maemo.org - Talk

maemo.org - Talk (https://talk.maemo.org/index.php)
-   Community (https://talk.maemo.org/forumdisplay.php?f=16)
-   -   Bugzilla members' security? Publication of email addresses leads to spam? (https://talk.maemo.org/showthread.php?t=6377)

craftyguy 2010-03-08 22:30

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560535)
Point missed.

Andre's comment was mild teasing humor. That's all. Attempts to make anything sinister out of it are utterly disingenuous.

Point acknowledged, but proved to be irrelevant because people interpret those stupid emoticons differently (as sarcasm, as joking, as 'softening' something offensive, etc).

For example:
Andre that was a very unprofessional thing to say to a real concern by a participating member of this community :)

Am I joking or being sarcastic, or hiding my opinion behind a smiley face :)

Ok, ok, I'm done.

Texrat 2010-03-08 22:45

Re: What? Bugzilla uses my email address as my ID?
 
It helps to actually know the person "speaking". Andre is a great guy, very personable, doubt there's a malicious bone in his body.

More importantly: erring to the side of caution in interpretation is good, too. ;)

geneven 2010-03-08 22:52

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560448)
craftyguy, note the emoticon after Andre's statement.

What a horrible world we're in if wry humor is now considered... horrible.

Maybe you would be good enough to explain the difference between the grin that expresses wry humor and the same grin expressing 'tough sh.t, you're out of luck, buddy.' I have a hard time distinguishing them.

Texrat 2010-03-08 23:31

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by geneven (Post 560572)
Maybe you would be good enough to explain the difference between the grin that expresses wry humor and the same grin expressing 'tough sh.t, you're out of luck, buddy.' I have a hard time distinguishing them.

context. like the poster's personality and history. and for those who lack the background, once again: err to the side of caution instead of automatically assuming ill intent.

noobmonkey 2010-03-08 23:37

Re: What? Bugzilla uses my email address as my ID?
 
have to admit, i'm not sure who to take seriously all the time, but i would hope that posts that raise questions for people... especially privacy should be dealt with with a bit less sarcasm at times, at least when its obvious people will get wound up...

Not a kill joy - but can see both sides to the debate here... and think both need a bit of respect :D

Texrat 2010-03-08 23:51

Re: What? Bugzilla uses my email address as my ID?
 
...and on the other side it would be nice if people dropped their anxiety at the door (that applies to me too, since I forget too often). ;)

noobmonkey 2010-03-08 23:54

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560617)
...and on the other side it would be nice if people dropped their anxiety at the door (that applies to me too, since I forget too often). ;)

hehe :D

yeah... res'pecccccct (Said in a daffy duck styleee) gets forgotten both sides when typing.... :(

Also people forget that you could be taking things really seriously... and at the other end of the debate is a Texrat sitting there sipping pina colada's next to a paddling pool :D (Well, relaxed anyway)

Oh the joys of t'internet and wireless ;)

Texrat 2010-03-08 23:56

Re: What? Bugzilla uses my email address as my ID?
 
Speaking of which, I'm about to have some red wine.

Are we done with the debate, yet? :D

craftyguy 2010-03-09 00:23

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560625)
Speaking of which, I'm about to have some red wine.

Are we done with the debate, yet? :D

Yes, have a glass(or three) for us! :)

pataphysician 2010-03-09 01:52

Re: What? Bugzilla uses my email address as my ID?
 
If you post to Google Groups your email can be seen be anyone in the group. Google doesn't clearly notify you at any point of joining a group that this will occur, though it is somewhere in their Privacy Policy, but if you already have a gmail account and are logged in you won't see the tiny link to their Privacy Policy, which only occurs if you go to google groups url when not signed in to a gmail account.

