2026-09-14T01:03:50  <matrix-o-o> <jeff_mahoney> Submitted as https://github.com/openSUSE/paste-o-o/pull/302 if anyone is interested
2026-09-14T01:13:05  <matrix-o-o> <malcolmlewis> jeff_mahoney: Looks good to me 😄
2026-09-14T02:57:47  <matrix-o-o> <Emma [it/its]> too bad its word soup generator written
2026-09-14T03:02:04  <matrix-o-o> <knurpht - Gertjan> Emma [it/its]: 👎️
2026-09-14T03:07:19  <matrix-o-o> <malcolmlewis> Emma [it/its]: A means to an end...
2026-09-14T03:19:40  *** teepee_ is now known as teepee
2026-09-14T06:27:07  <matrix-o-o> <jeff_mahoney> I’ll accept that as approval given that you didn’t address the code at all.
2026-09-14T20:55:49  <matrix-o-o> <jeff_mahoney> How long are logs kept for paste.opensuse.org? There is a question posted in review about whether it's really necessary to require authentication for the API or if the abuse comes from just the web posting
2026-09-14T21:08:02  <matrix-o-o> <malcolmlewis> jeff_mahoney: well you do have to login to create the API key, so I would assume the user can be identified and dealt with as appropriate?
2026-09-14T21:10:33  <matrix-o-o> <SFaulken> I suspect its coming over the API, just based on the patterns I see, when going through the recents list, but that’s just a feeling.
2026-09-14T21:20:31  <matrix-o-o> <jeff_mahoney> malcolmlewis: To use the "new" API, yes. It's still possible to do a "POST /" request to create pastes
2026-09-14T21:21:01  <matrix-o-o> <jeff_mahoney> For example:
2026-09-14T21:21:26  <matrix-o-o> <jeff_mahoney> For example:
2026-09-14T21:58:10  <matrix-o-o> <jeff_mahoney> Interesting, while looking into susepaste, I discovered a different bug - even if the user specifies an API key, the server only uses it to authenticate the request but doesn't associate the request with the account owner.
2026-09-14T22:05:31  <matrix-o-o> <SFaulken> Yeah, I seem to recall the “username” field in ~/.susepaste can basically be anything the user decides they want it to be, if that’s what you’re talking about
2026-09-14T22:46:58  <matrix-o-o> <malcolmlewis> SFaulken: Yes, it is/was anonymous, no API key needed