maemo.org - Talk

maemo.org - Talk (https://talk.maemo.org/index.php)
-   Community (https://talk.maemo.org/forumdisplay.php?f=16)
-   -   Bugzilla members' security? Publication of email addresses leads to spam? (https://talk.maemo.org/showthread.php?t=6377)

craftyguy 2010-03-09 18:47

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by GeneralAntilles (Post 561538)
You should probably seek to educate yourself about Andre's actual position before making statements like these. He doesn't actually work for Nokia, he works for maemo.org, nothing he says should ever be interpreted as an official statement from Nokia, since he's not actually an employee.

My apologies to Andre then.
Even if he's not making a statement as a Nokia employee, he's still a representative for the maemo.org community. Comments such as his (even though it was ultimately in jest) are not very professional when people are bringing up real concerns.

For the 'record', spam RARELY made it to my inbox before I joined in on the Maemo bugzilla fun, now I get several a day that make it past the gmail spam blocker..

Texrat 2010-03-09 18:49

Re: What? Bugzilla uses my email address as my ID?
 
*sigh*.....

Andre Klapper 2010-03-10 17:26

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Milhouse (Post 561190)
Can you at least explain what the Maemo/MeeGo policy is regarding the privacy of Bugzilla account emails - will they in future be visible to non-authenticated users, or not?

Bugzilla 3.4 does not show user account email addresses to people not authenticated. If it does somewhere, it is a bug.
Don't know of any Maemo/MeeGo policies about this.

Quote:

Originally Posted by Milhouse (Post 561190)
And depending on your answer, will Bugzilla 3.4 resolve bug 6873?

Yes. See comment 5 in that report.

Andre Klapper 2010-03-10 17:42

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by craftyguy (Post 561574)
My apologies to Andre then.

Heh, no problem.

Quote:

Originally Posted by craftyguy (Post 561574)
Even if he's not making a statement as a Nokia employee, he's still a representative for the maemo.org community.

Well, I could add a footer to each of my postings here:
"It should be obvious but in case it isn't: the opinions reflected here are my own. They are not the views of my employer, the Queen of England, George W. Bush or anyone else." (copied from mezcalero's blog).
However I have no plans to do that.
Plus I could also simply stay away from talk.maemo.org.
But I have no plans to do that either.

Quote:

Originally Posted by craftyguy (Post 561574)
Comments such as his (even though it was ultimately in jest) are not very professional when people are bringing up real concerns.

True. However I don't manage to be serious the entire day as work and open source communities should also be fun, and I can live with the fact that sometimes my specific sense of humour is confusing, not understood, or not well-received.
That's the collateral damage I am more than willing to accept as egoistically speaking I have a way better life by that.

Plus I get more hatemail (being the evil guy closing some unbelievably important bug reports/requests that will make the world collapse tomorrow if not getting fixed ASAP) that I collect and later on publish as a book to make lotsa $$$$!!!!

(Disclaimer: This was a bloody serious posting, as always.)

Milhouse 2010-03-10 17:49

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 562759)
Bugzilla 3.4 does not show user account email addresses to people not authenticated. If it does somewhere, it is a bug.

Thanks - I thought it best to ask as your boiler plate text confused me. No doubt it will confuse new bug reporters too, many of whom may decide not to bother signing up as a result.

Quote:

Originally Posted by Andre Klapper (Post 562759)
Don't know of any Maemo/MeeGo policies about this.

It might be worth clarifying that before we all pile headlong into the new meego.com defect tracking system. All organisations should at least decide and agree publicly that the privacy of their members/community is of paramount importance, even if they can't decide in a month of Sundays what fracking forum software to use (joke). :)

Quote:

Originally Posted by Andre Klapper (Post 562759)
Yes. See comment 5 in that report.

Thanks.

lma 2010-03-10 20:56

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 562772)
Plus I get more hatemail (being the evil guy closing some unbelievably important bug reports/requests that will make the world collapse tomorrow if not getting fixed ASAP) that I collect and later on publish as a book to make lotsa $$$$!!!!

Put me down for a copy!

jgombos 2010-05-30 14:11

Bug db forces non-disposable email addresses, then they publicize it!
 
bugs.maemo.org refuses to open new accounts for users who protect themselves with disposable email addresses. Then the db admins have the nerve to publicize everyones email address! This is totally reckless and irresponsible.

bugs.maemo.org is being harvested by spammers, who are then attacking these accounts chronically.

Has anyone discovered a type of disposable email address that bugs.maemo.org does not know about?

GameboyRMH 2010-05-30 14:13

Re: Bug db forces non-disposable email addresses, then they publicize it!
 
Gmail keeps the spam out.

Spam is a fact of life, you just have to deal with it. Having an email address that can't filter spam is like having a car with no roof - it's not practical for everyday use.

ToJa92 2010-05-30 14:17

Re: Bug db forces non-disposable email addresses, then they publicize it!
 
Quote:

Originally Posted by GameboyRMH (Post 689849)
Gmail keeps the spam out.

True that. I already got to my GMail account before I signed up here, so I never thought about that.

jgombos 2010-05-30 18:05

Re: Bug db forces non-disposable email addresses, then they publicize it!
 
Quote:

Originally Posted by GameboyRMH (Post 689849)
Gmail keeps the spam out.

Sure, as well as the legit email. Gmail is for simple users. Advanced users certainly do not depend on gmail accounts. It has false positives and in terms of capability it's too limiting. It's also weakly secured and far too inadequate to win support from any street wise users.

Know your audience. A bug tracking system needs to cater to advanced users. By accepting disposable addresses, this would not prevent basic users from supplying their gmail addresses if they want access.
Quote:

Originally Posted by GameboyRMH (Post 689849)
Spam is a fact of life,

Of course. You are stating my case.
Quote:

Originally Posted by GameboyRMH (Post 689849)
you just have to deal with it.

Exactly my point. So why limit yourself to one lousy mechanism for protection? You don't force everyone to adopt the lowest common denominator. It makes no sense from a security standpoint. The rule of least privilege trumps here. You don't disclose more sensitive information than needed for the job - even in your hypothetical world where there are no false positives, and all spam is detected as a true positive.
Quote:

Originally Posted by GameboyRMH (Post 689849)
Having an email address that can't filter spam is like having a car with no roof - it's not practical for everyday use.

Insisting that users rely on one instrument for protection is like having a car with a roof but no windows, and claiming the roof will protect you from the rain. It's not a complete solution. Nor is filtering.

Of course you still filter. But you do it based on content, not IP address. Gmails filtering is not sophisticated enough to rely wholly on content analysis. Gmail takes that crude and error prone step of blackballing IP addresses. Gmail also has blocks in place to prevent dynamic outbound FROM header fields. They overzealously try to stop their own users from sending spam, and as a result they restrict users from using the more effective self-defensive mechanisms.


All times are GMT. The time now is 15:58.

vBulletin® Version 3.8.8