[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

Tue Sep 1 04:02:56 PDT 2026

Hi all

Thank you very much for all the feedback and comments. I had a chat through
this with Lova offline in one of our catch up calls and I am of the opinion
that we should just remove the feature entirely - both in QGIS desktop and
on the plugins.qgis.org web site. We are a small team and not equipped to
deal with queries and validation and reviewing inputs etc. that comes with
implementing a more robust system.

So if there are no objections we will implement a noop on the api call (so
it doesn't break legacy QGIS installs) and then Lova and I will make a
patch to QGIS core for you guys to review and hopefully approve if we did a
good job of stripping it out.

Regards

Tim

On Fri, Aug 21, 2026 at 5:06 PM Valentin Buira via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> Hi Lova,
>
> >  I agree that shifting to authenticated ratings with a proper comment
> system makes the most sense given the current situation.
>
> Thanks a lot for suggesting this, I had one bad review without explanation
> on one of my plugins, and it still haunts me to this day!
>
> If you're looking to draw some inspiration, I think over the years Steam
> really nailed the rating system in their game store.
>
> * They display two ratings, one rating average from recent reviews, and
> one rating average for the overall reviews on the lifetime of the game.
> * There is a bar chart with positive/negative rating along the year, so
> you can see the evolution and "review bombing" [0]
> * The review include info like hardware of the users, game version -> this
> could be simplified to QGIS Version and Plugin version, and maybe OS
> * Reviews always have comments
> * You can filter reviews by your language, date, rating, positive/negative
> etc...
>
> Of course we don't have to have as compelling a rating system (And we
> probably should not, we are not in the plugin selling nor video game
> selling business after all). But I think it's interesting to look at it
> anyway
>
> Cheers,
> Valentin
>
> [0] one good example of this is "no man's sky" than went from most
> negative to mostly positive alongs the updates
> https://store.steampowered.com/app/275850/No_Mans_Sky/#app_reviews_hash
>
> Le mer. 19 août 2026 à 11:57, Lova Andriarimalala via QGIS-Developer <
> qgis-developer at lists.osgeo.org> a écrit :
>
>> Hi Régis and Denis
>>
>> Thank you for the input. I agree that shifting to authenticated ratings
>> with a proper comment system makes the most sense given the current
>> situation.
>>
>> With that change, I wonder if it wouldn't be simpler to start with clean
>> rating records for all plugins rather than migrating those who rated with
>> an account from the current obsolete ones. This will prevent recalculating
>> all ratings based on the new rule or considering removing any rating based
>> on abuse (which is difficult to determine) if we even choose to keep the
>> obsolete records. With clean records, we could easily add the
>> mandatory constructive comments feature as Denis suggested.
>>
>> On the QGIS Desktop side, this change will most likely require a QEP
>> first because the existing feature in current and previous versions will
>> break and I am not familiar with how to handle that.
>>
>> I can also prepare a detailed plan for the changes and announcement
>> accordingly.
>>
>> Best regards,
>> Lova Andriarimalala
>>
>>
>> *QGIS Full Stack Developer   *
>> *T *: +27(0) 87 809 2702 <+27%2087%20809%202702>          *E *:
>> lova at kartoza.com          *W* : kartoza.com
>>
>>
>>
>> *This email and any attachments are confidential and intended solely for
>> the use of the individual or entity to whom they are addressed. If you *
>> *have received this email in error, please notify the sender immediately
>> and delete it from your system. Unauthorised use, disclosure, or copying*
>> *of the contents is prohibited.*
>>
>>
>> On Wed, 19 Aug 2026 at 10:43, Régis Haubourg <regis.haubourg at gmail.com>
>> wrote:
>>
>>> Hi, and thanks for the very clear situation overview Lova!
>>>
>>> Firefox  requires to log to be able to rate.  I concur with Denis.
>>> Anonymous voting is now obsolete to me, as the ecosystem has grown and many
>>> companies rely on this ecosystem.
>>>
>>> I would have no problem with a communication campaign announcing that
>>> rating is no more authorized for anonymous accounts, and should only be
>>> done from the website, as I don't think we want to add a sign in feature
>>> from QGIS desktop itself. This feature would open the gate to a bunch of
>>> security / privacy /compliance issues that I don't thing we want to add
>>> complexity right now, as this is one strength of QGIS, to have no link with
>>> our public infrastructure and no personal data collection.
>>>
>>> So, I guess that would mean that we remove the rating feature from QGIS
>>> desktop and that the voting button only opens the web app at the right
>>> place.
>>>
>>>
>>> Best regards
>>>
>>> Régis
>>>
>>>
>>>
>>> On 19/08/2026 09:16, Denis Rouzaud via QGIS-Developer wrote:
>>>
>>> Hi,
>>>
>>> We switch to osgeo logged-in users only and force to have a
>>> (constructive) comment?
>>> Otherwise votes are meaningless and useless I'd say.
>>>
>>> Cheers,
>>> Denis
>>>
>>> Le mer. 19 août 2026 à 09:07, Lova Andriarimalala via QGIS-Developer <
>>> qgis-developer at lists.osgeo.org> a écrit :
>>>
>>>> Hello everyone,
>>>>
>>>> Following the plugin rating abuse issue reported at
>>>> https://github.com/qgis/QGIS-Plugins-Website/issues/416 and
>>>> https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if
>>>> someone could help or share some thoughts about it.
>>>>
>>>> We have released some fixes to enforce throttles (
>>>> https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged
>>>> cookies and add a cap votes per address (
>>>> https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is
>>>> not fully working because every IP recorded against a vote is a Cloudflare
>>>> edge IP, not a real user IP. I checked 100 recent votes against
>>>> Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is
>>>> counting Cloudflare's proxy pool, which rotates per request. So, storing
>>>> real client IPs would probably require some discussions regarding GDPR and
>>>> retention angle.
>>>>
>>>> The reporter also asks us to (a) purge the fake votes and recompute the
>>>> affected plugin scores, and (b) require a logged-in account to vote. Both
>>>> are policy calls, not just code. And noting that the latter will probably
>>>> break how the QGIS Desktop plugin manager submits ratings anonymously over
>>>> XML-RPC.
>>>>
>>>> Thanks so much in advance for any input.
>>>>
>>>> Lova Andriarimalala
>>>>
>>>>
>>>> *QGIS Full Stack Developer    *
>>>> *T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W*
>>>>  : kartoza.com
>>>>
>>>> _______________________________________________
>>>> QGIS-Developer mailing list
>>>> QGIS-Developer at lists.osgeo.org
>>>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>>
>>>
>>> _______________________________________________
>>> QGIS-Developer mailing listQGIS-Developer at lists.osgeo.org
>>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>
>>> _______________________________________________
>> QGIS-Developer mailing list
>> QGIS-Developer at lists.osgeo.org
>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>

-- 

Tim Sutton

*Kartoza Cofounder*Tim is a member of the QGIS Project Steering Committee

*E *: tim at kartoza.com          *W* : kartoza.com

*This email and any attachments are confidential and intended solely for
the use of the individual or entity to whom they are addressed. If you *
*have received this email in error, please notify the sender immediately
and delete it from your system. Unauthorised use, disclosure, or copying*
*of the contents is prohibited.*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260901/1e86d224/attachment-0001.htm>