Reply by email functionality disabled in Gitlab

[Ben Cooksley]

Hi all,

This is just a heads up that due to a recent wave of abuse centered around
the Service Desk function in Gitlab, i've had to disable incoming email
functionality on invent.kde.org this morning. As a consequence, you will no
longer be able to reply to emails from Gitlab and have that reply appear on
the issue / merge request in question.

This has been needed because abusive actors have discovered that the
Service Desk function in Gitlab can be (ab)used to send emails to people
using a configurable per-project template.

This has happened a couple of times now in isolated instances, but a more
concentrated wave happened today (with over 4,100 issues being created,
with multiple people per issue being opened, so probably ~10k spam emails
being sent using invent.kde.org). These attacks appear to be a
phishing campaign
targeting Vinted (a second hand sales platform) on essentially all
occasions this has happened.

This was also why email delivery earlier today was running slow - because
every single message going out of invent.kde.org is subject to spam checks
(and unfortunately the nature of this being a fairly small but targeted
campaign means SpamAssassin unfortunately was unable to block this).

Please let me know if there are any issues with this.

Thanks,
Ben
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20260916/fd284168/attachment.htm>