Spamcheck Anti-Abuse Engine

1 post · Jun 2019 – Aug 2021

What this trail covers

GitLab is introducing Spamcheck, a new data-driven anti-spam engine designed to improve resilience to spam and abuse. Spamcheck has been enabled for all projects on GitLab.com and will be included in the 14.6 release for self-managed customers. The engine was developed by the Security Automation team in partnership with Trust and Safety, Create, and Plan Engineering teams. It leverages a testbed for analysis and prototyping, and is built with a loosely coupled architecture. Deployment is iterative.

All GitLab trails

Aug 2021Introducing Spamcheck: A data-driven, anti-abuse engineThis post introduces Spamcheck, a new anti-spam engine for GitLab. It details the development process, including the creation of a spam testbed for analysis and prototyping, and the iterative deployment strategy starting in monitoring mode. The post highlights the data-driven approach, emphasizing logging for measurement and iteration, and compares Spamcheck's performance against Akismet, noting its strengths during spam waves and areas for improvement in false positive rates. It also mentions the collaborative effort across multiple teams for its development and upcoming deep dive into the tech stack.
Oct 2020How we work to detect and mitigate Spam on GitLab.com and beyondThis post details the work done to detect and mitigate spam on GitLab.com and for self-managed instances. It outlines the Trust and Safety team's role, defines abuse, and provides reporting mechanisms for GitLab.com users. For self-managed instances, it recommends enabling 2FA, using sign-up and sign-in restrictions, hardening the instance, and understanding abuse reporting. It also mentions rate limits for issue creation and user/IP limits. Future work includes exploring alternate captcha options, preventing bots from posting URLs, and developing new automation for spam detection and prevention.
Jun 2019Ask GitLab Security: Roger OstranderThis post details Roger Ostrander's role in abuse operations, focusing on combating spam, Bitcoin mining, phishing, and malware through automated detection and prevention tools. He highlights initiatives like addressing snippet spam via API changes and preventing malicious group names. Ostrander shares his journey into security and the broad technical expertise gained from his roles, including machine learning and solutions architecture. He also recounts a professional failure involving a mass subreddit ban and discusses the challenges and opportunities of transparency in security work, particularly in anti-abuse efforts.
Advertisement