Comment 1 Quim Gil 2007-09-21 07:40:45 UTC

Agreed. In fact we have an ongoing task about identifying Nokia official
documentation, projects, applications... so people know what to expect. We had
overlooked usernames here, fair point.

The fix should be simple, just editing our "Real name" field in our
preferences. I have just done that, let's see how it looks in this comment. 

Of course this is not a perfect solution since somebody could just append
"(Nokia)" to her name. You have to be a bit massochist to do that, though.  ;) 
And in any case this doesn't give you any extra priviledge and any abuse will
be sooner or later detected.

I don't know any Kevin Heart working at Nokia, but it's also true that there
are some Nokia employees that are using here their usual 'community' nicknames
because this is what they are used to. We'll look into this.

Comment 2 Quim Gil 2007-09-21 07:41:48 UTC

"Comment  #1 From Quim Gil (Nokia)  2007-09-21 07:40:45 GMT+3"

It works.  :)

Standard disclaimer: I'm an individual. My opinions are my own unless I
explicitly indicate I represent someone else. Which I will almost never do.

In the rare instances where I indicate that I represent some entity, I tend to
regret it.

Such an instance happened to me this week. If I had represented Nokia, things
would probably have been worse. I'd much rather not be associated with Nokia,
if possible, it's safer for everyone. 

For reference, in bugzilla.mozilla.org, Google, IBM, and "SQA Partners", happen
to do this.

> 2. In maemo Bugzilla there is a group called "editbugs", all 
> users who belongs to that group can edit bugs (change status 
> etc..). That group contains more than 350 persons, some of 
> them are using Nokia e-mail as a username some not.

Some background. I was the one who changed bugs.maemo.org from giving everyone
editbugs (and canconfirm since it inherits) to manually granting permissions to
people.

I basically data-mined all bugs in bugs.maemo.org and granted editbugs to
everyone who had reported a couple of bugs, or was the assignee for a couple of
bugs and a couple of other items. i.e., I tried to make sure that anyone who
could possibly have "earned" editbugs was granted editbugs. I also granted
editbugs to specific people I knew and trusted (working at or for Nokia was not
a requirement, I picked people from #maemo and the Mozilla community).

Unfortunately, I was afraid of negative feedback, so I also added a temporary
grant for Nokians, I intended to remove it after allowing people some time to
get accustomed to the situation.

I was in a hurry to switch to using editbugs and canconfirm because people who
don't have canconfirm get a better bug filing form, and I wanted to encourage
people to use it. For people who are unsure about which form they get, the one
I want people to use is visible from:
<https://bugs.maemo.org/enter_bug.cgi?format=guided>, it is also the one I used
in all the http://browser.garage.maemo.org/news/index.xml URLs

Personally, I want everyone to earn editbugs, including Nokians. For reference,
mozilla.org currently has that policy. Even people who are employed by Mozilla
Corporation have to prove they know what they're doing to get permissions in
bugzilla.mozilla.org.

It's very easy to remove the whitelist on nokia.com and force people to
earn/ask for editbugs. And at the earliest opportunity (possibly within a month
of this comment), I hope to be able to do that.

Ideally you'd have a process similar to the mozilla.org process where people
file a bug report and explain why they should have edit bugs,
Reasons can be:
1. see work I've done in bug ..., bug ..., ....
2. person X vouches for me. (comment 2 has a comment from person X - i.e.,
Bugzilla authentication shows that person X vouches)
3. person X files a bug explaining that person Y will be doing ... and needs
editbugs.
4. I'm an recognized contributor at <see other bugzilla or similar installation
with the same user account>

https://bugzilla.mozilla.org/show_bug.cgi?id=391390
https://bugzilla.mozilla.org/show_bug.cgi?id=390207
https://bugzilla.mozilla.org/show_bug.cgi?id=397392

Questions arise as to he goal of adding (Nokia) attributions.

Personally, I think you're better off having only people who officially speak
for Nokia stick it in their name.

e.g., Quim speaks for Nokia. I don't think it's even possible for him *not* to
speak for Nokia. However, I don't speak for Nokia. (Footnote, as you'll see
later, he might also be able to speak for GNOME at times, and technically he
gets three hats: Nokia<realm:maemo>, maemo.org, and GNOME)

Speaking for Nokia isn't really relevant in most cases. What people usually
care about is whether a person working on a module or owning a module is
issuing a statement that something won't be fixed. (As you'll see later, I can
speak for browser).

Certainly, if you or someone else is making a change (WONTFIX) you should
probably say "I'm doing this is owner of <whatever>". If the reason you're
doing it is because a lawyer at Nokia has dictated it, then you probably should
somehow indicate in a clear comment that you are speaking for Nokia (after
first getting explicit permission to speak for Nokia, from your lawyer).

A little about the real name field in Bugzilla. Simply put, there's very little
logging and there's no way for people to verify the content of a real name
field. I could change my real name to "Quim Gil (Nokia)" for a day, enter a
couple of comments, and then change my real name tomorrow.

