Please shut down the /users/ feature

[smontanaro]

The webmasters got a take down letter from Autodesk today:

From: brandprotection@autodesk-mm.com
Date: Tue, Sep 12, 2017 at 3:01 PM
Subject: [Webmaster] Infringement of the Autodesk Inc. Trademarks and Copyrights [Case #522910]
To: webmaster@python.org

To Whom It May Concern:

1. I am the legal representative authorized to act on behalf of the owner, of certain intellectual property rights ("IP Owner");
2. I have a good faith belief that the website(s):
   https://www.python.org/users/AutoCAD2018/
   offer(s) items and contains materials that are not authorized by the IP Owner, its agent, or the law, and therefore infringes the IP Owner's rights; and
3. I represent that the information in the notification is accurate, and under penalty of perjury, that I am authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
4. I May Be Contacted At:
   Name of IP Owner: Autodesk Inc.
   Name and Title: Kevin Lara Vice-President, Assistant General Counsel and Assistant Secretary
   Company: Autodesk Inc.
   Address: 111 McInnis Parkway, San Rafael, California 94903
   Email: brandprotection@Autodesk-mm.com
   Telephone: 1.800.NOCOPIES
   Fax: 1.415.507.6162
5. Information on the material being infringed can be found below:
   Name of Copyright Owner: Autodesk Systems Inc.
   Country: United States
   Title of the copyrighted work: Autodesk Systems Inc. Software (various)
   Type of work: Software
   Specific online location (URL) where you can view our work:
   https://www.autodesk.com/products
6. The reasons that the URL website must be suspended are as follows:
   a. Offers pirated software or otherwise unauthorized item that violates the IP Owner's trademarks and copyright.
   b. Misuses the IP Owner's brand name, trademarks and copyright.
   Please suspend this website immediately so that our rights are no longer violated and that the proprietor of this site discontinues its criminal activities.
   By submitting this form, Autodesk Inc. agrees to indemnify the ISP against all claims or damages related to the suspension of the aforementioned infringing website(s).

Very Truly Yours,
Kevin Lara
Vice-President, Assistant General Counsel and Assistant Secretary
brandprotection@Autodesk-mm.com
1.800.NOCOPIES

Can we please block all /users/ URLs while we figure out if the feature is even needed?

[MarkMangoba]

@berkerpeksag lets block /users for now and reassess.

[MarkMangoba]

I just disabled the user account in question and deleted the content associated with this user.

[smontanaro]

Thanks. This was just the straw that broke the camel's back. From where I sit (watching webmaster and postmaster addresses) this feature doesn't seem to have any upside at the moment. At minimum, I suggest it be disabled unless and until it can be made a bit better spam/scam-proof.

…

On Sep 12, 2017 9:26 PM, "Mark Mangoba" ***@***.***> wrote: I just disabled the user account in question and deleted the content associated with this user. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1149 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADRNocY523HQJ5iNhmb_LkXIwJ2LHaqhks5shz1egaJpZM4PVa-Z> .

[malemburg]

Since the "bio" field is the only one where people can post links, I think it's good enough to simply not apply any rendering to the bio field when showing it under /users/.

Other than that, I'm also not convinced that showing more than the name of the PSF members in a (long) list is useful for /users/. There doesn't appear to be a need to show users of the website who are not PSF members.

BTW: Could someone at least describe what kind of content was posted on the account, so that it's clearer what the notice was about ? Thanks.

[berkerpeksag]

I've opened #916 to delete the user listing page a while ago. The decision was to keep it but fix its pagination.

Note that most of these spam accounts also created basic PSF membership for themselves.

/users/ is not directly related to this issue, but I prefer removing the bio field completely in /users/<username> until we find a way to prevent spamming.

I also wouldn't mind removing /users/ since what it does basically dump all user information to UI and it doesn't have any use case for python.org users.

[berkerpeksag]

32e619c should disable showing the bio field in /users/<username>.

[smontanaro]

BTW: Could someone at least describe what kind of content was posted on the account, so that it's clearer what the notice was about ? Thanks.

I believe it was a version of AutoCad which (probably?) had its licensing features disabled. Your guess is as good as mine about what nefarious bits the black hats might have added.

[malemburg]

On 13.09.2017 19:02, Skip Montanaro wrote: > BTW: Could someone at least describe what kind of content was posted on the account, so that it's clearer what the notice was about ? Thanks. I believe it was a version of AutoCad which (probably?) had its licensing features disabled. Your guess is as good as mine about what nefarious bits the black hats might have added.

Didn't anyone check before disabling the account ? If it was just the account name, then I think a take down notice goes a bit far.

…

-- Marc-Andre Lemburg http://www.malemburg.com/

[smontanaro]

Why should we have? This was done in response to a take down letter from AutoDesk. I forwarded it to legal@ and Van concurred that it should be taken down. On Wed, Sep 13, 2017 at 1:42 PM, Marc-Andre Lemburg < notifications@github.com> wrote:

…

On 13.09.2017 19:02, Skip Montanaro wrote: >> BTW: Could someone at least describe what kind of content was posted on the account, so that it's clearer what the notice was about ? Thanks. > > I believe it was a version of AutoCad which (probably?) had its > licensing features disabled. Your guess is as good as mine about what > nefarious bits the black hats might have added. Didn't anyone check before disabling the account ? If it was just the account name, then I think a take down notice goes a bit far. -- Marc-Andre Lemburg http://www.malemburg.com/ — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1149 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADRNoYWn8z6AYIke8pKSWfz92NxBto-Oks5siCIBgaJpZM4PVa-Z> .

[malemburg]

On 13.09.2017 21:56, Skip Montanaro wrote: Why should we have? This was done in response to a take down letter from AutoDesk. I forwarded it to legal@ and Van concurred that it should be taken down.

The letter doesn't identify what they were complaining about (it's a blanket letter that fits many difference things). Of course, we have to check whether a take request is legitimate and may have been the case. I just want to find out whether there was content on the profile which was infringing or whether it was just the account name itself. I checked the account data, but the history only says that the bio was edited by Mark.

…

-- Marc-Andre Lemburg http://www.malemburg.com/

[malemburg]

Nevermind, Google cache still had the content and the bio was indeed listing links, so this was a legitimate request.