[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

Wed Sep 9 02:23:14 PDT 2026

Hi

Just to follow up on this, we have discussed this in the PSC call last
night. It was agreed that we will remove the rating feature from
https://plugins.qgis.org and replace the endpoint with a no-op so that it
does not break existing desktop plugin manager interactions, and then
follow up with a patch to remove it from the plugin manager.

For those curious about knowing if their plugin is being well received by
their users, we will move the responsibility for this to you to build
something into your plugin itself.

Regards

Tim

On Tue, Sep 1, 2026 at 12:03 PM Tim Sutton via QGIS-Developer <
qgis-developer at lists.osgeo.org> wrote:

> Hi all
>
> Thank you very much for all the feedback and comments. I had a chat
> through this with Lova offline in one of our catch up calls and I am of the
> opinion that we should just remove the feature entirely - both in QGIS
> desktop and on the plugins.qgis.org web site. We are a small team and not
> equipped to deal with queries and validation and reviewing inputs etc. that
> comes with implementing a more robust system.
>
> So if there are no objections we will implement a noop on the api call (so
> it doesn't break legacy QGIS installs) and then Lova and I will make a
> patch to QGIS core for you guys to review and hopefully approve if we did a
> good job of stripping it out.
>
> Regards
>
> Tim
>
> On Fri, Aug 21, 2026 at 5:06 PM Valentin Buira via QGIS-Developer <
> qgis-developer at lists.osgeo.org> wrote:
>
>> Hi Lova,
>>
>> >  I agree that shifting to authenticated ratings with a proper comment
>> system makes the most sense given the current situation.
>>
>> Thanks a lot for suggesting this, I had one bad review without
>> explanation on one of my plugins, and it still haunts me to this day!
>>
>> If you're looking to draw some inspiration, I think over the years Steam
>> really nailed the rating system in their game store.
>>
>> * They display two ratings, one rating average from recent reviews, and
>> one rating average for the overall reviews on the lifetime of the game.
>> * There is a bar chart with positive/negative rating along the year, so
>> you can see the evolution and "review bombing" [0]
>> * The review include info like hardware of the users, game version ->
>> this could be simplified to QGIS Version and Plugin version, and maybe OS
>> * Reviews always have comments
>> * You can filter reviews by your language, date, rating,
>> positive/negative etc...
>>
>> Of course we don't have to have as compelling a rating system (And we
>> probably should not, we are not in the plugin selling nor video game
>> selling business after all). But I think it's interesting to look at it
>> anyway
>>
>> Cheers,
>> Valentin
>>
>> [0] one good example of this is "no man's sky" than went from most
>> negative to mostly positive alongs the updates
>> https://store.steampowered.com/app/275850/No_Mans_Sky/#app_reviews_hash
>>
>> Le mer. 19 août 2026 à 11:57, Lova Andriarimalala via QGIS-Developer <
>> qgis-developer at lists.osgeo.org> a écrit :
>>
>>> Hi Régis and Denis
>>>
>>> Thank you for the input. I agree that shifting to authenticated ratings
>>> with a proper comment system makes the most sense given the current
>>> situation.
>>>
>>> With that change, I wonder if it wouldn't be simpler to start with clean
>>> rating records for all plugins rather than migrating those who rated with
>>> an account from the current obsolete ones. This will prevent recalculating
>>> all ratings based on the new rule or considering removing any rating based
>>> on abuse (which is difficult to determine) if we even choose to keep the
>>> obsolete records. With clean records, we could easily add the
>>> mandatory constructive comments feature as Denis suggested.
>>>
>>> On the QGIS Desktop side, this change will most likely require a QEP
>>> first because the existing feature in current and previous versions will
>>> break and I am not familiar with how to handle that.
>>>
>>> I can also prepare a detailed plan for the changes and announcement
>>> accordingly.
>>>
>>> Best regards,
>>> Lova Andriarimalala
>>>
>>>
>>> *QGIS Full Stack Developer   *
>>> *T *: +27(0) 87 809 2702 <+27%2087%20809%202702>          *E *:
>>> lova at kartoza.com          *W* : kartoza.com
>>>
>>>
>>>
>>> *This email and any attachments are confidential and intended solely for
>>> the use of the individual or entity to whom they are addressed. If you *
>>> *have received this email in error, please notify the sender immediately
>>> and delete it from your system. Unauthorised use, disclosure, or copying*