While this is common for some bug tracking and support groups to expose email addresses to members, unfortunately the Privacy Policy of maemo.org says

"You expressly accept and give your unambiguous consent that Nokia, Nokia’s subcontractors or agents performing support and thereto related tasks may have access to your Personal Information in order to complete the task in question. These entities performing these functions have accepted appropriate confidentiality obligations when processing your personal information. Your Personal Information will not be revealed to any third parties without your prior consent, except as otherwise provided above in this Privacy Policy or required by law, court order or law enforcement officials. "
http://maemo.org/legal/privacy_policy/

But there is no confidentiality agreement/obligation you submit to, when you join bugs.maemo.org, so it is not true that your personal information is only given to persons who have signed confidentiality agreements/obligations. Maemo needs to update their privacy policy. The policy was written in 2005, so this was well before there was a bugzilla for maemo, which started in 2008.

Maemo should look at Google Groups Privacy Policy, which clearly states that your email is available to all who are members of any group you join.

Texrat 2010-03-09 02:29

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by pataphysician (Post 560714)
Maemo should look at Google Groups Privacy Policy, which clearly states that your email is available to all who are members of any group you join.

Right. IMO that's the simplest, best solution.

YoDude 2010-03-09 04:33

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560535)
Point missed.

Andre's comment was mild teasing humor. That's all. Attempts to make anything sinister out of it are utterly disingenuous.

No it is the posts after that in support of his "mild teasing humor" statement that suck...

To everyone else my opinion is:

Bugzilla ain't freakin' "Facebook".
It is for serious reports from serious people, I have no problem with using my addy as I want a serious response to the dang bugs I report.

I also don't want the process ruined by anonymous, spammed bug reports. It is boring and tedious enough to manage the information I receive from this "anonymous" forum as it is.

I understood that the minute I crossed over from this forum and registered on the maemo.org side of the house.
Sooner or later ya got to grow up. :)

If you don't want your email addy displayed, simple fix: Register a throw away and change it to that on your user account page.

And for those piping up about legal requirements and whatnot... Good luck with that. What are you going to pay your lawyer with, karma?

I agree the standard MO response to "Feel Free to...(whatever)" can get a person riled up. Typically the first response to hearing that is well then "feel free to go... (whatever ;) ) yourself". :eek:

...but it is what it is.

If you're serious about improving your device then participate and deal with it.
If not then feel free to....

Texrat 2010-03-09 04:46

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by YoDude (Post 560787)
No it is the posts after that in support of his "mild teasing humor" statement that suck...

Just when I thought we were done with pointless provocation.

:rolleyes:

YoDude 2010-03-09 06:48

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560793)
Just when I thought we were done with pointless provocation.

:rolleyes:

:rolleyes::rolleyes::rolleyes:

If that one line is all that you got out my multi paragraph post then I guess you're the one that's not done. :)

tnhh 2010-03-09 07:48

Re: What? Bugzilla uses my email address as my ID?
 
This ridiculous debate has convinced me to leave maemo.org. I would like to delete my account. Please let me know who I should contact about this.

qwerty12 2010-03-09 07:52

Re: What? Bugzilla uses my email address as my ID?
 
Somebody's trying to leave.

Smithers, get the dogs!

twaelti 2010-03-09 08:30

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by tnhh (Post 560867)
This ridiculous debate has convinced me to leave maemo.org. I would like to delete my account. Please let me know who I should contact about this.

I hope you enjoyed the two months and thanks for all your valuable contributions :D
Ridicilous is only the assumption and naivety of the original poster who probably never used a bugtracker before and doesn't get the ideas of open source collaboration and teamwork, then people getting into privacy ranting mode (nobody posted your underwear pictures, but an email address useful for communication about specific problems where we share a common interest).
You know, some of us come from an age where E-Mail was all we had :D

ewan 2010-03-09 08:54

Re: What? Bugzilla uses my email address as my ID?
 
The title of this thread could equally well have been "ZOMG! Bugzilla is using my email address as an email address, I might get email!"

Really, that's what it's for.

cashclientel 2010-03-09 08:55

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 560066)
Accounts cannot be deleted (and it makes no sense anyway). You could disable it though.

