From mtb19 at columbia.edu Mon Jun 4 01:56:31 2012 From: mtb19 at columbia.edu (Matthew Bogosian) Date: Sun, 3 Jun 2012 18:56:31 -0700 Subject: Self-Introduction: Matt Bogosian Message-ID: <6A3115FD-A748-4589-998B-60C6280BEDA0@columbia.edu> Name: Matthew T. Bogosian (I go by "Matt", but answer to "Matthew", "Hey you!", etc.) IRC nick: posita City/Country/Timezone: Marina CA, United States (PST/PDT) Profession (former): software engineer/architect Profession (current): patent attorney (hobbyist coder) Desired area of focus: i18n, l10n, etc. One mark of success for software is that it is used to solve problems largely unanticipated during its inception and development. Collaborative tools outside of software development SUCK (a severe understatement). Bugzilla is an outstanding issue tracker (and even work-flow manager) that surpasses nearly every other (often very expensive) industry-specific product available. I'm interested in assisting in allowing Bugzilla installations to be adaptable to a more diverse set of environments without disrupting its core utility as the best bug tracking software on the planet. I am acutely aware that most adaptation is appropriately done through extensions. My understanding is that certain fixes and enhancements to the core would not only make these adaptations easier and more fruitful, but they would help with the core focus on software defect tracking as well. Historical qualifications: Spent 10 years in software development (mostly back-end unix-y environments). Worked for Amazon.com (used Bugzilla internally) and Yahoo.com (uses Bugzilla) for a little while among various start-ups (most of which used Bugzilla internally). I miss it. (Warning: I may be a little rusty at some things, so please have patience with me.) Now my day job is writing patents (I never thought I'd spend so much time agonizing over language), but I still hack on the side. :o) Looking forward to discussions. Hopefully my presence is ultimately helpful.... --Matt -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: PGP.sig Type: application/pgp-signature Size: 243 bytes Desc: This is a digitally signed message part URL: From mcote at mozilla.com Mon Jun 4 17:03:36 2012 From: mcote at mozilla.com (=?UTF-8?B?TWFyayBDw7R0w6k=?=) Date: Mon, 04 Jun 2012 13:03:36 -0400 Subject: BMO Meeting Minutes Message-ID: The bugzilla.mozilla.org team has recently begun recording minutes of our weekly meetings. If you're curious about what's going on in the world of BMO, and our plans for the future, check out https://wiki.mozilla.org/BMO/Meetings Mark _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From steven_tierney at yahoo.co.uk Tue Jun 5 15:57:06 2012 From: steven_tierney at yahoo.co.uk (Steven Tierney) Date: Tue, 05 Jun 2012 16:57:06 +0100 Subject: Please advise on security Message-ID: <4FCE2C52.2090807@yahoo.co.uk> Hi, I have developed a new extension for Bugzilla. It uses the web service to access previously entered bug information in order to suggest autocomplete data for custom fields. Using jQuery, it's fully configurable through Bugzilla web pages accessible from within the Administration area. There are security implications here because it will potentially expose bug data which might otherwise be secure. For that reason I need advice on how to verify in the web service that 1. a user is logged in and, 2. is cleared to access bug data. I did check the Bugzilla source files but, not being very used to coding in Perl and not knowing how security 'works' in Bugzilla, I don't know where to start! I wonder if anyone can point me towards some documentation or give advice / code snippets that may help. The validation has to happen in the Webservice.pm file of the extension. Thanks in advance! --- Steven From wurblzap at gmail.com Tue Jun 5 16:15:42 2012 From: wurblzap at gmail.com (Marc Schumann) Date: Tue, 5 Jun 2012 18:15:42 +0200 Subject: Please advise on security In-Reply-To: <4FCE2C52.2090807@yahoo.co.uk> References: <4FCE2C52.2090807@yahoo.co.uk> Message-ID: Steven, use Bugzilla->user to find out whether the user is logged in (see http://www.bugzilla.org/docs/tip/en/html/api/Bugzilla.html). Check out http://www.bugzilla.org/docs/tip/en/html/api/Bugzilla/User.html, too -- there are some can_see_* methods which may be of use to you. Further reading is at http://www.bugzilla.org/docs/tip/en/html/api/. Good luck Marc 2012/6/5 Steven Tierney > Hi, > > I have developed a new extension for Bugzilla. It uses the web service to > access previously entered bug information in order to suggest autocomplete > data for custom fields. Using jQuery, it's fully configurable through > Bugzilla web pages accessible from within the Administration area. > > There are security implications here because it will potentially expose > bug data which might otherwise be secure. For that reason I need advice on > how to verify in the web service that > 1. a user is logged in and, > 2. is cleared to access bug data. > > I did check the Bugzilla source files but, not being very