How do you know I'm not Quim? How do you know Quim isn't using my Bugzilla
account?

Because there's no way to verify the content in the real name field, using it
for this purpose a pretty bad idea. Anyone could add (Nokia) to their name. And
as I mentioned above, they could remove it a day later.

I think it's much easier to make Nokians who wish to speak as Nokia.com log in
as @nokia.com and comment that way. Once they have an account, they aren't
required to go behind the firewall ever again. It's true that someone should
make sure people who leave nokia.com have their Bugzilla accounts retired,
which is another problem, but that's a manageable problem. Note that real names
are not permanent, if I change my real name tomorrow, you won't see what my
real name said today when you read this comment next week, you'll see what the
real name currently says. Similarly, it's possible to change your bugzilla
email address, so it's much better for people to engrave in stone the comment
indicating when they are intentionally speaking for Nokia.

If anyone ever claims they are speaking for Nokia and it turns out they aren't,
someone merely has to contact a Bugzilla administrator. Administrators are
capable of impersonating other users, so if necessary, I could impersonate
someone and make a comment "Note: what was written by this account in comment X
is incorrect, this account at this time does not speak for Nokia". Before
people complain that impersonation is silent, do note that an email is sent out
by Bugzilla to the account indicating that it's being impersonated, and the
action is logged for posterity. (Technically, this isn't required, Bugzilla
administrators can do more evil things like change the password of an account
or rename the account and reset the password, however password resets are
logged, and changing the password would be noticed when the original holder can
no longer log in. These actions while possible should not be done to active
accounts as impersonation is a more proper mechanism.)

This is a revised/expanded version of a message that was sent to Quim, he did
not approve the final content of this comment, although he did indicate it was
OK to discuss here.

Again, I don't speak for Quim, I'm not speaking for Nokia, I'm not speaking for
the Mozilla based browser for maemo project, I'm not speaking for mozilla.org,
nor am I speaking for bugzilla.org. Oh, I'm not a Finn.

I'm an American, I have opinions.

I am speaking as someone who has interacted with a couple of Bugzillas, and as
a Bugzilla developer, and a fairly active (ab)user of Bugzillas and as a person
familiar with security constraints (I have access to both Mozilla and Bugzilla
security bugs). I'm also interested in making bugs.maemo.org succeed, and
growing the maemo community.

As a footnote, the problem I ran into earlier this week would not have been
solved by people sticking (Nokia) into their names. It would have been resolved
had there been a general table where people maintained pages indicated what
they were doing. My table would have the following items:
* http://www.ohloh.net/accounts/6653 (this is a substitute for a long list)
* MicroB Browser Architect (timeless)
* maintains unofficial garage cross reference,
http://timeless.justdave.net/mxr-test/garage/
* 770 owner (2.2006.39-14)
-
* have admin. privs for garage.maemo.org (I'm working to transition mxr-test to
be the official replacement for lxr.maemo.org, the exact details and schedule
for this are currently in the air)
* have admin. privs for bugs.maemo.org (these are not because I speak for
maemo.org, I did the bugs.maemo.org reorg
<http://browser.garage.maemo.org/news/8/>)
* have editproducts privs (timeless@bemail.org) for bugzilla.mozilla.org
* wide interest in most things
* willing to test or break just about anything
* sensitive to pixel imperfections and misuse of English

I'm reviewing your bug to try to come up with an example of what yours should
say:

* N800 owner running 3.2007 (?)
-
* admin. for a company's internal Bugzilla 

For Quim, this would be something like:
* http://www.ohloh.net/accounts/10111
* maemo.org spokesperson, community liaison
* GNOME Foundation board member
* admin. for bugs.maemo.org

For Ferenc, this would be something like:
* http://www.ohloh.net/accounts/4517
* maemo.org {not sure what his title, but he has an official relationship to
maemo.org}
* admin. for garage.maemo.org
* admin. for bugs.maemo.org

For Jake Kunnari,
* maintainer for bugs.maemo.org

Note: there's a difference of sorts between my "have/has" and just a normal
"admin" token, and maintainer. Maintainer is the responsible party,
administrator tokens may speak for the project, people with "have/has" are
merely capable of taking actions to complete tasks. These words should clearly
be reorganized, it's just a general idea of how things could be done.

To deal with bug 2034, yes, kevin's real name should say (QA:Browser), it
shouldn't say (Nokia), because he doesn't speak for Nokia, but it is currently
(and for the foreseeable future) his job to QA Browser bugs.

I should probably highlight the bit about people leaving and returning to
Nokia, it's actually not uncommon for a person to work (as an employee) for
Nokia, leave, and return later. When they do, they actually get a new email
address (.1, .2, something like that), but the point is that even if someone
*was* an employee of Nokia at a given time, if they happen to stop being a
Nokia employee and rename their account (and remove Nokia from the real name),
then someone reviewing a bug will lose any hints that the comment was made by a
one time Nokian (acting as a Nokian).