Just to clarify on anyone that was confused by this "you can't delete accounts". He's actually correct - deleting an account would break the referential integrity of the system. Wherever the account had been used there would be a back hole if it was completely deleted. The parser would error out when trying to construct the page from the database.

To be technically correct you should 'null out' all the data on the account - email address, etc. Depending on your view to data protection you could also null out all previous comments by that account (so they show as being made, but just as a blank).

Rob1n 2010-03-09 10:00

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by cashclientel (Post 560914)
Just to clarify on anyone that was confused by this "you can't delete accounts". He's actually correct - deleting an account would break the referential integrity of the system. Wherever the account had been used there would be a back hole if it was completely deleted. The parser would error out when trying to construct the page from the database.

To be technically correct you should 'null out' all the data on the account - email address, etc. Depending on your view to data protection you could also null out all previous comments by that account (so they show as being made, but just as a blank).

Just have a single "Deleted user" account (with email notifications disabled), and merge any others into it when they ask to be deleted. There's scripts available for merging bugzilla accounts.

Andre Klapper 2010-03-09 11:14

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by craftyguy (Post 560440)
What a horrible "official" response to this issue from Nokia.

This was not an "official" response from Nokia as I do not work for Nokia. So please don't state that. Thanks.

Andre Klapper 2010-03-09 11:19

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560388)
I think the info should be clearly disclosed during account creation.

This will be fixed in the next weeks when we have finally upgraded maemo.org Bugzilla to version 3.4.
See https://landfill.bugzilla.org/bugzil...teaccount.cgi:

"PRIVACY NOTICE: Bugzilla is an open bug tracking system. Activity on most bugs, including email addresses, will be visible to the public. We recommend using a secondary account or free web email service (such as Gmail, Yahoo, Hotmail, or similar) to avoid receiving spam at your primary email address. "

As a general note, everybody can always test the latest stable Bugzilla version online, upstream at https://landfill.bugzilla.org/bugzilla-3.4-branch/ to check if any requests/improvements exist in that new version.

Andre Klapper 2010-03-09 11:19

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by ossipena (Post 560272)
btw does the bugzilla account creation state that the email wont be shown to anyone?

Bugzilla 3.4 will fix this by displaying a hint on account creation:
"PRIVACY NOTICE: Bugzilla is an open bug tracking system. Activity on most bugs, including email addresses, will be visible to the public. We recommend using a secondary account or free web email service (such as Gmail, Yahoo, Hotmail, or similar) to avoid receiving spam at your primary email address."

Andre Klapper 2010-03-09 11:46

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Rob1n (Post 560965)
Just have a single "Deleted user" account (with email notifications disabled), and merge any others into it when they ask to be deleted. There's scripts available for merging bugzilla accounts.

Uhm, that sounds dirrrrty!
So let's say three employees of the company X quit the company and have been active in the Bugzilla of X. Now "deleting" these three user accounts and merging them into one big "Once upon a time this was a Bugzilla user" account will make it impossible later on to see which person has written (and especially: decided) what. Unlikely that this is wanted from a company and community point of view with regard to transparency.

Milhouse 2010-03-09 12:16

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Texrat (Post 560252)
- I get no spam at all due to this;

Wish I could say different - I've been receiving spam regularly on my b.m.o. email address for the last few months and I wouldn't be surprised if it's related to bug #6873 which, for an information security issue, is getting sod all attention. For years we've asked people to vote on bugs, and their reward is to have their email addresses exposed for potential harvesting by spammers.

Quote:

Originally Posted by Texrat (Post 560388)
In the context of bug reporting, why would we want anonymity from participants?

A fair question, but why is it necessary to show email addresses at all?

The system knows who each individual is, the system should be displaying full names and never email addresses.

Unless I'm missing an obvious point, there should be absolutely no reason for me or anyone else to know someone's email address in Bugzilla. The only time this has been useful is when adding someone manually as a CC - as I did recently (to no avail) with Sergio on a Modest/POP bug - but there should instead be a mechanism where I can search for his full name and the system then adds his reference, his email doesn't need to be known by me or divulged to me.

