1141750 - Amend MozReview note on Create New Attachment page to warn against security patches

Status: RESOLVED WONTFIX

(bugzilla.mozilla.org :: User Interface, defect)

Description

[Mark Côté [:mcote]]

Given that MozReview is entirely public at the moment, it's important that people don't submit security-related or other confidential patches via MozReview.  We should append this to the note:

<b>Note</b>: At the moment, MozReview is an entirely public system. <b>Do not</b> use it for security-related patches or any other confidential material.

Comment 1

[Mark Côté [:mcote]]

Attachment: Warn against security patches

Comment 2

[Mark Côté [:mcote]]

Changed the wording a little bit:

  <b>Note</b>: At the moment, all content on MozReview is entirely
  public. <b>Do not</b> use MozReview for security-related patches or any
  other confidential material.

Comment 3

[:glob ✱]

Comment on attachment 8575561 [details] [diff] [review]
Warn against security patches

Review of attachment 8575561 [details] [diff] [review]:
-----------------------------------------------------------------

i don't think there's any need to always display this warning.
instead we should just not display the "use rb" suggestion if a bug isn't public.

side note: does the "post to rb from hg" stuff throw an error if you try to link it with a non-public bug?

Comment 4

[Mark Côté [:mcote]]

The intent is not necessarily to prevent a single confidential patch from being posted; rather, it's a general "awareness campaign".  Not displaying it when the bug is confidential doesn't really solve that problem.  It doesn't advertise MozReview, but neither does it indicate that you should definitely not use MozReview for this nor any other confidential patch.

There is an error if you try to publish a review request for a confidential bug.  I can't remember if you get an error when you try to push to the hg review repo, but there probably should be.  It has to look up the bug to verify that it exists, but I can't remember if it fails if the bug is confidential.

Comment 5

[:glob ✱]

(In reply to Mark Côté [:mcote] from comment #4)
> The intent is not necessarily to prevent a single confidential patch from
> being posted; rather, it's a general "awareness campaign".  Not displaying
> it when the bug is confidential doesn't really solve that problem.  It
> doesn't advertise MozReview, but neither does it indicate that you should
> definitely not use MozReview for this nor any other confidential patch.

i don't think it's the place of bugzilla to document/advertise the limitations of mozreview.

that message is really only useful once, and it's only useful for people who work on confidential bugs (which i strongly suspect is a small fraction of our overall patch developers).  i don't agree there's value in displaying the message to all users, all the time.

Comment 6

[Mark Côté [:mcote]]

The whole message is really only useful once, but all right; I'll put it elsewhere.