Cannot file a non-security proprietary bug in Launchpad

[Jonathan Lange]

Currently, if you are filing a bug in the web user interface, there's no way to indicate that the bug is private.

Both the simple and complicated forms let you mark a bug as being a security vulnerability, but that's not the same thing.

[Mark Shuttleworth (sabdfl)]

Launchpad is a public service for collaboration between free software projects. We support cases where bugs have a security implication by allowing those bugs to be kept private (but disclosed to the project security team). We may also in future allow commercial users of Lp to annotate bugs with private comments that are not shared, but don't do that at this stage.

[Martin Pool (mbp)]

The workaround at the moment is to file a bug as security-related, then edit its status to make it private. afaik anyone can do this.

Canonical internally commonly uses private non-security bugs for customer issues. It would help if this was directly accommodated.

[Andrea Corbellini (andrea.corbellini)]

Also some non-security bugs may contain sensible data from the user. To respect his/her privacy everyone should be able to mark a bug as private. This is also one of the Ubuntu Bugs team guidelines.

[Martin Albisetti (beuno)]

Does this bug still apply?
You can now have private bugs by default for paying projects.

[Jonathan Lange (jml)]

It still applies. When you file a bug on a project such as malone, you cannot mark it as private, only as a security issue.

[Martin Pool (mbp)]

I think the bottom line here is:

Only selected people (commercial, canonical-support, etc) should be able to file private non-security bugs. However, people who are allowed to do this should be able to do it directly, without dancing around the security bit.

[Steve Kowalik (stevenk)]

I have fixed this bug by changing Bug:+filebug to show the information_type rather than the security_related checkbox. I will mark this bug as In Progress and assign it to myself, and then mark it as Fix Commited when the feature flag is enabled on production.