15:00:44 #startmeeting Tooling meeting 15 September 2020 15:00:44 Meeting started Tue Sep 15 15:00:44 2020 UTC. The chair is gaba. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:44 Useful Commands: #action #agreed #help #info #idea #link #topic. 15:01:11 * anarcat waves 15:01:21 o/ 15:01:32 let me create a pad so we start this is as a proper meeting 15:02:39 The idea for this meeting is to talk about gitlab so we can move forward and resolve challenges we have right now 15:02:44 but also about toolig in general 15:02:53 pad in http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor-tooling-meeting-pad-2020-keep 15:07:39 who else is here? 15:08:38 mmm, it seems that is just you and me 15:08:41 whee 15:08:44 ahf was going to be here 15:08:45 anyway 15:08:54 i'm here, but probably don't have much to propose 15:08:55 hi! :) 15:09:00 hello juga ! 15:09:14 hi anarcat 15:09:20 hi! 15:09:50 the main issue I wanted to discuss today is the stuff about guest accounts 15:09:54 and how people report issues 15:09:59 hep 15:10:00 i am here 15:10:06 o/ 15:10:09 i was sitting at another computer sorry 15:10:24 hi juga! 15:10:27 ok 15:11:05 please add anything you may need to discuss in the agenda: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/tor-tooling-meeting-pad-2020-keep 15:11:07 guest accounts sounds good. i think i need some direction for what is next for the lobby stuff there 15:11:23 i don't have anything else for this week, but i think we will find stuff as we go on with that 15:11:29 the issue is that I feel that reporting bugs right now require a lot of steps 15:11:41 yep 15:11:42 * nickm lurks 15:11:48 o/ nickm 15:11:51 people are reporting issues in the notes of https://gitlab.onionize.space/ 15:12:16 yep, and some bots are just copying the "pre-filled" message in the signup form too :-/ 15:12:45 bots are cracking the signup form? 15:12:48 oh, I didnt realize that 15:13:06 anarcat: not cracking, there is nothing to crack 15:13:14 they just put in the same text as we have as suggested text 15:13:21 which is something like "I wish to report an issue in Tor Browser" 15:13:47 gaba: let me just find a ticket from nickm for a while ago 15:14:21 is this: https://gitlab.torproject.org/tpo/tpa/gitlab-lobby/-/issues/1 15:15:41 maybe we need to handle the contribution of first tickets as the first thing here? and then work towards merging the steps later? 15:16:34 I wonder how bad things will get if we just open registration 15:17:18 i think we will see spam if we open registration on the gitlab page itself. i think if we open registration via an external tool then we wont see much spam at all 15:17:31 we can try the former though and see how bad it goes? 15:18:21 if we're going to do that we should make a note that it's experimental and we'll go back to the current thing if there's spam 15:19:14 tbh i have no idea what other way we can improve this. 15:19:31 nickm: yep 15:19:50 gaba: is cool, it means that i can focus on anonymous submissions and moderation of that for the lobby if we do that 15:20:03 and just leave the code that is in there for now for sign-ups if we need to fall back to that 15:20:09 ok 15:20:23 we open it up and we check back in a week? 15:20:26 it does mean that we give every user on the internet a bit of storage on the server for hosting projects there 15:20:40 so we should probably be using the nice graphana view more that the sysadmin team gave us 15:20:44 where we can see disk usage and such 15:20:56 we had a downtime with gitlab last saturday that hiro solved for us, which was due to disk space 15:21:10 which i think is because there is a lot of forking going on right now iwth the browser related projects and those projects are very big 15:21:22 to avoid spam with open registrations, doesn't gitlab have a captcha system? (though that would penalize Tor users probably) 15:21:27 * anarcat told-you-so's ;) 15:21:56 juga: nope, it has a system where we can send usernames + the users IP to a third-party that says good/bad 15:22:06 but we don't want to send all users info that way 15:22:15 ahf: make sense, thanks 15:23:33 okay, so it sounds like we are ok with trying this as an experiment 15:23:56 should i go ahead then and remove the sign-up text with link to the lobby sign-up and enable open registration? 15:24:08 and we need to tell all the people who are currently doing moderation too 15:24:15 +1 to try this for a week 15:24:20 i can do that. the N is not very big, but it's like 10 people i think 15:24:24 there is nothing in moderation queue right now 15:24:35 yep 15:25:55 ok. We should tell people doing moderation and ggus 15:25:59 that is doing support 15:27:15 ok, i can do that 15:27:37 query: what abusive behavior could people do on gitlab that we would _not_ notice promptly? 15:28:37 create a user, create a repo, put crap in repo 15:28:45 limit to 5 repos 15:28:46 generate todo list items 15:28:54 spam existing issues 15:28:56 maybe we should lower down the amount of projects they can create 15:28:58 spam with new issues 15:29:14 for "spam existing issues" or "spam new issues" we'd probably notice, right? 