used to coding > in Perl and not knowing how security 'works' in Bugzilla, I don't know > where to start! > > I wonder if anyone can point me towards some documentation or give advice > / code snippets that may help. > > The validation has to happen in the Webservice.pm file of the extension. > > > Thanks in advance! > -------------- next part -------------- An HTML attachment was scrubbed... URL: From gerv at mozilla.org Tue Jun 5 16:30:52 2012 From: gerv at mozilla.org (Gervase Markham) Date: Tue, 05 Jun 2012 17:30:52 +0100 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: On 04/06/12 18:03, Mark C?t? wrote: > The bugzilla.mozilla.org team has recently begun recording minutes of > our weekly meetings. If you're curious about what's going on in the > world of BMO, and our plans for the future, check out > > https://wiki.mozilla.org/BMO/Meetings Is there a feed, or some other way of hearing about new sets of minutes apart from checking that page periodically? Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From dkl at mozilla.com Tue Jun 5 18:01:43 2012 From: dkl at mozilla.com (David Lawrence) Date: Tue, 05 Jun 2012 14:01:43 -0400 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: <4FCE4987.8050705@mozilla.com> It would be nice to set up a feed for this for sure. Is there an example from other team meetings we can see how to set this up? I can work on that once I know where to look. dkl On 06/05/2012 12:30 PM, Gervase Markham wrote: > On 04/06/12 18:03, Mark C?t? wrote: >> The bugzilla.mozilla.org team has recently begun recording minutes of >> our weekly meetings. If you're curious about what's going on in the >> world of BMO, and our plans for the future, check out >> >> https://wiki.mozilla.org/BMO/Meetings > > Is there a feed, or some other way of hearing about new sets of minutes > apart from checking that page periodically? > > Gerv > > > _______________________________________________ > dev-apps-bugzilla mailing list > dev-apps-bugzilla at lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-apps-bugzilla > - > To view or change your list settings, click here: > -- David Lawrence dkl at mozilla.com From glob at mozilla.com Wed Jun 6 04:34:09 2012 From: glob at mozilla.com (Byron Jones) Date: Wed, 06 Jun 2012 12:34:09 +0800 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: <4FCEDDC1.6010800@mozilla.com> Gervase Markham wrote: > Is there a feed, or some other way of hearing about new sets of minutes > apart from checking that page periodically? yes, all wiki pages have a built in rss feed. in this case you'd want https://wiki.mozilla.org/index.php?title=BMO/Meetings&action=history&feed=atom you can also watch the wiki page to receive an email notification. -- byron - irc:glob - bugzilla.mozilla.org team - -------------- next part -------------- An HTML attachment was scrubbed... URL: From steven_tierney at yahoo.co.uk Wed Jun 6 07:04:57 2012 From: steven_tierney at yahoo.co.uk (Steven Tierney) Date: Wed, 6 Jun 2012 08:04:57 +0100 (BST) Subject: Please advise on security In-Reply-To: <4FCE2C52.2090807@yahoo.co.uk> References: <4FCE2C52.2090807@yahoo.co.uk> Message-ID: <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> Hi Marc, Thanks for your quick reply. I had a look at the links you suggested, thanks for them. In my extension/Extension.pm file I try to get the logged in user and there is no problem, the logged in user & encrypted password can be found. The problem I face is at the callback stage. ?Eg. The user types 3 characters into the field and that triggers the Javascript to issue a callback to the web service.? At the callback time I try to do the find (in my extension/lib/WebService.pm file) but the logged in user is undefined. ? I can't help thinking I'm missing something blindingly obvious! ?Do I need to pass in credentials when calling the webservice, so that the user can first be logged in here then the details I need can be found? ?That can be done but I don't want to be writing the user id and encrypted password to the page, or depending on a browser cookie. ? I don't know what the proper 'bugzilla' methodology/workflow of using the web service is. Anyway I am rambling on! ?If you could offer me further guidance it would be greatly appreciated. Thanks, --- Steven On 5 June 2012 17:15, Marc Schumann??wrote: Steven, > >use Bugzilla->user to find out whether the user is logged in (see?http://www.bugzilla.org/docs/tip/en/html/api/Bugzilla.html). >Check out?http://www.bugzilla.org/docs/tip/en/html/api/Bugzilla/User.html, too -- there are some can_see_* methods which may be of use to you. > >Further reading is at?http://www.bugzilla.org/docs/tip/en/html/api/. > >?? Good luck >????? Marc > > > >2012/6/5 Steven Tierney? > >Hi, >> >>I have developed a new extension for Bugzilla. ?It uses the web service to access previously entered bug information in order to suggest autocomplete data for custom fields. ?Using jQuery, it's fully configurable through Bugzilla web pages accessible from within the Administration