demo.ckan.org does not allow registration
Chealer opened this issue · comments
CKAN's demonstration site allows logins, but does not seem to allow registration. This was probably a somewhat intentional change to adress #5858 but the site has limited value until this is solved.
In the last dev meeting we discussed a few ideas, and I've added a couple more:
allow account creation but regularly reset the database to remove spam- offer a form to request access and manually review requests
- stop linking to demo.ckan.org and direct users to run a copy in github codespaces or similar
- link to a self-serve option provided by one or more ckan vendors
@EricSoroos pointed out that spammers will quickly adapt to option 1 to coordinate their spam with the database reset, so isn't a good choice
What do you think? Are there any options I've missed?
Is there a CAPTCHA properly integrated with the login process? The qld-gov-au fork has a reCAPTCHA integration working, if that would help.
Thank you wardi
Tiki Wiki CMS Groupware has been using a variant (the admin account's password is documented) of #1 for more than 12 years. I was not involved in the project for most of that duration, but I am not aware of spam being a serious issue there. It could be that spammers would target CKAN more than Tiki, but I would have thought the threat would be comparable.
Of course, per-user databases is ideal, and cmsmatrix.org used to offer that for Tiki and others, but that site has unfortunately disappeared.
Captchas are easily broken and as human labor is cheap, even if email addresses were verified, spammers will find places to spam. We have one our instances with open registration with captchas and email verification and spam was nearly weekly problem, until we limited publishing permissions. And that's with someone actually looking after the instance and removing spam. We have no resources to do it manually from demo.ckan.org.
I'm totally new to CKAN - I created a user at the demo system mid January 2024, but now I cannot login in and reset of password does not work - I have checked spam filter. I cannot create another user either. I assume my problems relate to the above.
If so, it would be nice if there was some kind of message information about that instead of the "wrong user / password" message which just lead to another try and reset of password .... :-)
Per-user databases would require per-user solr as well, which is a headache.
I wonder if there would be a way to do it where:
- User list is private
- No User/Group uploads for pictures
- Any datasets created are private, per user.
- Maybe put each user in their own (private?) org?
- All users/datasets/orgs/uploads are cleared on a periodic basis.
The goal being -- No way for a user to post anything public, but allow the user to make changes at a private level to test drive the system.
My feeling here is that it would wind up being a whack-a-mole game, because we're trying to allow random people to do some write operations, but not publicly accessible ones.
@alkragh I was under the impression that demo.ckan.org hadn't allowed registrations since 2021... for sure, that's the presumed issue this ticket meant to track. I can't explain how you would have registered in January though.
@EricSoroos a single Solr instance allows multiple indices. I can't imagine that being much more complicated than multiple databases on the same RDBMS, but then my knowledge of Solr is very limited. For sure, you're right that requiring per-user indices increases the complexity of allowing per-user demos.
Here's the 10 mins guide from Brett on how to launch CKAN quickly on Codespaces: https://www.youtube.com/watch?v=KGTyX3Nx9IU
Captchas are easily broken and as human labor is cheap, even if email addresses were verified, spammers will find places to spam.
Some will, yes. Others won't. Cheap is not free, and hiring CAPTCHA-breakers is an extra step that some script-kiddies might not bother with.