It really is a deficiency of the Bugzilla design that it leaks private and personal information *unnecessarily*.

Quote:

Originally Posted by thp (Post 560479)
Privacy-loving people should already know about mailinator.com and other pages that allow users to create "throw-away" e-mail addresses on the fly.

There also exist services that allow you to create temporary-forwarding addresses that will accept only a few (e.g. 10) mails and then stop fowarding mail to your real address. Can't remember right now how that service is called, though.

The problem with temporary addresses in the context of Bugzilla is that you will never be notified of updates to your bugs, and when there are requests for "more information" it's a sure fire way to see the bug closed, unresolved, sooner than later, when nobody responds (as they no longer receive the notification emails...)

Drive-by Bug creation is not something to be recommended. :)

Quote:

Originally Posted by Andre Klapper (Post 561040)
"PRIVACY NOTICE: Bugzilla is an open bug tracking system. Activity on most bugs, including email addresses, will be visible to the public. We recommend using a secondary account or free web email service (such as Gmail, Yahoo, Hotmail, or similar) to avoid receiving spam at your primary email address. "

Hold on, does this mean email addresses will be open to EVERYONE or only authenticated/logged in users? If the former, do you also define "fixing it" as "making the current situation worse"? It does sound like this warning is just a band-aid over a gaping wound - the underlying problem is the design of Bugzilla which is unnecessarily poor in respect of user privacy.

Honestly, what benefit is to be gained from displaying email addresses at all in Bugzilla, even to authenticated users? Are there any plans to enhance Bugzilla so that it is able to function without users publicly viewing or entering email addresses?

ossipena 2010-03-09 12:36

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Milhouse (Post 561105)
Hold on, does this mean email addresses will be open to EVERYONE or only authenticated/logged in users?

emails have never been open to everyone, only to people who have a bugzilla account.

Milhouse 2010-03-09 12:46

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by ossipena (Post 561125)
emails have never been open to everyone, only to people who have a bugzilla account.

Yes, and I hope that remains the case although I think Bugzilla (the software) needs to go further and dispense with visible email addresses entirely.

However regarding b.m.o., the new warning doesn't differentiate between authenticated and non-authenticated users.

Being the uber cynic that I am, one way of resolving the information security issues that have plagued b.m.o. since it's inception would be to not bother protecting emails at all and just rely on this warning text... ie. putting the onus on the end user.

Andre Klapper 2010-03-09 12:51

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Milhouse (Post 561134)
Yes, and I hope that remains the case although I think Bugzilla (the software) needs to go further and dispense with visible email addresses entirely.

...as for example Launchpad does. I totally agree, but must also admit that I don't track Bugzilla upstream development closely, so I have no idea if there are plans for this.

lemmyslender 2010-03-09 12:53

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by ossipena (Post 561125)
emails have never been open to everyone, only to people who have a bugzilla account.

Yes, but that's not what the privacy notice states. It could be worded more accurately ie "registered users" instead of "public".

That could give novice users a reason to not register or use throwaway email and defeat the purpose.

Andre Klapper 2010-03-09 12:53

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Milhouse (Post 561105)
Are there any plans to enhance Bugzilla so that it is able to function without users publicly viewing or entering email addresses?

Don't know myself - best to query/ask upstream (Mozilla).

Andre Klapper 2010-03-09 13:25

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by lemmyslender (Post 561141)
Yes, but that's not what the privacy notice states. It could be worded more accurately ie "registered users" instead of "public".

True. Feel free to file this as a bug report in bugzilla.mozilla.org so it can get fixed.

Milhouse 2010-03-09 13:52

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 561168)
True. Feel free to file this as a bug report in bugzilla.mozilla.org so it can get fixed.

Can you at least explain what the Maemo/MeeGo policy is regarding the privacy of Bugzilla account emails - will they in future be visible to non-authenticated users, or not?

