Two QA testers were creating accounts on a half dozen devices from a single IP as part of some manual QA for the mobile site and got locked out of account creation before they could finish. Not sure what the throttle rate is now for single IPs, but could we raise it a bit higher?
Do we need to throttle at all on Beta Cluster? If we do need it, can we only throttle for obvious bots/spammers (e.g., 100s of events per hour or something)?
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | hashar | T87704 Account creation throttling too restrictive on Beta Cluster | |||
| Resolved | None | T87841 Don't throttle WMF office IP(s) for account creation in beta | |||
| Resolved | Krinkle | T156983 User::isPingLimitable() should handle CIDR notation in $wgRateLimitsExcludedIPs |
In this case I would like to increase this number to the lowest useful spot.
Could you describe the use case a bit more? I can think of a couple:
For the second use-case we can do what we do in prod and have a specific lift of the limit for certain IPs for a specified time period.
For the first we should set the throttle at a level where we cover 99% of the time.
We should also probably unthrottle WMF Office IPs to avoid this in many cases as well.
This particular use-case is: a pair of testers manually creating accounts on a handful of different mobile devices all using the same IP. They're not in our office, so whitelisting the office IP wouldn't help. Apparently, they hit the limit after they created 6 accounts. From their email reporting the issue:
"Creating an exception for our IP may not work long term as it is a dynamic address and could change, but we can typically get through a test cycle that way. If you can give me a contact that can resolve/over-ride this lock out when it happens, that would work better."
Not sure if the ad hoc reporting of the issue to you guys would work, but this wouldn't happen all that often (they're testing every 2 weeks or so).
Interesting. Yeah, ad hoc might work. Do you know if they're always doing this from the same place (is this that outside contractor we have?)? We could probably whitelist that easily.
Otherwise, yeah, ad hoc a la how we do events seems easy enough. A request with the IP and a "need this by" date would be enough (with someone we trust filing that ticket). Using the Beta-Cluster-Infrastructure project should hit me and others who can respond.
And to respond to the actual limit: 6 does seem low. We can probably up that to something higher.
@Reedy / @chad: thoughts on a reasonable account creation limit for Beta Cluster (from a single IP)?