pauamma
commented
1 year ago The /create error message given in #3293 doesn't quite fit this case, as:
- this is based on country of IP address, not IP address itself
- this is overridable with an invite code, but #3293 (as I read it) isn't.
What should the error message for this read? Alternatively, should a more generic error message be used for both cases?
Do you want this to work for both IPv4 and IPv6? (I just checked and www.dreamwidth.org doesn't have IPv6 addresses currently, but I distinctly remember it did, so you may want to future-proof this.) The choice of geolocalisation module may depend on that.
We can kinda-sorta do geoblocking through AWS, but it's sorta brute force and I've been really reluctant to do it because it also affects legitimate use. (Our biggest source of spam is India, for instance, and I know we have legitimate users from India because I'm friends with several of them!)
So, I want a pony: I want a system where I can define (ideally on-site through an admin system or through a console command; less-ideally-but-still-okay, in the config file) a list of countries that can't create accounts. Same as with #3293 just opened, someone visiting the site from an IP that's geolocated to one of those countries shouldn't see the account creation links anywhere on the site (homepage, navigation) and should get an error message if they visit /create directly.
However! Because we do have legitimate users even from the Six Spam Countries, and they will want to create accounts, we need some kind of override that will let someone who's geoblocked actually create an account. This is probably best done through re-enabling invite codes but only requiring them if someone's accessing the site from an IP geolocated to one of the Spam Countries, where we can give people some invites to have on hand or create a multi-use code that we can give to people when they write in to us (especially since the existing invite code system has provisions for "multi-use codes, but still limited to X maximum uses", which would help prevent spammers from getting a code and using it all the time).
The last time I looked into this, Geo::IP looked like the best module to use, but there might be something better now.