Add a mechanism to set limits on repetitive reporting

[softvision-sergiulogigan]

Giving the fact that we have a lot of spam/duplicates lately, we suggest adding a (simple) CAPTCHA field, to discourage such behaviors.

Recent examples: https://github.com/webcompat/web-bugs/issues/25603 - 17 duplicates https://github.com/webcompat/web-bugs/issues/25609 - 10 duplicates https://github.com/webcompat/web-bugs/issues/26503 - 3 duplicates https://github.com/webcompat/web-bugs/issues/26480 - 4 duplicates

[karlcow]

we can blacklist these domains

[miketaylr]

Captcha is good if we have evidence non-humans are reporting the bugs. Otherwise, I worry it's too high a barrier for sending in quick bugs.

[karlcow]

I rephrased the title of the issue to be more general.

• blacklist (we do that already for certain domains)
• deny the posting based on a triplet (ip, uri, time). For the same ip and uri, if time(n-1)-time(n) < x (minutes), we block/ignore/warn the user about cooling down on reporting.
• add a captcha (this is my list favorite). It will become quickly annoying and it's already a bit hard to report something meaningful.

[marimeireles]

deny the posting based on a triplet (ip, uri, time). For the same ip and uri, if time(n-1)-time(n) < x (minutes), we block/ignore/warn the user about cooling down on reporting.

This seems like a good idea. What do you think it's a reasonable time for us to set on this @karlcow?

[karlcow]

@marimeireles

Taking one of the cases we had.

• 12:56pm
• 2:54pm
• 3:11pm
• 3:15pm
• 3:16pm
• 3:17pm
• 3:21pm
• 3:23pm
• 3:26pm

I guess 10 minutes could be reasonable. or longer with an additional check on the fact that it is webcompat-bot reporting the issue (so we are not blocking softvision team when they report issues.)

[marimeireles]

I'm going to give a try on this.