting access, send email to the individual asking for more details to prove they are human. ** Is this idea a bit rude? I figure, if you are clear and concise it should be OK: "Hi, I'm checking from the oVirt wiki account system that you are really a human. We've been having trouble with wiki spam. Can you please tell me a bit more about your interest in oVirt?" Any other ideas or thoughts? Cheers - Karsten --=20 Karsten 'quaid' Wade, Sr. Analyst - Community Growth http://TheOpenSourceWay.org .^\ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 ------enig2POCQRSKKCRFOPRCJONOK Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" ------enig2POCQRSKKCRFOPRCJONOK--