area. >> >>There are security implications here because it will potentially expose bug data which might otherwise be secure. ?For that reason I need advice on how to verify in the web service that >>1. a user is logged in and, >>2. is cleared to access bug data. >> >>I did check the Bugzilla source files but, not being very used to coding in Perl and not knowing how security 'works' in Bugzilla, I don't know where to start! >> >>I wonder if anyone can point me towards some documentation or give advice / code snippets that may help. >> >>The validation has to happen in the Webservice.pm file of the extension. >> >> >>Thanks in advance! -------------- next part -------------- An HTML attachment was scrubbed... URL: From aliustek at gmail.com Wed Jun 6 07:14:35 2012 From: aliustek at gmail.com (Ali Ustek) Date: Wed, 6 Jun 2012 08:14:35 +0100 Subject: Please advise on security In-Reply-To: <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> References: <4FCE2C52.2090807@yahoo.co.uk> <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> Message-ID: Steven, Bugzilla->user object can be used to find the details of the user in the current session, just check the objects methods Regards, Rojanu On Jun 6, 2012 8:05 AM, "Steven Tierney" wrote: > Hi Marc, > > Thanks for your quick reply. > > I had a look at the links you suggested, thanks for them. > > In my extension/Extension.pm file I try to get the logged in user and > there is no problem, the logged in user & encrypted password can be found. > > The problem I face is at the callback stage. Eg. The user types 3 > characters into the field and that triggers the Javascript to issue a > callback to the web service. > > At the callback time I try to do the find (in my > extension/lib/WebService.pm file) but the logged in user is undefined. > > I can't help thinking I'm missing something blindingly obvious! Do I need > to pass in credentials when calling the webservice, so that the user can > first be logged in here then the details I need can be found? That can be > done but I don't want to be writing the user id and encrypted password to > the page, or depending on a browser cookie. > > I don't know what the proper 'bugzilla' methodology/workflow of using the > web service is. > > Anyway I am rambling on! If you could offer me further guidance it would > be greatly appreciated. > > > Thanks, > --- > Steven > > > > On 5 June 2012 17:15, Marc Schumann wrote: > >> Steven, >> >> use Bugzilla->user to find out whether the user is logged in (see >> http://www.bugzilla.org/docs/**tip/en/html/api/Bugzilla.html >> )**. >> Check out http://www.bugzilla.org/docs/**tip/en/html/api/Bugzilla/User.** >> html , >> too -- there are some can_see_* methods which may be of use to you. >> >> Further reading is at http://www.bugzilla.org/docs/**tip/en/html/api/ >> . >> >> Good luck >> Marc >> >> >> 2012/6/5 Steven Tierney >> >>> Hi, >>> >>> I have developed a new extension for Bugzilla. It uses the web service >>> to access previously entered bug information in order to suggest >>> autocomplete data for custom fields. Using jQuery, it's fully configurable >>> through Bugzilla web pages accessible from within the Administration area. >>> >>> There are security implications here because it will potentially expose >>> bug data which might otherwise be secure. For that reason I need advice on >>> how to verify in the web service that >>> 1. a user is logged in and, >>> 2. is cleared to access bug data. >>> >>> I did check the Bugzilla source files but, not being very used to coding >>> in Perl and not knowing how security 'works' in Bugzilla, I don't know >>> where to start! >>> >>> I wonder if anyone can point me towards some documentation or give >>> advice / code snippets that may help. >>> >>> The validation has to happen in the Webservice.pm file of the extension. >>> >>> >>> Thanks in advance! >> >> -------------- next part -------------- An HTML attachment was scrubbed... URL: From gerv at mozilla.org Wed Jun 6 10:21:25 2012 From: gerv at mozilla.org (Gervase Markham) Date: Wed, 06 Jun 2012 11:21:25 +0100 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: On 06/06/12 05:34, Byron Jones wrote: > yes, all wiki pages have a built in rss feed. > in this case you'd want > https://wiki.mozilla.org/index.php?title=BMO/Meetings&action=history&feed=atom True; although it's not the most user-friendly way of getting the content into an RSS reader :-) > you can also watch the wiki page to receive an email notification. Also true. Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From gerv at mozilla.org Wed Jun 6 10:22:33 2012 From: gerv at mozilla.org (Gervase Markham) Date: Wed, 06 Jun 2012 11:22:33 +0100 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: On 05/06/12 19:01, David Lawrence wrote: > It would be nice to set up a feed for this for sure. Is there an example > from other team meetings we can see how to set this up? I can work on > that once I know where to look. I'm not sure who runs it, but there are various team meetings whose notes get blogified: http://blog.mozilla.org/meeting-notes/ Looks like Jesper Kristiansen might be the guy... Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From wurblzap at gmail.com Wed Jun 6 10:59:07 2012 From: wurblzap at gmail.com (Marc Schumann) Date: Wed, 6 Jun 2012 12:59:07 +0200 Subject: Please advise on security In-Reply-To: <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> References: <4FCE2C52.2090807@yahoo.co.uk> <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> Message-ID: Steven, unless you use ENV authentication (which you probably don't), Bugzilla uses cookies to identify the logged in user. I believe Javascript sends these unless you did something so that it doesn't, so you should be fine... Maybe you can take a look at what YAHOO.bugzilla.userAutocomplete does (in js/field.js), calling User.get (in Bugzilla/WebService/User.pm). User.get calls can_see_user, referencing the logged in user, and it works. Maybe you can use this as a template for your web service call. Best Marc -------------- next part -------------- An HTML attachment was scrubbed... URL: From mcote at mozilla.com Tue Jun 5 17:40:12 2012 From: mcote at mozilla.com (Mark C=?UTF-8?B?w7R0w6k=?=) Date: Tue, 5 Jun 2012 13:40:12 -0400 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: <568b231a-6d9b-426d-99a7-0415818b29f4@blur> Hm not at the moment, but that's a good point. I will start posting them to the dev.apps.bugzilla group as well. Mark -----Original message----- From: Gervase Markham To: dev-apps-bugzilla at lists.mozilla.org Sent: 2012 Jun, Tue, 5 16:35:27 GMT+00:00 Subject: Re: BMO Meeting Minutes On 04/06/12 18:03, Mark C?t? wrote: > The bugzilla.mozilla.org team has recently begun recording minutes of > our weekly meetings. If you're curious about what's going on in the > world of BMO, and our plans for the future, check out > > https://wiki.mozilla.org/BMO/Meetings Is there a feed, or some other way of hearing about new sets of minutes apart from checking that page periodically? Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla - To view or change your list settings, click here: -------------- next part -------------- An HTML attachment was scrubbed... URL: From jochen.wiedmann at gmail.com Wed Jun 6 18:54:17 2012 From: jochen.wiedmann at gmail.com (Jochen Wiedmann) Date: Wed, 6 Jun 2012 20:54:17 +0200 Subject: BMO Meeting Minutes In-Reply-To: <568b231a-6d9b-426d-99a7-0415818b29f4@blur> References: <568b231a-6d9b-426d-99a7-0415818b29f4@blur> Message-ID: > On 04/06/12 18:03, Mark C?t? wrote: >> The bugzilla.mozilla.org team has recently begun recording minutes of >> our weekly meetings. If you're curious about what's going on in the >> world of BMO, and our plans for the future, check out >> >> https://wiki.mozilla.org/BMO/Meetings One question: What is de-duplication, please? -- "Bildung kommt von Bildschirm und nicht von Buch, sonst hie?e es ja Buchung." Dieter Hildebrandt From steven_tierney at yahoo.co.uk Wed Jun 6 19:08:15 2012 From: steven_tierney at yahoo.co.uk (Steven Tierney) Date: Wed, 6 Jun 2012 20:08:15 +0100 (BST) Subject: Please advise on security In-Reply-To: References: <4FCE2C52.2090807@yahoo.co.uk> <1338966297.67014.YahooMailNeo@web29702.mail.ird.yahoo.com> Message-ID: <1339009695.81296.YahooMailNeo@web29701.mail.ird.yahoo.com> Sounds like that's where I need to look then. ?It's an obvious place to look but sometimes one stares at a problem for so long that the obvious goes unnoticed! ? Thanks again, --- Steven ________________________________ From: Marc Schumann To: Steven Tierney Cc: "developers at bugzilla.org" Sent: Wednesday, 6 June 2012, 11:59 Subject: Re: Please advise on security Steven, unless you use ENV authentication (which you probably don't), Bugzilla uses cookies to identify the logged in user. I believe Javascript sends these unless you did something so that it doesn't, so you should be fine... Maybe you can take a look at what YAHOO.bugzilla.userAutocomplete does (in js/field.js), calling User.get (in Bugzilla/WebService/User.pm). User.get calls can_see_user, referencing the logged in user, and it works. Maybe you can use this as a template for your web service call. ?? Best ????? Marc -------------- next part -------------- An HTML attachment was scrubbed... URL: From vladd at bugzilla.org Wed Jun 6 19:09:44 2012 From: vladd at bugzilla.org (Vlad Dascalu) Date: Wed, 6 Jun 2012 22:09:44 +0300 Subject: BMO Meeting Minutes In-Reply-To: References: <568b231a-6d9b-426d-99a7-0415818b29f4@blur> Message-ID: > One question: What is de-duplication, please? It's a follow-up action item from the previous notes ( https://wiki.mozilla.org/BMO/Meetings/2012-05-21 , same section - I.T.): >> a failed data consistency check resulted in duplicate entries in dependencies, bugs_activity and profiles_activity table Vlad From lpsolit at gmail.com Thu Jun 7 00:01:57 2012 From: lpsolit at gmail.com (=?ISO-8859-1?Q?Fr=E9d=E9ric_Buclin?