<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi, and thanks for the very clear situation overview Lova!</p>
<p>Firefox requires to log to be able to rate. I concur with
Denis. Anonymous voting is now obsolete to me, as the ecosystem
has grown and many companies rely on this ecosystem. <br>
<br>
I would have no problem with a communication campaign announcing
that rating is no more authorized for anonymous accounts, and
should only be done from the website, as I don't think we want to
add a sign in feature from QGIS desktop itself. This feature would
open the gate to a bunch of security / privacy /compliance issues
that I don't thing we want to add complexity right now, as this is
one strength of QGIS, to have no link with our public
infrastructure and no personal data collection. </p>
<p>So, I guess that would mean that we remove the rating feature
from QGIS desktop and that the voting button only opens the web
app at the right place. </p>
<p><br>
</p>
<p>Best regards</p>
<p>Régis</p>
<p><br>
</p>
<p><br>
</p>
<p>On 19/08/2026 09:16, Denis Rouzaud via QGIS-Developer wrote:</p>
<blockquote type="cite"
cite="mid:CAMtsY+Z2rwsFzpAUHPNnyk+7w30z3+mays3rgrMtDi8C8MQdNg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi,
<div><br>
</div>
<div>We switch to osgeo logged-in users only and force to have a
(constructive) comment?<br>
Otherwise votes are meaningless and useless I'd say.</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Denis</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">Le mer. 19 août 2026 à 09:07,
Lova Andriarimalala via QGIS-Developer <<a
href="mailto:qgis-developer@lists.osgeo.org" target="_blank"
moz-do-not-send="true" class="moz-txt-link-freetext">qgis-developer@lists.osgeo.org</a>>
a écrit :<br>
</div>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div>Hello everyone,</div>
<div><br>
</div>
<div>Following the plugin rating abuse issue reported at <a
href="https://github.com/qgis/QGIS-Plugins-Website/issues/416"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://github.com/qgis/QGIS-Plugins-Website/issues/416</a>
and <a
href="https://github.com/qgis/QGIS-Plugins-Website/issues/420"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://github.com/qgis/QGIS-Plugins-Website/issues/420</a>,
I wonder if someone could help or share some thoughts
about it.</div>
<div><br>
We have released some fixes to enforce throttles (<a
href="https://github.com/qgis/QGIS-Plugins-Website/pull/418"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://github.com/qgis/QGIS-Plugins-Website/pull/418</a>),
reject forged cookies and add a cap votes per address (<a
href="https://github.com/qgis/QGIS-Plugins-Website/pull/423"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://github.com/qgis/QGIS-Plugins-Website/pull/423</a>).
However, it is not fully working because every IP recorded
against a vote is a Cloudflare edge IP, not a real user
IP. I checked 100 recent votes against Cloudflare's
published ranges: 100 out of 100 match. So the per-IP cap
is counting Cloudflare's proxy pool, which rotates per
request. So, storing real client IPs would probably
require some discussions regarding GDPR and retention
angle.</div>
<div><br>
The reporter also asks us to (a) purge the fake votes and
recompute the affected plugin scores, and (b) require a
logged-in account to vote. Both are policy calls, not just
code. And noting that the latter will probably break how
the QGIS Desktop plugin manager submits ratings
anonymously over XML-RPC.</div>
<div><br>
Thanks so much in advance for any input.</div>
<div><br>
</div>
<div>
<div dir="ltr" class="gmail_signature">
<div dir="ltr">
<div style="color:rgb(34,34,34)">Lova Andriarimalala</div>
<div style="color:rgb(34,34,34)"><b>QGIS Full Stack
Developer <br>
<br>
</b></div>
<div style="color:rgb(34,34,34)"><b>T </b>: +27(0) 87
809 2702 <b>E </b>:<b> </b><a
href="mailto:lova@kartoza.com"
style="color:rgb(17,85,204)" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">lova@kartoza.com</a>
<b>W</b> : <a href="http://kartoza.com"
style="color:rgb(17,85,204)" target="_blank"
moz-do-not-send="true">kartoza.com</a><br>
</div>
<div style="color:rgb(34,34,34)"><br>
</div>
<div style="color:rgb(34,34,34)">
<div><img
src="https://erp.kartoza.com/files/KartozaEmailSignatureTest.gif"
moz-do-not-send="true"></div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
QGIS-Developer mailing list<br>
<a href="mailto:QGIS-Developer@lists.osgeo.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">QGIS-Developer@lists.osgeo.org</a><br>
List info: <a
href="https://lists.osgeo.org/mailman/listinfo/qgis-developer"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a><br>
Unsubscribe: <a
href="https://lists.osgeo.org/mailman/listinfo/qgis-developer"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a><br>
</blockquote>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre wrap="" class="moz-quote-pre">_______________________________________________
QGIS-Developer mailing list
<a class="moz-txt-link-abbreviated" href="mailto:QGIS-Developer@lists.osgeo.org">QGIS-Developer@lists.osgeo.org</a>
List info: <a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a>
Unsubscribe: <a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a>
</pre>
</blockquote>
</body>
</html>