Re: ABRT?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Tue, 2014-08-12 at 12:21 -0400, Bastien Nocera wrote:
> 
> ----- Original Message -----
> <snip>
> > >  The process to skip commenting the first time is
> > > also sub-par. Given that the window is only there to show progress, maybe
> > > it
> > > doesn't need to be there at all, and progress can be shown in the main
> > > window.
> > 
> > I am going to be completely honest with you: I want/need/have to reuse
> > the reporting window for several reporting work-flows because we have
> > one for Fedora (ABRT Server/Bugzilla), SELinux AVCs, Anaconda
> > (Bugzilla/Upload), RHEL and another distro in the near future.
> 
> I don't see what is, or should be different for the user about reporting
> SELinux AVCs to Bugzilla, reporting Anaconda traces to Bugzilla, or reporting
> crashers to ABRT.
> 

Reporting to ABRT server is fast and anonymous, thus the report doesn't
need a review and doesn't need a comment.
- the mockups cover this part

Reporting to Bugzilla isn't anonymous, automatically collected data
migth contain security sensitive data and ABRT must ensure high quality
of reports (maintainers are people too), thus the report must be
reviewed, should have a comment and user must provide Bugzilla
credentials.
- the mockups don't cover this part at all (or am I mistaken?)

> > > Are you after a UI review after that?
> > 
> > You are the reviewer :) Thank you very much indeed!
> 
> I filed:
> https://github.com/abrt/gnome-abrt/issues/55
> through to 67, to start with.

Many thanks! I've fixed a lot of them and I'll fix the rest of those
issues when gtk-3.14 is released.

> > > Either do it automatically, or simply cache it all so that
> > > they can be reported by hand later, in the UI.
> > > 
> > > > If you click "Report" in the GUI, the reporting window allows you to
> > > > provide a description, informs you about processing and tells you that
> > > > the reporting is done. The workflow is almost the same as the workflow
> > > > for New Report in Normal mode at:
> > > > https://wiki.gnome.org/Design/Apps/Oops
> > > 
> > > I don't see any windows besides the main window in those mockups. The
> > > "add comment" variant is only there for developers.
> > 
> > Although I would really love to make ABRT's workflow completely the
> > same, I cannot do it because I need to reuse the reporting window for
> > other work-flows (Fedora, SELinux, Anaconda, RHEL).
> 
> That's really not a good enough reason for not wanting to change it.
> 

I'm not saying that I don't want to change it. I just said that it's
hard to make it exactly the same and be able to support the other
workflows. We all have to make trade-offs, right?

> <snip>
> > > > > I also note that the core dump uploading, which gdb engineers advised
> > > > > against,
> > > > 
> > > > Pardon? I am not sure I understand you. Where gdb engineers advised such
> > > > a thing?
> > > 
> > > The gdb engineers, as well as security engineers, I talked to thought it
> > > was a bad thing for the core dump to even travel to a remote machine. The
> > > remote gdb could be vulnerable to a carefully crafted core dump,
> > > potentially
> > > gaining access to the server, and also other user's core dumps.
> > > 
> > > Even if the core dump generation using gdb on the remote server is secure,
> > > other services that it offers could be compromised and attackers could
> > > harvest passwords and other data from the core dumps.
> > 
> > ABRT warns users before uploading core dump and they can generate
> > backtrace locally if they have concerns about security.
> 
> Warning users doesn't make the retrace server secure. And there's currently
> no other ways to generate a backtrace with full debuginfo.

This topic is being discussed here :
https://github.com/abrt/abrt/issues/834

> 
> > > > > is still there for all the reports sent to the ABRT server.
> > > > 
> > > > No, the new workflow doesn't upload the core dump. If ABRT uploads the
> > > > core dump, it is a bug or you don't have Shortened Reporting ON:
> > > > 
> > > > https://github.com/abrt/abrt/wiki/Configuration#shortened-reporting
> > > 
> > > Right, but that's still available when doing "shortened reporting off", no?
> > 
> > Yes, exactly. And GNOME user will do "Shortened reporting ON" by
> > default.
> 
> Why wouldn't other users want to make use of the "shortened reporting"?

We want to allow users of other DEs to report bugs to Bugzilla without
the need to configure ABRT.

> 
> > > I don't understand how one would switch between those 2 modes,
> > 
> > In the ABRT Preferences window. See:
> > https://github.com/abrt/abrt/wiki/Configuration#shortened-reporting
> 
> As I mentioned before, I'm not sure why users wouldn't want to have this feature
> on, all the time.

It would prevent users from submitting a full report to Bugzilla.

> 
> > >  or how they might know the difference.
> > 
> > It will be documented in the ABRT Preferences window, on the online
> > documentation and in man pages.
> 
> I still don't understand why we want to make this an option, so I'd like to know
> the difference now :)
> 

ON  -> automatic report (?comment) [ABRT server]

OFF -> automatic report (?comment) [ABRT server] + full report
[Bugzilla]

> <snip>
> > > > > Finally, I'd still prefer a way for the stack traces with mini-debug
> > > > > that
> > > > > should
> > > > > already be available on the system to be uploaded without interaction.
> > > > > Full
> > > > > debug
> > > > > traces could be sent out as additional information to those reports
> > > > > (whether they
> > > > > end up in Bugzilla or just on the ABRT server).
> > > > 
> > > > Yes, if you use the notification bubbles for reporting, then ABRT works
> > > > as you describe. You can also enable the Auto-reporting to get rid of
> > > > necessity to click "Report" button in the notification bubble:
> > > > 
> > > > https://github.com/abrt/abrt/wiki/Configuration#autoreporting
> > > > 
> > > > The new workflow disables Bugzilla (and all the tings before opening a
> > > > new Bugzilla bug) when Shortened Reporting is ON for the reporting
> > > > process started from the GUI.
> > > 
> > > This should probably be integrated in the Privacy Settings of the desktop
> > > instead
> > > of being in the bug reporting application's preferences.
> > 
> > Sure, what should I do to get this done?
> > 
> > I have attempted to develop a custom ABRT panel for control-center but I
> > failed:
> > https://mail.gnome.org/archives/gnomecc-list/2012-October/msg00017.html
> 
> That's because, as I said above, and 2 years ago, it should be integrated into the
> Privacy panel, and it should only configure how to capture crashes (not at all,
> locally only, or report them automatically).
> 
> Adding something like ABRT's Preferences to gnome-control-center is out of the question.

OK, I've understood for the first time, it wasn't necessary to elaborate
more on that. I just wanted to express my will to work on this goal.
Unfortunately, your response didn't help me much again. I'd rather know
what is the preferred way of accomplishing this goal.

Thanks Elad for filing https://github.com/abrt/gnome-abrt/issues/74


Kind regards,
Jakub




-- 
desktop mailing list
desktop@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/desktop





[Index of Archives]     [Fedora Users]     [Fedora KDE]     [Fedora Announce]     [Fedora Docs]     [Fedora Config]     [PAM]     [Red Hat Development]     [Red Hat 9]     [Gimp]     [Yosemite News]

  Powered by Linux