=) Date: Thu, 07 Jun 2012 02:01:57 +0200 Subject: Self-Introduction: Matt Bogosian In-Reply-To: <6A3115FD-A748-4589-998B-60C6280BEDA0@columbia.edu> References: <6A3115FD-A748-4589-998B-60C6280BEDA0@columbia.edu> Message-ID: <4FCFEF75.5010507@gmail.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Le 04. 06. 12 03:56, Matthew Bogosian a ?crit : > Looking forward to discussions. Hopefully my presence is > ultimately helpful.... Hi Matthew, Don't worry, your presence will probably be helpful. :) I see that you already filed some bugs. I hope you also plan to provide some patches. ;) Do not hesitate to come on IRC to chat with developers if you need to. LpSolit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPz+91AAoJEJZXZhv5X1hqWjUP+gLBZmbuLZb/16ZBPlJVCEwj pQJNeAe36Hmv4V4y3rMvSeHtbC2flv85N/xRqsUR0tBLT99SdokFOMT0oEIlYuIE 1U6TFwgNvSk1XDSWCqUl206mrfE2K2CVt/XRxRgftQ7JDKsvhF6x+L++EbQ5wXVc YBb6mJ5aBBrcJpaJoniXnq2aNVvSKi7MmwQt2SlhbUIY6UN7qG1rKPlni6qPUsBb MS6AS3WIPUZq8Kkmy/to5q9KRk/Rw/cAE9YbNboaxh5Q/2gVEqmCfdQoar52fMu+ U9cNpq3HgC0dLxSnCajAUOuf4a/zHt5crDgN/ZrF5l3ZGCmsamBae3GqsScwoy/I NvyKmtC/zKGqgfSHNDO7w+VL9lKzE4CFXDG5yxpp/2meIVIAvNCIsueIThqZoRfk lfvSgWB4L51o0XOziIIRGI6If+emh6lF9WPAEvRGKaDYcBq0pQclztk1eAM5zR3y T1ksOZmsz1u14BCWCntqX5dTLMd1BtHAZaAEM7bNpJp5O4zlwjr6/6YiP2hlAiWK 5C1eel6DbboMCK19HYSfnwWpClXVBwKtmQY2Vt8mb1XK9cs9qzmdgXx+OAUh0HIl KxClt7oi4G8VWUsW5MrXcgLVVYKzMndRyCZOPU/xCDYVDDM7G1HIfriX9LN879XM HIWEfHbBbgJhcEx7JQs4 =Q4IZ -----END PGP SIGNATURE----- From mkanat at bugzilla.org Mon Jun 18 01:46:57 2012 From: mkanat at bugzilla.org (Max Kanat-Alexander) Date: Sun, 17 Jun 2012 18:46:57 -0700 Subject: Please advise on security In-Reply-To: <4FCE2C52.2090807@yahoo.co.uk> References: <4FCE2C52.2090807@yahoo.co.uk> Message-ID: <4FDE8891.6090403@bugzilla.org> On 06/05/2012 08:57 AM, Steven Tierney wrote: > I did check the Bugzilla source files but, not being very used to coding > in Perl and not knowing how security 'works' in Bugzilla, I don't know > where to start! Hey Steven. You probably want two things: (1) Bugzilla->login(LOGIN_REQUIRED) for methods that can only be used by logged-in users. (2) Bugzilla->user->visible_bugs (which is defined in Bugzilla::User). If you are going to show products and components to users as well, you will have to do security on those in a different way. -Max -- Max Kanat-Alexander Chief Architect, Community Lead, and Release Manager Bugzilla Project http://www.bugzilla.org/ From gerv at mozilla.org Fri Jun 22 16:52:47 2012 From: gerv at mozilla.org (Gervase Markham) Date: Fri, 22 Jun 2012 17:52:47 +0100 Subject: Bugzilla's documentation Message-ID: Bugzilla's documentation has stagnated. We can see the lack of change for the docs by looking at bzr. The last time most of these files were edited was 5 months ago, and that was to update the license header: http://bzr.mozilla.org/bugzilla/trunk/files/head:/docs/en/xml/ If you go back before that, they were last updated in October 2011, when we changed the software used to compile them: http://bzr.mozilla.org/bugzilla/trunk/files/8074/docs/en/xml/ The actual _content_ of most of the files hasn't changed for ages. Another telling sign is that new bits of documentation end up being maintained on the wiki: https://wiki.mozilla.org/Bugzilla:Move_Installation (one of the most frequently referenced when giving people help) https://wiki.mozilla.org/Bugzilla:Mac_OS_X_installation https://wiki.mozilla.org/Bugzilla:FAQ etc. etc. Why are people not updating the docs? Why are new things being written on the wiki instead? The primary reason, I suggest, is that editing the documentation is difficult. It's XML and DocBook-based, and compiling it to validate one's patches and even view what they look like in the HTML version requires installing a variety of esoteric packages. I certainly don't have the necessary software on my machine. Making changes beyond editing some text requires knowing DocBook, or doing cargo-cult copy and paste from another part of the docs. You have very little control over the look and feel of the resulting HTML which most people read, and it's not pretty by modern standards anyway. I have made several patches to Bugzilla over the last year and I didn't even think of checking the docs, never mind patching them. From the commit logs, it seems like I'm not alone. If we want to have accurate and useful documentation for Bugzilla, we need to make editing the documentation a _much_ more accessible process, certainly for developers and even for knowledgeable users. We could just say "hey, move it all to the wiki". However, IMO we also don't want to lose the very useful ability to have frozen versions of the documentation for each release: http://www.bugzilla.org/docs/ AIUI, that would be hard to do on a standard MediaWiki like wiki.mozilla.org. I think what we need is a SCM-backed wiki, so people can edit the docs either over the web, or by checking out the repo and editing the markup directly. And we can make branches in order to deal with the multiple versions issue. Ideally, we could back it with bzr and keep the docs in the same repo as the source, as now. But