The wording of the Bugzilla 3.4 notice is ambiguous because b.m.o. has made an effort in the past to hide emails from non-authenticated users, and this may be non-standard out-of-the-box behaviour hence why the upstream message is inaccurate (in which case filing a bug is pointless, no?)

And depending on your answer, will Bugzilla 3.4 resolve bug 6873?

Thanks. :)

ewan 2010-03-09 14:08

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 561168)
True. Feel free to file this as a bug report in bugzilla.mozilla.org so it can get fixed.

It is free software; you're allowed to customise it yourself.

I think the warning is a terrible idea since it will inevitably lead to people setting up new addresses, then ignoring them completely which does no one any good.

Ewan

lemmyslender 2010-03-09 14:43

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by Andre Klapper (Post 561168)
True. Feel free to file this as a bug report in bugzilla.mozilla.org so it can get fixed.

Thanks, but no thanks :)

Not passionate enough about this to:
1) sign up for another account online (that I likely won't ever use again),
2)expose my email address in yet another bugtracker (or use a throwaway one, bad),

Just to address an issue with verbiage in a warning that tells me how I'm exposing my email address? Which might not get changed anyway?

Any one else that already has an account at bugzilla.mozilla.org please feel free to step in and file a bug :)

TA-t3 2010-03-09 16:14

Re: What? Bugzilla uses my email address as my ID?
 
There is a vast difference between email addresses exposed in mailing lists, and email addresses exposed on web pages. The latter ones are always harvested by spammers, the former only rarely. Fortunately bugzilla apparently forces you to have an account before you see any email address, but I've always been surprised why it has to expose them in the first place. To see them in the bugzilla emails themselves isn't a big problem. However, I don't see why there's should be some technical reason to expose them on the web page. Even though there's a veneer of protection (=the need for an account) over it.

For the record, I have some email addresses that have been rendered completely useless because they were exposed on the web by some software, I typically get thousands of spam messages a month there. I can't use them anymore. Just pray that you didn't use your primary email address (the one all your friends and colleagues know about) when that happens to you.

pelago 2010-03-09 16:31

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by TA-t3 (Post 561368)
Fortunately bugzilla apparently forces you to have an account before you see any email address

Unfortunately it seems to be worse than that. Visit https://bugs.maemo.org/votes.cgi?act...ug&bug_id=5357 while not logged onto Bugzilla, for example.

TA-t3 2010-03-09 16:33

Re: What? Bugzilla uses my email address as my ID?
 
Ops... you're right. Now that is bad, whatever way you look at it. Some simple obfuscation should at least be added (most web-interfaces to mailing lists do that).

Rob1n 2010-03-09 16:49

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by TA-t3 (Post 561397)
Ops... you're right. Now that is bad, whatever way you look at it. Some simple obfuscation should at least be added (most web-interfaces to mailing lists do that).

According to the bug report, that's fixed in the new Bugzilla version.

GeneralAntilles 2010-03-09 18:20

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by craftyguy (Post 560440)
What a horrible "official" response to this issue from Nokia. Yes it's an official response because you represent Nokia as an employee.
Discouraging others from participating in debugging your buggy software just because they have privacy issues?? Tisk tisk..

You should probably seek to educate yourself about Andre's actual position before making statements like these. He doesn't actually work for Nokia, he works for maemo.org, nothing he says should ever be interpreted as an official statement from Nokia, since he's not actually an employee.

GeneralAntilles 2010-03-09 18:26

Re: What? Bugzilla uses my email address as my ID?
 
Quote:

Originally Posted by TA-t3 (Post 561368)
For the record, I have some email addresses that have been rendered completely useless because they were exposed on the web by some software, I typically get thousands of spam messages a month there. I can't use them anymore. Just pray that you didn't use your primary email address (the one all your friends and colleagues know about) when that happens to you.

Interestingly enough I have two primary email accounts, one of which has been in use since 2000 and both of which are plastered all of the web. The spam rate on both is less than a message a day.


All times are GMT. The time now is 15:58.

vBulletin® Version 3.8.8