If you follow either the Perl Dancer community or the Sinatra one, you may be aware of what happened yesterday: some unknown individual posed as different members of the Sinatra core team on CPAN ratings in order to trash Dancer. The comments posted were rude and clearly intented to harm the project or the people involved with it.

It’s not the first time Dancer is the target of an unknown individual (who always sends his attacks anonymously), we already experienced that whenever a news was posted to HackerNews about Dancer. But this time, the attack was more aggresive, 5 different accounts were created in a row on Bitcard to downgrade the CPAN ratings average of Dancer. Furthermore they used the names of known people in the Sinatra community, in order to make it look even more harmful.

But what was the result of that? Well, it turned out to be one of our most productive and positive marketing action since we launched our advent calendar. Yes. Because our first reaction when this came to our attention was to contact the Sinatra community, in order to check out with them if they were related to that or not.

Tunred out they had clearly nothing to do with this childish attacks, and were even as offended as we were that Sinatra could be associated to such low behaviour. In the end, the result of all this is an official statement from Sinatra saying that “Sinatra loves Dancer“. It has triggered a lot of very positive noise on Twitter for both Sinatra (who clearly appears to be a very classy community) and Dancer who benefits from the huge spotlight Sinatra gave. For this, I thank very gracefully the Sinatra community and more precisely Konstantin Haase.

Back from a CPAN author point of view, I wonder if we couldn’t make the CPAN-ratings system a bit more troll-safe. It is clearly very easy to create a bunch of accounts for poisoning on purpose a distribution. On the other hand, negative ratings should remain possible, otherwise the rating system would be useless (If as a CPAN author I delete all the negative reviews of my distributions, I alter the reality). I understand it’s a tricky design issue to solve, but I think we should spend energy on it.

In our case, we had the chance to be part of a very noisy event, and that helped us to have some of the fake ratings removed, but what would have happened if your distribution had less spotlights? If you don’t have an active community to defend it? If you don’t know who to contact to have some abusing ratings moderated? Then you’re vulnerable to trolls.

Maybe the following points could enhance the ratings system (feel free to comment on them):

• add a “Report abuse” link on the rating items, in order to be able to ask easily for moderation
• downgrade/hide/moderate any ratings that have a very high proportion of negative votes (like 1 of 20).
• prevent multiple accounts creation in a row: if the same IP address creates more than X accounts in the same time window, something suspicious may be happening, maybe we could block that IP for a while, like a day, …
• Another idea is to allow CPAN authors either not to appear on the CPAN-ratings page, or to reset their ratings (all of them)

I’m sure there are lots of other options. Feel free to comment on that. Maybe we could use also some sort of “reputation score” like StackOverflow does in order to enlight the ratings by revelance.

Related posts:

1. Dancer, global thoughts about our philosophy If you follow Perl5 blogs you may have been aware...
2. Dancer 1.150 released I’m happy to announce the release of Dancer 1.150. This...
3. Dancer 1.100 released A new version of Dancer has just been published on...

    * Support for multiple method routes at once with 'any'
    * Templates engines
      + Bug fixes in Dancer::Template::Simple (Jury Gorky)
      + Refactoring of the factory
      + option for disabling the layout in the template helper.
    * New session engine based on encrypted cookies (Alex Kapranof)
    * More HTTP codes supported for a better REST compat (Nate Jones)
    * Documentation updates
    * script/dancer now requires an appname
    * New Makefile.PL with better metadata (CPAN Service)

I’m pretty glad to underline that this release is the first one where most of the changes are written by other developers than me, that’s really exciting to see more and more people involved with the project.

This release should also fix the test-suite which looks to be broken on most of the CPAN testers under version 1.000 (but sadly not on my workstation, so I wasn’t aware of it).

UPDATE Jan. 7th 2010 : The CPAN-testers reports show that 1.100 passes 100% of the tests under Linux and FreeBSD, that’s a good start!
Stay tuned for next dances!

Related posts:

1. Dancer 1.150 released I’m happy to announce the release of Dancer 1.150. This...
2. Perl Dancer 0.9904 released I’ve just published a new version of Dancer. It’s basically...
3. Dancer 1.18 released I’m glad to announce a new major release of Dancer,...

Cette version corrige 3 bugs importants, pour les détails de cette version, voir le blog anglophone.

Related posts:

1. Nouvelle version de Coat::Persistent : 0.104 En travaillant sur mes slides pour FPW 2009, je me...
2. Nouvelle fonctionnalité pour Coat::Persistent : cache Une nouvelle fonctionnalité va faire son apparition d’ici peu de...
3. Publication de Coat::Persistent 0.200 Je viens d’uploader Coat::Persistent sur CPAN. Voila une bonne chose...