I still think it would be better even if we had to use a different SCM and so a different Mozilla repo. (Mozilla has svn, hg, bzr, cvs and (soon) git repos.) I did a blog post about this recently: http://blog.gerv.net/2012/04/maintaining-documentation-in-a-wiki/ and the following software was suggested: Hatta: http://hatta-wiki.org/ (hg) IkiWiki: http://ikiwiki.info/ (svn, git, bzr, monotone, hg, darcs) GitIt: http://gitit.net/ (git, darcs or hg) I have since found: PodWiki: http://www.daemon.de/PodWiki (rcs) Foswiki: http://foswiki.org/ (rcs) IkiWiki is the only one I've found that supports bzr, although it claims to work best on git: http://ikiwiki.info/rcs/ Getting the bzr support working might require manual work. However, it is written in Perl. It also has a "wiki to HTML compiler", allowing us to make static versions of the docs for the website archive. Questions: 0) Do you agree with my initial assertion that our docs have stagnated? 1) Do you agree with my diagnosis of the problem? 2) What do you think of my proposed SCM-backed-wiki solution? 3) Do you know of any other SCM-backed-wiki systems? Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From glob at mozilla.com Mon Jun 25 11:50:57 2012 From: glob at mozilla.com (Byron Jones) Date: Mon, 25 Jun 2012 19:50:57 +0800 Subject: Bugzilla's documentation In-Reply-To: References: Message-ID: <4FE850A1.7060209@mozilla.com> Gervase Markham wrote: > Bugzilla's documentation has stagnated. [snip] > 0) Do you agree with my initial assertion that our docs have stagnated? yes > 1) Do you agree with my diagnosis of the problem? yes > 2) What do you think of my proposed SCM-backed-wiki solution? no. > We could just say "hey, move it all to the wiki". However, IMO we also > don't want to lose the very useful ability to have frozen versions of > the documentation for each release: > http://www.bugzilla.org/docs/ > AIUI, that would be hard to do on a standard MediaWiki like > wiki.mozilla.org. what's wrong with having different namespaces: http://wiki.bugzilla.org/docs/4.0/en/html/ http://wiki.bugzilla.org/docs/4.2/en/html/ there are many mediawiki extensions which will allow us to restrict editing of pages once we want to freeze the docs for a version. -- byron - irc:glob - bugzilla.mozilla.org team - -------------- next part -------------- An HTML attachment was scrubbed... URL: From sdaugherty at gmail.com Mon Jun 25 16:53:17 2012 From: sdaugherty at gmail.com (Stephanie Daugherty) Date: Mon, 25 Jun 2012 12:53:17 -0400 Subject: Bugzilla's documentation In-Reply-To: <4FE850A1.7060209@mozilla.com> References: <4FE850A1.7060209@mozilla.com> Message-ID: On Mon, Jun 25, 2012 at 7:50 AM, Byron Jones wrote: > > 2) What do you think of my proposed SCM-backed-wiki solution? > > no. > > > I'd have to argue for a SCM-based solution, if only for one reason - it makes it possible to check documentation with the same changes that need to be documented - granularity and freezing by version is enough for releases, but it's not enough for "living" documentation of what's happening between releases. Also, SCM systems have better revision history functionality than MediaWiki by far, since they provide for branching and merging, where "faking" that with namespaces in MediaWiki actually makes that very difficult - it would lead to copy and paste merges in the process of catching up on the documentation backlog, since a lot of the documentation written will apply to several versions. Being able to cherry pick the documentation updates and apply them to all versions they apply to with a clean revision history seems good to have. -------------- next part -------------- An HTML attachment was scrubbed... URL: From lpsolit at gmail.com Mon Jun 25 18:14:32 2012 From: lpsolit at gmail.com (=?ISO-8859-1?Q?Fr=E9d=E9ric_Buclin?=) Date: Mon, 25 Jun 2012 20:14:32 +0200 Subject: Bugzilla's documentation In-Reply-To: References: Message-ID: <4FE8AA88.6030803@gmail.com> Le 22. 06. 12 18:52, Gervase Markham a ?crit : > Why are people not updating the docs? Why are new things being written > on the wiki instead? The primary reason, I suggest, is that editing the > documentation is difficult. That's not the single reason. Being able to edit the documentation on wiki without having to ask for review plays a major role too, I think. Everyone is free to write what he wants without having to ask anyone's approval. If it needed review, contributors wouldn't bother writing doc, even on wiki. But there are two major disadvantages of free editing: 1?) Some contributors can write wrong information (unintentionally), which is especially critical when talking about how to upgrade or how to manage the security of your installation. 