++ Goes on Hiatus
If you saw @kraih's recent MetaCPAN tweet, you'll know that MetaCPAN's ++ feature has been gamed. Now, we were aware there was some potential for gaming. Initially you needed a PAUSE id to be able to ++, but this had an unexpected side effect in that there were some requests for PAUSE accounts with the justification of "I'd like to be able to ++ on MetaCPAN". Because this placed an additional burden on the already busy PAUSE admins, we were asked to remove this requirement.
The result of this was that the bar was now much lower for someone who wanted to create a MetaCPAN account and begin using the ++ feature. People behaved and used the feature as it was meant to be used. It was helpful, a great addition to the site and it led to a fun little leaderboard where you could get a glimpse of what people in the Perl community care about in general. You could also view recent ++ activity, which could give you an indication of what is trending "right now". So far, so good. The code was written in good faith and the community used it in that same spirit.
Earlier this week someone start to game the system, apparently creating fake Github accounts, creating MetaCPAN accounts with that Github login and then boosting first Dancer and the Mojolicious in the leaderboard. I don't know if it was the same person and I really don't care to do the research. By later today the bot was adding ++ data for modules which didn't even exist -- a bug we weren't aware of. It was getting to the point of silliness and the ++ feature had at best been rendered useless and at worst become somewhat of an embarrassment.
So, earlier this evening, I turned off the ++ feature on the MetaCPAN front end. I'm not going to pontificate on whether the bot behaviour is good (points out an obvious weakness in the code) or if it's bad behaviour (the exploit was run without an appropriate issue being opened first). What I am going to say is that a feature which was very helpful to many people has been now taken offline. A lot of work goes into this stuff and some of that work has been rendered useless for the time being. I can't give any kind of estimate as to when this might come back online. The limiting factors are a) finding an appropriate way of limiting abuse and b) finding a volunteer to sink the necessary hours into it.
So, I'd like to extend my congratulations to the person(s) who sunk the time into defeating the ++ system, but who conversely can't be bothered to provide a patch to fix the hole. You've accomplished what you set out to do and now somebody else gets to clean up after you. Your parents must be so proud.