[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

[Denis Rouzaud]

Hi,

We switch to osgeo logged-in users only and force to have a (constructive)
comment?
Otherwise votes are meaningless and useless I'd say.

Cheers,
Denis

Le mer. 19 août 2026 à 09:07, Lova Andriarimalala via QGIS-Developer <
qgis-developer at lists.osgeo.org> a écrit :

> Hello everyone,
>
> Following the plugin rating abuse issue reported at
> https://github.com/qgis/QGIS-Plugins-Website/issues/416 and
> https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if
> someone could help or share some thoughts about it.
>
> We have released some fixes to enforce throttles (
> https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged
> cookies and add a cap votes per address (
> https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is
> not fully working because every IP recorded against a vote is a Cloudflare
> edge IP, not a real user IP. I checked 100 recent votes against
> Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is
> counting Cloudflare's proxy pool, which rotates per request. So, storing
> real client IPs would probably require some discussions regarding GDPR and
> retention angle.
>
> The reporter also asks us to (a) purge the fake votes and recompute the
> affected plugin scores, and (b) require a logged-in account to vote. Both
> are policy calls, not just code. And noting that the latter will probably
> break how the QGIS Desktop plugin manager submits ratings anonymously over
> XML-RPC.
>
> Thanks so much in advance for any input.
>
> Lova Andriarimalala
>
>
> *QGIS Full Stack Developer   *
> *T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
> kartoza.com
>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260819/404f27c1/attachment.htm>