2?) The information can become messy pretty quickly, everyone starting his own page despite the information is already duplicated elsewhere, even partially. This makes it harder to find what you want. Also, some information is very old, despite being on wiki. It's XML and DocBook-based, and compiling it > to validate one's patches and even view what they look like in the HTML > version requires installing a variety of esoteric packages. This last statement is no longer true. Instead of Jade + a variety of other tools, you now simply need xmlto. It's now much more easier to compile the documentation than it was before. > You have > very little control over the look and feel of the resulting HTML which > most people read, and it's not pretty by modern standards anyway. The output is much better with xmlto than with Jade. We also have a higher control on the output. Just compare: Jade: http://www.bugzilla.org/docs/4.2/en/html/installation.html xmlto: http://www.bugzilla.org/docs/tip/en/html/installation.html If we are simply writing plain text, it won't look better on wiki. > I have made several patches to Bugzilla over the last year and I didn't > even think of checking the docs, never mind patching them. From the > commit logs, it seems like I'm not alone. Having the documentation on wiki won't help. People who don't care about updating the documentation will still not care. Depending on what is changed, reviewers *have to* ask to update the documentation at the same time. If they don't, they don't do their job correctly. At the very least, they are responsible to set the documentation flag to "?" to put it in our radar. Also, it's currently possible to have the doc changes included in the same patch as code changes. With having everything on wiki, this won't be possible anymore. > If we want to have accurate and useful documentation for Bugzilla, we > need to make editing the documentation a _much_ more accessible process, > certainly for developers and even for knowledgeable users. We agree on that, assuming not everybody starts writing doc at the wrong place in an unmanageable way, see above. Can you easily write a table of contents with several levels of depth and an index with wiki, which are updated automatically? Just compare these two pages: official doc: http://www.bugzilla.org/docs/tip/en/html/index.html wiki: https://wiki.mozilla.org/Bugzilla:Home_Page The first one has a clear structure which is updated automatically and which reviewers have approved. The second one has no structure. It's a mess which I don't even bother to read. And it requires manual changes. This means you could write a great page and nobody would know it exists if you don't add it manually to the table of contents. > the same repo as the source, as now. But I still think it would be > better even if we had to use a different SCM and so a different Mozilla > repo. (Mozilla has svn, hg, bzr, cvs and (soon) git repos.) I personally wouldn't want to use another repo for the documentation. We already have CVS for bugzilla.org, one bzr repo for the Bugzilla core code, and another bzr repo for Selenium + QA code. A 4th one is a bit too much. > Questions: > > 0) Do you agree with my initial assertion that our docs have stagnated? Yes. > 1) Do you agree with my diagnosis of the problem? Only partially. > 2) What do you think of my proposed SCM-backed-wiki solution? > 3) Do you know of any other SCM-backed-wiki systems? No, twice. LpSolit From gerv at mozilla.org Wed Jun 27 12:25:15 2012 From: gerv at mozilla.org (Gervase Markham) Date: Wed, 27 Jun 2012 13:25:15 +0100 Subject: Bugzilla's documentation In-Reply-To: References: Message-ID: <4FEAFBAB.20309@mozilla.org> On 25/06/12 12:50, Byron Jones wrote: > what's wrong with having different namespaces: > http://wiki.bugzilla.org/docs/4.0/en/html/ > http://wiki.bugzilla.org/docs/4.2/en/html/ One problem with this is that, AFAIK, MediaWiki has no "Copy Tree" function which would allow us to say: "Take everything under http://wiki.bugzilla.org/docs/trunk and copy it to http://wiki.bugzilla.org/docs/4.4". If there is such an extension, point me at it :-) The second is that it's much harder to apply a patch to multiple branches on a wiki which is only editable over the web. Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From karishma.balan at gmail.com Sat Jun 30 06:05:56 2012 From: karishma.balan at gmail.com (Karishma Balan) Date: Sat, 30 Jun 2012 11:35:56 +0530 Subject: Mozilla Bug database - How to access? Message-ID: I am a second year postgraduatestudent studying ME CSE. As part of my projectwork, I need the Eclipse and Mozilla bug databases. I am working on the project ?Bug Assignment? where bugs are assigned to a potentialdeveloper. Bug assignment uses machine learning approach where the classifiersare trained using the bug reports ? fixed bug data. I browsedwebsites to get the bug database. The web sites say that the databases are publicly available and can be downloaded. But I couldn?t get a link to download. According to the paper that I follow, they have used the bug reports of Mozilla from May1998 to March 2010, and that of Eclipse from October 2001 to March 2010. Pleasehelp me to get the Mozilla and Eclipse bug databases. _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla From sdaugherty at gmail.com Sat Jun 30 06:29:30 2012 From: