Projects and spams

Question

Hello, I receive many spams through fake jira projects.
I would like to know :

Why am I automatically added to these projects, Without an email confirmation to accept to join the project?
And why I can't find any button to leave a project?

Your website and processes are lacking some base features and are very anoying when you are the target of spams...

(This really does not make me want to deepen my exploration of your services...)

Is the only solution to delete my account ?

Antoine Lafarge · Answer

I disagree, you could simply request permission from the guest user in an instance if they agree to join. This would greatly reduce spammers' interest in using this service because phishing links would not be automatically sent by email.
You are really the only ones to be so failing and to defend body-and-souls your wobbly system. It's very disappointing.
Since you don't want to take your responsibilities, I'm going to choose to delete my pro and personal accounts from your services, and stop wasting time giving you feedback that you don't listen to. Good continuation all the same.

Nic Brough -Adaptavist- · Answer

So...

Atlassian has a problem with its account system.  It is far too easy to set up an Atlassian account. There's very little verification (and to stay with the current big thing in IT, yes, you can ask an AI to do the whole lot for you, so yay for the ability to create abuse).

* This means it is easy to create a non-human account (i.e. a 'bot or a fake account.  There are legitimate uses for "service" accounts).
* Any Atlassian account can create free Atlassian systems in the Cloud.
* Any Atlassian system in the Cloud can be set up to add Atlassian accounts or even just arbitrary emails to them.
* Which lets them send email
* This means they can then spam people

There's no point railing against Atlassian for this - the maliciousness is not theirs.

Most of the problem here is not their systems or the way they work. They are designed to make it easy to let people work together.

The biggest problem is poor verification (ironically, something that the wonders of Generative AI are going to make a lot worse).  If they could improve the "hey, you're a 'bot account, go away" detection, we'd see a massive reduction in the spam problem and the "wastes my time" problem you rightly talk about.

The best thing to do, as @Max Foerster - K15t says, is to forward any email you get from an unwanted <something>.atlassian.net site to https://www.atlassian.com/trust/report-abuse (no need to explain, just forward).  The worst case I've had was a fortnight for them to shut it down, but I've seen the floodgate shut off inside an hour sometimes.

Antoine Lafarge · Answer

I hear, but I'm not convinced because I think that:

- You shouldn't start an answer by saying: "no, the problem you're highlighting doesn't exist."
It's pretty annoying to have to come here and waste time dealing with a problem that shouldn't exist but does.

- We are all on the same internet, we all know that someone will necessarily abuse and divert a service (especially free). That shouldn't come as a surprise, especially for a company like Atlassian

- So your Jira Cloud instance service should not be permissive by default. You should email collaborators to see if they want to join a Jira Cloud instance project. It's a bad design to not ask, and I shouldn't have to tell you that.

- There should be an option to leave a Jira Cloud instance project. It's not normal that we are stuck in it.

- I receive spam via your email services, which means that google considers them to be legitimate. You are responsible for what passes through your platforms. So you can't get away with not being responsible for it, especially when it's the result of bad service design. Also, if I start marking your atlassian notification emails as spam, google may consider other legitimate atlassian emails as spam in the future. Which of course is not a viable solution.

- It's not normal that I had to come and post a message here to find a solution. Competing services have similar spam problems, but provide one or more of the basic solutions listed above to overcome these problems. Your service is the only one I had issues with and got stuck like this with no solution available.

I understand that you want to help, and thank you for your time, but it's not normal that Atlassian wastes my time posting here and countering its own customer abuse. A solution must be found on your side, not mine.