>>> *of the contents is prohibited.*
>>>
>>>
>>> On Wed, 19 Aug 2026 at 10:43, Régis Haubourg <regis.haubourg at gmail.com>
>>> wrote:
>>>
>>>> Hi, and thanks for the very clear situation overview Lova!
>>>>
>>>> Firefox  requires to log to be able to rate.  I concur with Denis.
>>>> Anonymous voting is now obsolete to me, as the ecosystem has grown and many
>>>> companies rely on this ecosystem.
>>>>
>>>> I would have no problem with a communication campaign announcing that
>>>> rating is no more authorized for anonymous accounts, and should only be
>>>> done from the website, as I don't think we want to add a sign in feature
>>>> from QGIS desktop itself. This feature would open the gate to a bunch of
>>>> security / privacy /compliance issues that I don't thing we want to add
>>>> complexity right now, as this is one strength of QGIS, to have no link with
>>>> our public infrastructure and no personal data collection.
>>>>
>>>> So, I guess that would mean that we remove the rating feature from QGIS
>>>> desktop and that the voting button only opens the web app at the right
>>>> place.
>>>>
>>>>
>>>> Best regards
>>>>
>>>> Régis
>>>>
>>>>
>>>>
>>>> On 19/08/2026 09:16, Denis Rouzaud via QGIS-Developer wrote:
>>>>
>>>> Hi,
>>>>
>>>> We switch to osgeo logged-in users only and force to have a
>>>> (constructive) comment?
>>>> Otherwise votes are meaningless and useless I'd say.
>>>>
>>>> Cheers,
>>>> Denis
>>>>
>>>> Le mer. 19 août 2026 à 09:07, Lova Andriarimalala via QGIS-Developer <
>>>> qgis-developer at lists.osgeo.org> a écrit :
>>>>
>>>>> Hello everyone,
>>>>>
>>>>> Following the plugin rating abuse issue reported at
>>>>> https://github.com/qgis/QGIS-Plugins-Website/issues/416 and
>>>>> https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if
>>>>> someone could help or share some thoughts about it.
>>>>>
>>>>> We have released some fixes to enforce throttles (
>>>>> https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged
>>>>> cookies and add a cap votes per address (
>>>>> https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it
>>>>> is not fully working because every IP recorded against a vote is a
>>>>> Cloudflare edge IP, not a real user IP. I checked 100 recent votes against
>>>>> Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is
>>>>> counting Cloudflare's proxy pool, which rotates per request. So, storing
>>>>> real client IPs would probably require some discussions regarding GDPR and
>>>>> retention angle.
>>>>>
>>>>> The reporter also asks us to (a) purge the fake votes and recompute
>>>>> the affected plugin scores, and (b) require a logged-in account to vote.
>>>>> Both are policy calls, not just code. And noting that the latter will
>>>>> probably break how the QGIS Desktop plugin manager submits ratings
>>>>> anonymously over XML-RPC.
>>>>>
>>>>> Thanks so much in advance for any input.
>>>>>
>>>>> Lova Andriarimalala
>>>>>
>>>>>
>>>>> *QGIS Full Stack Developer    *
>>>>> *T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W*
>>>>>  : kartoza.com
>>>>>
>>>>> _______________________________________________
>>>>> QGIS-Developer mailing list
>>>>> QGIS-Developer at lists.osgeo.org
>>>>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>>>
>>>>
>>>> _______________________________________________
>>>> QGIS-Developer mailing listQGIS-Developer at lists.osgeo.org
>>>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>>
>>>> _______________________________________________
>>> QGIS-Developer mailing list
>>> QGIS-Developer at lists.osgeo.org
>>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>>
>> _______________________________________________
>> QGIS-Developer mailing list
>> QGIS-Developer at lists.osgeo.org
>> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>>
>
>
> --
>
> Tim Sutton
>
> *Kartoza Cofounder*Tim is a member of the QGIS Project Steering Committee
>
> *E *: tim at kartoza.com          *W* : kartoza.com
>
>
>
> *This email and any attachments are confidential and intended solely for
> the use of the individual or entity to whom they are addressed. If you *
> *have received this email in error, please notify the sender immediately
> and delete it from your system. Unauthorised use, disclosure, or copying*
> *of the contents is prohibited.*
> _______________________________________________
> QGIS-Developer mailing list
> QGIS-Developer at lists.osgeo.org
> List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer
> Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
>

-- 

*Tim Sutton*
QGIS Project Steering Committee
tim at qgis.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260909/53af7922/attachment-0001.htm>