sdaugherty at gmail.com (Stephanie Daugherty) Date: Sat, 30 Jun 2012 02:29:30 -0400 Subject: Mozilla Bug database - How to access? In-Reply-To: References: Message-ID: This list is really for Bugzilla development in general rather than for Mozilla's own Bugzilla instance, but Mozilla's Bugzilla is publicly accessible at https://bugzilla.mozilla.org and has an API ( https://wiki.mozilla.org/Bugzilla:REST_API) as well as pretty extensive reporting features. If you anticipate doing a lot of queries in a short time, you might want to check with the admins first as a courtesy and to make sure you don't cause performance impacts for other users. I'm not aware of a mailing list for the bugzilla.mozilla.org admin team (many of them are also on this list), but they do hang out on irc - irc.mozilla.org #bmo -Stephanie On Sat, Jun 30, 2012 at 2:05 AM, Karishma Balan wrote: > I am a second year postgraduatestudent studying ME CSE. As part of my > projectwork, I need the Eclipse and Mozilla bug databases. > > I am working on the project ?Bug Assignment? where bugs are assigned to a > potentialdeveloper. Bug assignment uses machine learning approach where the > classifiersare trained using the bug reports ? fixed bug data. > > I browsedwebsites to get the bug database. The web sites say that the > databases are publicly available and can be downloaded. But I couldn?t get > a link to download. According to the paper that I follow, they have used > the bug reports of Mozilla from May1998 to March 2010, and that of Eclipse > from October 2001 to March 2010. Pleasehelp me to get the Mozilla and > Eclipse bug databases. > _______________________________________________ > dev-apps-bugzilla mailing list > dev-apps-bugzilla at lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-apps-bugzilla > - > To view or change your list settings, click here: > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From bugzilla at colinogilvie.co.uk Sat Jun 30 06:57:42 2012 From: bugzilla at colinogilvie.co.uk (Colin Ogilvie) Date: Sat, 30 Jun 2012 07:57:42 +0100 Subject: Mozilla Bug database - How to access? In-Reply-To: References: Message-ID: <4FEEA366.8000003@colinogilvie.co.uk> I think you're probably asking in the wrong place for this, as this is a list for the development of the Bugzilla project really, not bugzilla.mozilla.org specific things. However, it would appear that your first step should be filing a bug at http://bugzilla.mozilla.org/ detailing what you want and why you want it... someone from there would then get back to you with what information you need to provide, anything you need to sign etc. I would suggest that https://bugzilla.mozilla.org/enter_bug.cgi?product=bugzilla.mozilla.org&component=Administration might be a good place to start from that point of view. Colin On 30/06/2012 07:05, Karishma Balan wrote: > I am a second year postgraduatestudent studying ME CSE. As part of my > projectwork, I need the Eclipse and Mozilla bug databases. > > I am working on the project ?Bug Assignment? where bugs are assigned to a > potentialdeveloper. Bug assignment uses machine learning approach where the > classifiersare trained using the bug reports ? fixed bug data. > > I browsedwebsites to get the bug database. The web sites say that the > databases are publicly available and can be downloaded. But I couldn?t get > a link to download. According to the paper that I follow, they have used > the bug reports of Mozilla from May1998 to March 2010, and that of Eclipse > from October 2001 to March 2010. Pleasehelp me to get the Mozilla and > Eclipse bug databases. > _______________________________________________ > dev-apps-bugzilla mailing list > dev-apps-bugzilla at lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-apps-bugzilla > - > To view or change your list settings, click here: > From mcote at mozilla.com Tue Jun 5 17:40:12 2012 From: mcote at mozilla.com (Mark C=?UTF-8?B?w7R0w6k=?=) Date: Tue, 5 Jun 2012 13:40:12 -0400 Subject: BMO Meeting Minutes In-Reply-To: References: Message-ID: <568b231a-6d9b-426d-99a7-0415818b29f4@blur> Hm not at the moment, but that's a good point. I will start posting them to the dev.apps.bugzilla group as well. Mark -----Original message----- From: Gervase Markham To: dev-apps-bugzilla at lists.mozilla.org Sent: 2012 Jun, Tue, 5 16:35:27 GMT+00:00 Subject: Re: BMO Meeting Minutes On 04/06/12 18:03, Mark C?t? wrote: > The bugzilla.mozilla.org team has recently begun recording minutes of > our weekly meetings. If you're curious about what's going on in the > world of BMO, and our plans for the future, check out > > https://wiki.mozilla.org/BMO/Meetings Is there a feed, or some other way of hearing about new sets of minutes apart from checking that page periodically? Gerv _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla - To view or change your list settings, click here: _______________________________________________ dev-apps-bugzilla mailing list dev-apps-bugzilla at lists.mozilla.org https://lists.mozilla.org/listinfo/dev-apps-bugzilla