15:29:26 they can create groups 15:29:35 but 'create abusive repos' (eg copyright infringment, advertising) wouldn't necessarily get noticed fast 15:30:03 nickm: ah, right 15:30:11 nickm: yep 15:31:05 I'm going to uncheck "Notify users by email when sign-in location is not recognized" that is related to https://gitlab.torproject.org/tpo/tpa/gitlab/-/issues/68 15:31:14 i think i have enabled sign-up now 15:31:25 there was an interesting discussion about captcha workarounds on HN! recently, in case that's useful here https://news.ycombinator.com/item?id=24334657 15:31:55 the poster was facing a determined attacker that would deliberately subvert spam controls, and wanted to avoid reCAPTCHA (like us) so it's an interesting overview of possible solutions 15:32:13 some suggested SMS authentication, to give you an idea of how far the discussion went 15:32:24 ahf: on the sign-up page do we have a disclaimer for "this is for tor only" and/or "this is open as an experiment. if we start getting spam or abuse, we'll have to lock this down again' ? 15:32:41 no, i removed the part with "Account creation go to this page" text 15:33:36 okay, now we are at this accounts stuff 15:33:44 we have a lot of accounts that we have given access to via the lobby 15:33:48 who have never logged in 15:33:54 many solutions involve major modifications to the software, of course, like shadow-banning, but also stuff like bayes filter and hooking up with stopforumspam.com which i did not know about 15:34:51 i am not going to dive into a new captcha thing unless it gets made by the gitlab.com people 15:35:10 we have a solution that took a very short amunt of time to do that we can fallback to if this doesn't work, which requires manual moderation 15:35:32 ahf: we should probably have a process to disable inactive accounts after a long time then 15:35:37 ahf: we said we were going to remove accounts that were never used or not used for an X amount of time, right? 15:35:47 gaba: we have a ticket for it, but then i went on vacation 15:35:55 so there is no code to expire accounts right now 15:36:11 ahf: i guess i mention this as a future reference, and in case you want to implement some heuristics in the signup form itself 15:36:18 * gaba needs to go through gitlab tickets... had not time for it yesterday 15:36:23 i'm not proposing we start patching gitlab, obviously :p 15:36:27 anarcat: nods 15:37:20 if this experiment with sign ups seems to work OK, do we agree that the next important thing for a lobby application to do is to handle anonymous submissions? i feel bad for the people who requested this *very* early in the gitlab migration process and keeps being postponed for them 15:37:26 and they all want to help moderate it 15:37:29 https://gitlab.torproject.org/tpo/tpa/gitlab/-/boards likes a prioritized todo list 15:37:34 if maybe out of date :) 15:37:47 i thought https://gitlab.torproject.org/tpo/tpa/gitlab/-/issues/21 was done already 15:38:09 it hasn't been moved away from my account 15:38:17 ah 15:38:21 only the lobby has been moved to tpa/ 15:38:23 seems like a low hanging fruit ;) 15:38:26 yep 15:38:52 +1 to figure out anonymous submissions 15:39:43 okay, if that is the next step i think i will next week talk a bit with geko about how we should do it. he has been giving me some feedback already when we talked about it earlier in the process 15:40:25 the irc bot with the short-hands for MR's and issues have been running without an exception now since it was started last time, so that is good 15:40:36 it should probably be moved to tpo/tpa/ too so people can submit issues/feature requests there 15:41:08 * anarcat nods 15:41:15 maybe at some point we can disable the long-form ticket ID handling of zwiebelbot as 'tor' already does it 15:42:19 also, we should probably try to encourage people who have tooling suggestions/need help to come to these meetings. i like that they have been renamed from gitlab to just be about tooling 15:42:29 i hope people will come with input/suggestions via that :o 15:42:37 seems like we should prioritize https://gitlab.torproject.org/tpo/tpa/gitlab/-/issues/11 as well 15:42:45 yeah lol 15:42:57 deadline june 26 15:43:02 ... 15:43:03 it is like high school all over 15:43:23 anyways, yeah, someone (tm) needs to walk through those tickets 15:43:25 maybe we can announce it now that we have open registration? :-) 15:43:48 * gaba will walk through the tickets this week before next meeting 15:43:55 awesome gaba, thanks! 15:45:08 yeah, very nice! 15:46:20 at some point i would like to hear people out what they find annoying with GL or what works well or what they wish they had. the first 2 months had a lot of support, but these days there is not much 15:46:25 and people seems to be using the CI too 15:46:55 * ahf has nothing more for today :o 15:48:28 yes, I would love to do a retrospective on this 15:48:41 * anarcat is slightly annoyed with the wikis, but is happy to have switched from trac :) 15:48:41 I have marked a retrospective in the calendar in october for all hands 15:48:45 cool 15:48:50 i'm annoyed with peermissions 15:49:01 and wikis not open for everybody in the internet world 15:49:29 * gaba has no more stuff. we can bring all this in a next meeting 15:49:42 #endmeeting