Comment 4 Andre Klapper 2008-05-02 16:28:11 UTC

In GNOME Bugzilla, accounts can be marked as developers for specific products.
When commenting on a report, it is displayed like this:
   "Comment #2 from John Doe ($productname developer, points: $x)"
Since the username is a link and the stuff in brackets is in italic, it's quite
easy to distinguish.
Again it seems like this is not upstream bugzilla.

Comment 5 Marcell Lengyel 2008-05-05 09:49:23 UTC

If you can get those patches from gnome I will be happy to apply those to  the
maemo bugzilla.

Comment 6 Andre Klapper 2008-05-05 11:11:42 UTC

i don't think it can be easily ported, but maybe adding a "employee" column to
the user table and checking for that value should be possible.
guenther has more knowledge on this, hence adding him to CC.

Comment 7 Andre Klapper 2008-05-13 17:39:23 UTC

there already is a "nokia" group in maemo bugzilla which could be used to
achieve this (though it currently defaults to the regexp "@nokia\.com$").

i reassign this to karsten, feel free to assign back to me if not content. ;-)

I will have a look at this.

The current style of adding a suffix to the real name is suboptimal. Instead,
this should be done automatically.

Comment 9 Andre Klapper 2008-06-13 16:39:02 UTC

Karsten has a patch for this that is currently tested before patching the
production bugzilla.

Comment 10 Quim Gil 2008-06-19 10:35:19 UTC

> (though it currently defaults to the regexp "@nokia\.com$")

But this is fine. By default Nokia employees doing maemo.org stuff should be
wearing their @nokia.com address. Personally I don't care if sometimes I do
this for really hobby/personal contributions. If someone cares and wants to
have a clear separation then s/he can create an additional account and separate
things.

Fixed in SVN, pushed for porting to b.m.o. Should land here soon.

A Nokia employee will be marked with an additional (Nokia) after his real name.
This is based on the nokia group membership per user. Indeed, it basically is
an RE on the email address. However, arbitrary users with non @nokia.com
addresses can be added to that group, too.

This clearly can just be a hint only. Even Nokia employees might not
necessarily be speaking on behalf of Nokia officially, though comments might be
biased. This is a *hint* to distinguish bugzilla users and their roles. Any
such marker can *not* be a reliable indicator about weight of an opinion,
knowledge or anything. Even regular users can be more knowledgeable than the
developer of a product. This is just to give some hint.

Also, it merely reflects a current snapshot. Roles can change, as can
addresses. This will have an impact upon address changes when viewing a bug.
The only way around this, and to correctly add persistent hints like developer
or admin of X is, to add these to the comment itself. Even during the life time
of a bug, this might change. I don't think this is necessary though, and
definitely not worth the trouble. Also, it would be hard, if not impossible to
add this to existing comments.

FWIW, I do agree that an @nokia.com address is a good base for this. Plus, it
can be set independently.


Once this patch has been applied, I'll remove the suffixes from the real names,
and close this bug FIXED.

(In reply to comment #11)
> Fixed in SVN, pushed for porting to b.m.o. Should land here soon.

> Once this patch has been applied, I'll remove the suffixes from the real names,
> and close this bug FIXED.

Done. Closing RESOLVED FIXED.

Thanks for raising this issue, Jason. Nokia employees now should be easy to
identify, giving a hint about roles.

Just some additional notes for clarity, since this question came up:

It is possible for a Nokia employee to create (or already have) a second
bugzilla account using a personal email address. And he can file bugs or leave
comments using that address, if he *really* intends to not speak on behalf of
Nokia in any way.

The real name might be the same, though. Just as timeless in comment 3 pointed
out, the real names shown can be rather arbitrary strings chosen by the user.

Also, again, this can serve as a hint only. If a user does not change his email
address when he leaves Nokia, the hint will be preserved indefinitely. Since he
doesn't have access to the Nokia email any more, he can not add comments using
this role either.

However, if a former Nokian ever leaves and actually changes his address, all
his comments will lose the "nokia" hint. Group membership reflects "now". It is
not correlated to the comment or that time.

Comment 14 Quim Gil 2008-06-29 12:51:37 UTC

The implementation is very good. Thank you!

Just a note: the same could be made for those of you with maemo.org addresses.
You are not just like any community contributor and it is good to see an e.g.
"(maemo.org)" visibly in the bug reports.

(In reply to comment #14)
> The implementation is very good. Thank you!

Thanks. Nice to hear you like it. :)

> Just a note: the same could be made for those of you with maemo.org addresses.
> You are not just like any community contributor and it is good to see an e.g.
> "(maemo.org)" visibly in the bug reports.

True. Good idea. File a bug. ;)

Should be easily possible to add, similar to the Nokia group membership. I'll
put it on my list.