-----BEGIN PGP SIGNED MESSAGE-----
On 01/25/2012 02:45 AM, Ewoud Kohl van Wijngaarden wrote:
On Wed, Jan 25, 2012 at 10:17:43AM +0200, Itamar Heim wrote:
> On 01/25/2012 06:03 AM, Karsten 'quaid' Wade wrote:
>> On 01/24/2012 03:40 PM, Ewoud Kohl van Wijngaarden wrote:
>>> I have no experience with mediawiki + openid myself, but
>>> maybe giving it a go and monitor it would be good enough for
>>> Possible downsides: - Spammers use openid to spam
>>> Possible upsides: - More open to new people - People can use
>>> a single account for both gerrit and the wiki
>>> Since the wiki edits are also shown on IRC I think spam would
>>> be caught fast enough and in the worst case the change could
>>> be reverted.
>> That's a good point, the wiki edits are watched that way more
>> What would our reaction be if we started to see spam edits via
>> OpenID accounts?
>> * Can we easily disable those accounts? * Would we revert to
>> not using OpenID? ** Sometimes spammers seem to be doing
>> test-spam on a wiki, so a few scattered edits might be
>> preparation for an onslaught.
>> Also consider all this in terms of who is taking care of the
>> wiki. We don't (yet?) have enough individuals or a team that
>> seem to be taking on any wiki management tasks.
>> So a spamming situation could rally such folks, but it could
>> also kill the energy while in the crib by overwhelming it with
>> spam pages from incrementally more spam accounts.
>> I'm reacting a bit here to e.g. more wiki pages being
>> incorrectly named than not, so a lot of wiki gardening required
>> still. OTOH, I am very much in favor of lowering barriers as
>> much as we can. I'd like to proceed with this discussion and
>> just figure out a way to counterbalance the risks, etc.
> can we separate the openid support for authentication (so people
> can user same user/password) from authorization (can an openid
> account do something)?
> so we would still have the process of an existing user has to
> give edit permissions to an openid user?
That could be a mitigation in case we do get spammers.
I'm wondering how wikipedia handles this since that's an open wiki
using the same software. Using an extension for authentication
makes us a non-standard target and thus harder.
AIUI, a large part is the legion of volunteers who revert spam edits.
All of the protection tools, such as Captchas, are reportedly cracked
I think it's important, if not vital, for an open source project
have a low barrier to join. Making it easy to do small fixes on the
wiki could help get people more involved.
This I do agree with, and wrote in to The Open Source Way handbook:
... and then as a project, struggle with how to handle the wiki auth.
(Short URL of above: http://bit.ly/TOSWOpenTooling
So in short I think using openid authentication and open
authorization will benefit the project at an acceptable risk of
spammers. If we do notice spammers we can switch to user
authorization with manual approval of users or in the worst case
fully disable openid and revert to the current workflow.
Are you able to volunteer to help with wiki gardening? In specific,
keeping things cleaned up if we do get a spammer - reverting changes,
deleting accounts, etc.
If we can get enough of us to watch things with commitment, then I'm
much more comfortable with the idea of rolling out OpenID.
- - Karsten
name: Karsten 'quaid' Wade, Sr. Community Architect
team: Red Hat Community Architecture & Leadership
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----