Requiring a GitHub account for registration

[kenjis]

The process of deleting spam posts daily is really useless and a pain.

It would be impossible to eliminate moderations, but we need to reduce the number of spammers registering.

Just like laravel.io, registration via github should be mandatory, IMO, as this will help reduce spam accounts and/or bots. We can apply more security as time goes on.
https://forum.codeigniter.com/showthread.php?tid=88243&pid=412015#pid412015

[michalsn]

IMO this is a good idea. Not sure how hard it would be to implement, because we still have to handle regular email login for old users.

[lonnieezell]

And if we are going to restrict registration we also need to include other login solutions like GitLab at least.

[kenjis]

GitHub should be a top priority. People cannot participate in development without a GitHub account.

However, there is nothing wrong with using other providers if it reduces the number of spammers registrations.

[lonnieezell]

People cannot participate in development without a GitHub account.

Not all people using our forums are the to help with development, so I think we need to have broad access for everyone, though that can probably be handled with Github and Google to start, since over 80% of email sent in the world is through Google, IIRC. I would like to have GitLab and Apple eventually, though. Apple provides more privacy protections some users might appreciate, while GitLab is also a very important platform for developers.

Another thought is we allow for password-less and rely on magic links for logins as an alternative. Combined with an API to check spam email address blocks, that could be a decent block.

One thing about custom software is that the automated bot machines won't know of any bugs/back doors, so it would have to all manual login and post creation which should dramatically cut down on the amount of spammers to begin with. I'm already planning an Akismet integration to automate checking the first few posts which will also help.

[datamweb]

registration via github should be mandatory

@kenjis Personally, I am not interested in forcing people to register only with GitHub.
The reason for this is related to the fact that many people do not have a GitHub account at all. I've seen this from people asking about the Shield. who have had to create a GitHub account and then create their question in section GitHub Discussions.

My question is, can't what you are worried about be prevented by adding captcha to the registration section and the posting section?

Not sure how hard it would be to implement, because we still have to handle regular email login for old users.

@michalsn We already have the ability to $allowRegistration from Shield.
https://github.com/codeigniter4/shield/blob/f1c2150e54f6aa5108a6e2cc25ddb00a77c5d801/src/Config/Auth.php#L147

and it doesn't seem to be too complicated, I've already created a package https://www.shield-oauth.codeigniter4.ir.

[lonnieezell]

Would it make sense to allow registration via Google or Apple then, also?

and it doesn't seem to be too complicated, I've already created a package https://www.shield-oauth.codeigniter4.ir/.

That's awesome. Thanks for sharing that! That's part I wasn't looking forward to building out :)

[michalsn]

Would it make sense to allow registration via Google or Apple then, also?

Sure, I don't see why not.

[datamweb]

Captcha is not the solution, because even though we have it now, it doesn't change the size of the spam problem.

I don't see any captcha in the post section now, at least for me it shows as below.

In any case, you know more about the performance of users in the forum than I do. Do the right thing.

[michalsn]

@datamweb You're right, I was referring only to the registration page. I believe we have a captcha enabled there and we still have spammer accounts.

[kenjis]

Capture is not helpful. I don't know if humans or AI are registering, but it is a fact that spammers are registering on the forum every single day.

I can't see the server logs, so I don't know what the spammers are doing. The current forum does not give us basic information and has little ability to eliminate spammers.