Subject: Re: Bugzilla

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 04 Jan 2003 10:45:50 -0500

In message <[email-masked]>, Melinda Shore writes:
>For those of you who've used bugzilla for tracking WG
>issues, what do you think of it?  What did you like,
>dislike, etc.?  What categories and so on did you use?
>Could you send the URLs so I could take a look at them?
>
Apart from its technical merits, note that Bugzilla has been the 
subject of repeated security alerts.  Whoever is running such a server 
will need to maintain it very actively.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)

---

From: Bernard Aboba <[email-masked]>
Date: Sat, 4 Jan 2003 07:28:06 -0800 (PST)

At IETF 53, there was a WG chair meeting on this subject, and some
discussion of the merits of various programs including Bugzilla and RT.
My understanding was that RT had fewer security issues than Bugzilla.
As I recall, RT also has nicer reporting facilities.

In discussion, it appears that there was no program that precisely met the
needs of the IETF, including:

a. Ability to make sure that all Issue discussions also appeared on
the WG mailing list. Most programs require addition of a facility to
enter Issues from a Web form that can both be entered into the Issue
db as well as being sent to the WG mailing list. Trying to parse Issue
mail directly from the WG mailing list seems like a losing proposition.

b. Ability to automatically link the entry in the Issue db to the WG
thread on the topic. This requires integration between the Issue tracking program and
the mailman mailing list manager.

c. Ability to assign varying levels of privilege to WG chairs, editors,
and participants, according to the draft involved. Programs like Bugzilla
don't support that level of access control granularity.

d. Customized reports that can summarize Issue status to the appropriate
individuals (AD, WG Chair, WG list) in a way that is meaningful. For
example, one might imagine a monthly report providing status on the
incoming and resolved issues, current disposition of the Issues (fixed,
rejected, pending), etc.

---

From: Joseph Reagle <[email-masked]>
Date: Mon, 6 Jan 2003 09:53:47 -0500

> As I recall, RT also has nicer reporting facilities.

We've been having similar discussions for a few years at the W3C as well:
  http://lists.w3.org/Archives/Public/www-qa-wg/2001Dec/0027.html
  http://lists.w3.org/Archives/Public/www-qa-wg/2001Dec/0020.html
  http://hades.mn.aptest.com/cgi-bin/voyager-issues
  http://www.w3.org/2002/12/open-issues.php3

(And I'm sure there are others.) I've yet to use any tools myself, though 
Dom's "poorman's tracking" (the last link) seems rather nifty. Does anyone 
at W3C remember the status of our tools discussions?