Block throw-away domains from signup #2579
Conversation
5341129 to
41374c6
Compare
|
Can we use |
e377632 to
5b02651
Compare
More often than not, malicious accounts use throw-away email accounts for signup. For example, both accounts we locked this month had `yektara.com` in email. https://check-mail.org/domain/yektara.com/ Current list is taken from: https://www.stopforumspam.com/downloads we will add a cron to keep s3 file updated. As of now ~1k users have these domains in email and they collectly own ~50 gems.
5b02651 to
3a29f10
Compare
| def toxic_email_domain | ||
| domain = email.split("@").last | ||
| toxic_domains_path = Pathname.new(Gemcutter::Application.config.toxic_domains_filepath) | ||
| toxic = toxic_domains_path.exist? && toxic_domains_path.readlines.grep(/^#{domain}$/).any? |
There was a problem hiding this comment.
I worry about the impact to performance by needing to searching through an ever growing list of domains. Have you run any benchmark tests to see what the performance cost is? Is there an alternative approach that doesn't share the same performance cost?
There was a problem hiding this comment.
grep takes 10ms or less.
puts Benchmark.measure { toxic_domains_path.readlines.grep(/^#{domain}$/).any? }
0.010157 0.000000 0.010157 ( 0.010143)
10ms seems like too small a variance to make a measurable impact. benchmark-ips reported version without email check was 1.03x slower https://gist.github.com/sonalkr132/fcfce8b95c796365da31597bc9d345e8
There was a problem hiding this comment.
Also to notice registration endpoint could be actually benefiting from not being fast. Current overhead is acceptable IMHO. Anyway Rails.cache could be used to prevent reading the file on each registration.
More often than not, malicious accounts use throw-away email accounts for signup.
For example, both accounts we locked this month had
yektara.comin email.https://check-mail.org/domain/yektara.com/
Current list is taken from: https://www.stopforumspam.com/downloads
we will add a cron to keep s3 file updated.
As of now ~1k users have these domains in email and they collectly own ~50 gems.