Problem

I've noticed a rather peculiar pattern of behaviour from one of our users. The person is creating theme projects that contains no code, and sets the version number to "1.0.0", suggesting that they're ready to use on production sites. Examples are:

The same individual has created a number of projects in the past, 11 are listed under "Projects" on the profile page. Of those, 4 are marked as "Unsupported" due to unfixed security vulnerabilities, 4 are just marked as "Unsupported", 1 is now maintained by someone else – and the two remaining projects does not seem to be well maintained (e.g. issues have been RTBC for a long time, but not reviewed by the project's owner).

I believe this sort of behaviour is harmful to our ecosystem. Having empty or unmaintained projects on the landing page when one uses Google to search for a solution to a particular problem helps no-one and reflects badly on the Drupal ecosystem.

However, before we hear from these users, I'll refrain from commenting on the the motivation behind this behaviour.

I've sent both users a PM to make them aware of this issue, and asked them to comment here.

Proposed resolution

If there is no response from an owner of an empty project 14 days after the person has been asked for an explanation, grade the project as "spam" and unpublish it.

If the person responds and wants to resolve the situation (typically by making the project's code available for download from the Drupal.org repo licensed under the GPL., close the matter as resolved.

Remaining tasks

  1. Get the user to comment here, and listen to what the user has to say about this.
  2. Figure out what to do, and proceed as suggested in the "Proposed solution" section.
  3. Do it.

Comments

gisle created an issue. See original summary.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Title: What to do we with multiple empty projects? » What do we do with multiple empty projects?

Basing on the first and last name, I take that https://www.drupal.org/u/weebpal and https://www.drupal.org/u/hai-nguyen have been created from the same person. From the biography, the first account seems thought to be used as organization account (I cannot say whether it's used from more than a person.)
If this is true, the commits done from both the accounts could be considered as done from the same person.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented

The projects created by https://www.drupal.org/u/weebpal during this year are the following.

The other projects have been created from the user on 2018, or earlier.

https://www.drupal.org/u/hai-nguyen has been used to create project releases and commit code for two different projects, one of which was created by https://www.drupal.org/u/weebpal.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Issue summary: View changes

I've spotted another user that recently has engaged in a somewhat similar activity.

His MO is create to project pages on Drupal.org without any code in the repo, but with a link on the project page to his own website where one can purchase the "premium" version of the missing extension. Examples:

Since these projects are derivative projects of Drupal, they must be distributed under the GPL. There is no mention of what license they are distributed under when you pay to download them from his own website, so at least the license they come with should be made clear.

I've sent the user a PM to make him aware of this issue, and asked him to comment here.

PS: This user originally came up on my radar because there were multiple spam reports for comments posted in issue queues here with links to his own website where one could buy "premium" Drupal 8/9 versions of various legacy Drupal 7 projects. These "premium" versions are clearly derivative works of Drupal. IMHO, using our issue queues to advertise "premium" software hosted elsewhere is spamming In accordance with our policies for dealing with spam, I've unpublished these comments and revoked his "confirmed" role. Please let me know if you disagree and think this reaction is too harsh.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Issue summary: View changes
minnur’s picture

minnur commented

Hi I am a developer for the following modules. Originally I was going to make those free but changed my mind and there is no way in D.o to delete projects, so I just put links back to my site:

- Entity Reference Patterns
- Autocomplete Labels

Feel free to delete those.

Thanks,

Minnur

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented

Here is a link to another project with zero lines of PHP-code in the repo:

There is a "Proposed solution" in the issue summary, but so far nobody as commented or up- or downvoted this proposed solution.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Issue summary: View changes

Also see #3248385: Request for 'confirmed' user role for request from user who created PushNinja. Still no code in the repo, user do not respond to requests for timeline for pushing code, and project page looks more like an advertisement for their services. Deleted as spam.

rushikesh raval’s picture

rushikesh raval commented

There is no response from user since long time, so projects may be un-publish as per proposed resolution.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Title: What do we do with multiple empty projects? » Policy for projects with commits but which do not contain a working module, theme, or installation profile
Component: Other » Policy
Category: Task » Plan
fjgarlin’s picture

fjgarlin commented

Important things to find out on these type of projects are:
- Do they have releases?
- Do they have issues?
- Do they have any usage reported?

If the projects are just spam, with no actual PHP code, we can delete them in this order:
- Delete issues
- Delete releases
- Delete projects

In this case, all these modules come from the same company, so it'd be good to ask them directly about this. Sometimes they might want to reserve a machine name, but if this is done to just show maintained projects in the company profile (credit gaming), then that's a different story.

But in any case, I think it's worth asking first. Luckily, it's not a common case so we might not need a strict policy in place.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented

I opened an issue for each of the themes listed in the issue summary.

rushikesh raval’s picture

rushikesh raval commented

I've spotted another user that has engaged in a somewhat similar activity.
user profile : shaggy

Here are links to another projects with zero lines of PHP-code in the repo:

rushikesh raval’s picture

rushikesh raval commented

adding some more projects

bramdriesen’s picture

bramdriesen
he/him
Primary language Dutch
Location Belgium 🇧🇪🇪🇺
commented

Nothing wrong with an empty sandbox in my opinion. They are a playground anyway and not ment to be installed.

I also have a few empty projects under my name. Usually because I have too many ideas, want to start on them but forget in the end or because I hit a technical obstacle. Usually I do it to have some place to work on and to reserve the namespace.

Note that the initial report was about empty modules with a tagged release!

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented

This issue is for projects with commits, but without code, which would not be recognized as modules, themes, installation profiles, or distributions by Drupal.
There is already a policy for empty projects. This issue is not focused on that policy.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Category: Plan » Task
Status: Active » Closed (outdated)

No comment has been posted for the issues I created. I marked the projects listed in the issue summary as obsolete and unsupported.

Luckily, it's not a common case so we might not need a strict policy in place.

It does not seem it is a common case. In any case, unpublishing or marking the projects obsolete and unsupported should be sufficient.