[openstreetmap/openstreetmap-website] Limit number of edits per user and day (#2342)

[David Karlaš]

https://nightwatch-test.azurewebsites.net/RateLimit was not meant to go public yet, but it is OK if it is now... It was mostly for me to brainstorm and tweak limits to minimize false positives...
Reasoning for 24h limiting was mainly to give time to DWG to respond, but I didn't give more thought to window size.

I also think, looking at just changeset count is not enough, for example todays 3 vandals:
<img width="1377" alt="image" src="https://github.com/openstreetmap/openstreetmap-website/assets/774791/35c9dfcc-3df0-4b32-87f9-77ce9ee0b6a8">
None went past 20 changesets, but https://www.openstreetmap.org/user/Radwan%20Bohiba who is HOT mapper made 143 changesets in past 24h, and there are many that go past 100 changesets per day. Looking just at changeset count it will be very hard to minimize false positives...

Reason for tracking created/modified/deleted separately is mostly because modified limit needs to be much lower than created, because ease of revert but also legit mappers can create a lot when mapping buildings... Same goes for nodes/ways/relations...

Limits that I use today are maybe/probably order of magnitude too low, if I increased them by 10x, it would still catch most if not all vandals and almost no real mappers...

It also feels like mechanism for DWG to monitor which users were blocked in past 24h and give them ability to either ban or lift limitations for each account is almost must, otherwise we will fly blind and not know how many super active mappers are being discouraged from mapping...

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/2342#issuecomment-1784190557
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/2342/1784190557 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20231029/ee725731/attachment.htm>