Gitlab Critical Security Release

Re:Gitlab Critical Security Release by dnsmichi on Saturday February 26, 2022 @12:20PM (#30479570)

GitLab employee here.

You can disable signups, or require all users to being approved by an administrator, if that works for your instance. https://docs.gitlab.com/ee/user/admin_area/settings/sign_up_... There are more ways, like limiting specific domains for signup.

Future spam detection ideas shared in https://news.ycombinator.com/item?id=30479511

[ Parent | on HN ]

Re:Gitlab Critical Security Release by jancsika on Saturday February 26, 2022 @01:30PM (#30480271)

Thanks.

> You can disable signups,

I want potential GSoC participants to be able to sign up.

> or require all users to being approved by an administrator, if that works for your instance.

I don't have time to hand separate the Indonesian casino spammers from the potential GSoC participants. And I do mean "by hand"-- the Gitlab UI requires me to click a button to open up a secondary menu, then choose add or delete, then wait for the user screen to reload.

At least when sifting through an email spam folder back in the 90s I could press the delete button multiple times in a row. Even that would be a relatively usable solution.

[ Parent | on HN ]

Re:Gitlab Critical Security Release by dnsmichi on Saturday February 26, 2022 @02:47PM (#30481126)

Thanks for the additional context. Agreed, manually approving and filtering is not efficient here. Spamcheck suggested in https://news.ycombinator.com/item?id=30480296 should be the path.

[ Parent | on HN ]

Re:Gitlab Critical Security Release by mathstuf on Saturday February 26, 2022 @02:45PM (#30481116)

The API is good enough to write some Python code that does this way faster. Some autoclassification based on keywords helps a lot too.

I made some scripts to do this, but would have to extract them from beside the user data in the repo.

[ Parent | on HN ]