181536 - need to block old geckos because of bug 177326

Status: RESOLVED WONTFIX

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[timeless]

i was at my parent's house using the latest official netscape7 release and i
needed to file 3 bugs. instead i ended up making hundreds of bugmails and the
mess isn't done.

we can wait until official releases (mozilla1.2,mozilla1.0.2, next netscape7)
are released or start blocking today, that's a choice we can make. but we need
to block these browsers.

Comment 1

[Asa Dotzler [:asa]]

What exactly was the problem and how many times has this happened in Bugzilla
since the affected builds became available. If it's a one time event then I see
no readon to block a major release from accessing bugzilla

Comment 2

[Daniel Veditz [:dveditz]]

See bug 177326, an error in our handling of TCP RST (reset) causes us to
resubmit, potentially a whole ton of times depending on why you're getting the
RSTs and if the condition clears or not. 

Comment 3

[Daniel Veditz [:dveditz]]

Don't read my comment as support for blocking old builds. we really haven't seen
this problem all that much. But it is pretty horrible when it does happen,
especially if you're buying something expensive.

Apparently most hackers don't use such flaky connections.

Comment 4

[Darin Fisher]

right, bug 177326 is a very very low occurance bug (it has been around for
ages).  when it happens, you'll see a request (possibly a form submission)
repeated exactly 10 times.  it really requires things to be lined up just right.

instead of (or in addition to) blocking these old browsers, i would actually
encourage bugzilla to consider adding some code to prevent duplicate submissions
of new bug reports.  even without bug 177326, i've seen people accidentally
press submit twice for example.  now, i think we've done some things in mozilla
to make that less likely (or impossible), but from the point of view of
protecting bugzilla, it might be wise to add some kind of checking within
bugzilla itself.

Comment 5

[timeless]

well, each of the people who were unfortunately direct ccs immediately contacted
me asking what happened. my estimate is that the result is  ~200 bugmails total
(150 now, 50 more later) per victim.

gecko browsers couldn't cause as much spam before 2.17.1 because bugzilla didn't
support for setting dependencies at bug creation. people can live with
duplicates (although darin's right, bugzilla should have some protection of its
own against that for any kind of user[agent] error, i'm sure there's a bug for
that).

The problem is that the bugs i filed had dependencies and each of the
dependencies gets a notification for status change (dupl, veri, removed deps).

if someone w/ bugzilla db access could silently nuke the dependencies for the
duplicate bugs listed in the url, that'd be great. otherwise i'm going to have
to either abuse a flag to decrease the spam or just trigger all of the spam from
removing the dependencies (it probably should have been done when the bugs were
resolved as duplicates).

Comment 6

[Gervase Markham [:gerv]]

This doesn't seem to have been a problem generally - WONTFIX?

Gerv

Comment 7

[Myk Melez [:myk] [@mykmelez]]

Indeed.