[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

[Régis Haubourg]

Hi, and thanks for the very clear situation overview Lova!

Firefox  requires to log to be able to rate.  I concur with Denis. 
Anonymous voting is now obsolete to me, as the ecosystem has grown and 
many companies rely on this ecosystem.

I would have no problem with a communication campaign announcing that 
rating is no more authorized for anonymous accounts, and should only be 
done from the website, as I don't think we want to add a sign in feature 
from QGIS desktop itself. This feature would open the gate to a bunch of 
security / privacy /compliance issues that I don't thing we want to add 
complexity right now, as this is one strength of QGIS, to have no link 
with our public infrastructure and no personal data collection.

So, I guess that would mean that we remove the rating feature from QGIS 
desktop and that the voting button only opens the web app at the right 
place.


Best regards

Régis



On 19/08/2026 09:16, Denis Rouzaud via QGIS-Developer wrote:

> Hi,
>
> We switch to osgeo logged-in users only and force to have a 
> (constructive) comment?
> Otherwise votes are meaningless and useless I'd say.
>
> Cheers,
> Denis
>
> Le mer. 19 août 2026 à 09:07, Lova Andriarimalala via QGIS-Developer 
> <qgis-developer at lists.osgeo.org> a écrit :
>
>     Hello everyone,
>
>     Following the plugin rating abuse issue reported at
>     https://github.com/qgis/QGIS-Plugins-Website/issues/416 and
>     https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder
>     if someone could help or share some thoughts about it.
>
>     We have released some fixes to enforce throttles
>     (https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject
>     forged cookies and add a cap votes per address
>     (https://github.com/qgis/QGIS-Plugins-Website/pull/423). However,
>     it is not fully working because every IP recorded against a vote
>     is a Cloudflare edge IP, not a real user IP. I checked 100 recent
>     votes against Cloudflare's published ranges: 100 out of 100 match.
>     So the per-IP cap is counting Cloudflare's proxy pool, which
>     rotates per request. So, storing real client IPs would probably
>     require some discussions regarding GDPR and retention angle.
>
>     The reporter also asks us to (a) purge the fake votes and
>     recompute the affected plugin scores, and (b) require a logged-in
>     account to vote. Both are policy calls, not just code. And noting
>     that the latter will probably break how the QGIS Desktop plugin
>     manager submits ratings anonymously over XML-RPC.
>
>     Thanks so much in advance for any input.
>
>     Lova Andriarimalala
>     *QGIS Full Stack Developer
>
>     *
>     *T *: +27(0) 87 809 2702 *E *:**lova at kartoza.com *W* : kartoza.com
>     <http://kartoza.com>
>
>     _______________________________________________
>     QGIS-Developer mailing list
>     QGIS-Developer at lists.osgeo.org
>     List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>     Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>
>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info:https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe:https://lists.osgeo.org/mailman/listinfo/qgis-developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260819/92d1cce6/attachment-0001.htm>