Re: Recent gitlab account requests...

Georgiy Tugai <[email protected]> Thu, 3 Jul 2025 14:46:06 +0200
Newsgroups	gmane.lisp.common-lisp-net.devel
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------zs0vyg2lzSXag5RnZdGR0BV3
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi Philipp,

On 3/07/2025 14:29, Philipp Marek wrote:
> Hi Georgiy,
>
>> The new installation currently does not support the link-via-IRC method, I imagine that we could reinstate it.
>>
>> Last time we discussed that, there was some concern as to whether link-via-IRC may be "too hard" for legitimate users, given how few people know about/use IRC these days.
>
> AFAIR we had a link to IRC via web there.
>
> I guess anything less obscure is too easy for the bots,
> especially if there is no media break in there
> (ie a http based captcha or so).
>
>
> I could imagine having the client solve some challenge,
> eg. finding some SHA256 HMAC key so that a server generated random token
> comes up with 24 zero bits in front or so --
> perhaps that's too expensive (ie. runs into timeouts) for spammer bots?

Currently, GitLab registration is behind a combination of Anubis <https://anubis.techaro.lol/> and reCaptcha.

Anubis provides a challenge like the one you described (N zero bits of a hash).

--------------zs0vyg2lzSXag5RnZdGR0BV3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Hi Philipp,</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">On 3/07/2025 14:29, Philipp Marek
      wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:[email protected]">Hi
      Georgiy,
      <br>
      <br>
      <blockquote type="cite">The new installation currently does not
        support the link-via-IRC method, I imagine that we could
        reinstate it.
        <br>
        <br>
        Last time we discussed that, there was some concern as to
        whether link-via-IRC may be "too hard" for legitimate users,
        given how few people know about/use IRC these days.
        <br>
      </blockquote>
      <br>
      AFAIR we had a link to IRC via web there.
      <br>
      <br>
      I guess anything less obscure is too easy for the bots,
      <br>
      especially if there is no media break in there
      <br>
      (ie a http based captcha or so).
      <br>
      <br>
      <br>
      I could imagine having the client solve some challenge,
      <br>
      eg. finding some SHA256 HMAC key so that a server generated random
      token
      <br>
      comes up with 24 zero bits in front or so --
      <br>
      perhaps that's too expensive (ie. runs into timeouts) for spammer
      bots?
      <br>
    </blockquote>
    <p>Currently, GitLab registration is behind a combination of <a
        href="https://anubis.techaro.lol/">Anubis</a> and reCaptcha.</p>
    <p>Anubis provides a challenge like the one you described (N zero
      bits of a hash).<br>
    </p>
  </body>
</html>

--------------zs0vyg2lzSXag5RnZdGR0BV3--