May need to obfuscate email addresses in comments

[Stuart Bishop]

As bug comments can not be altered, we may need to detect and obfuscate
email addresses. We have already had cases of needing to manually edit bug
comments to address user's privacy concerns.

This bug can be rejected if we allow editing of bug comments.

[Brad Bollenbach (bradb)]

I think allowing comment editing is a good idea.

I also think it'd be good to agree on an LP standard for obfuscating email addresses; I made some suggestions in bug 263.

[Martin Pool (mbp)]

stevea told me today that Launchpad should never display email addresses to anonymous users or to search engines. At the moment we do that in bug comment text. email addresses can happen when eg someone manually pastes in text from a mail.

[Curtis Hovey (sinzui)]

I think we should replace the email address to look like <email address hidden> when the user isn't logged in. I'm not certain if we should be doing this in TALES or in QuestionMessageDisplayView--the former is global to the where as the latter is local to the context.

[Francis J. Lacoste (flacoste)]

On May 9, 2007, Curtis Hovey wrote:
> I think we should replace the email address to look like
> <email address hidden> when the user isn't logged in. I'm not certain if we
> should be doing this in TALES or in QuestionMessageDisplayView--the
> former is global to the where as the latter is local to the context.
>
I think it would be best to implement in the function use to render the text
that already convert bug numbers and URI-looking strings into hyperlinks.
That would fix the problem for bugs and for changelog content (and future
users of that function).

[suntin (gerard-payne)]

On Wed, 2007-05-09 at 19:53 +0000, Curtis Hovey wrote:
> I think we should replace the email address to look like
> <email address hidden> when the user isn't logged in. I'm not certain if we
> should be doing this in TALES or in QuestionMessageDisplayView--the
> former is global to the where as the latter is local to the context.
>

[suntin (gerard-payne)]

meh, guess you have to unsubscribe from the website ;P

But, on this subject; I think it's best not to print anything except the
users login name.
For myself if people want to talk to me I would rather they did so
through the forum, I don't mind administrators but I don't want the
general public to have that kind of information, I also don't want my
future skills judged by questions I asked 5 years ago because there are
identifiable links to me.
This has happened in job interviews where questions I asked as a student
were queried years later when I could have answered it in my sleep.

I also feel, in this case where I subscribed under my company mail that
there is a chance problems queried could be related to poor
configuration and expose commercial site flaws to malicious users.

That point could be extended to these mailing lists which also expose
the mail address of people in the thread.

Just my 2 pennies.

G

On Thu, 2007-05-10 at 03:43 +0000, suntin wrote:
> On Wed, 2007-05-09 at 19:53 +0000, Curtis Hovey wrote:
> > I think we should replace the email address to look like
> > <email address hidden> when the user isn't logged in. I'm not certain if we
> > should be doing this in TALES or in QuestionMessageDisplayView--the
> > former is global to the where as the latter is local to the context.
> >
>

[Curtis Hovey (sinzui)]

My branch to fix this is in review. Unauthenticated users will see <email address hidden> in bug and question messages.

[Martin Pool (mbp)]

On 6/15/07, Curtis Hovey <email address hidden> wrote:
> My branch to fix this is in review. Unauthenticated users will see
> <email address hidden> in bug and question messages.

Thankyou for fixing it. I would have suggested "person@....." but
maybe this is bikeshedding as I can't really substantiate it.

--
Martin

[Curtis Hovey (sinzui)]

Fixed in RF 4403.

[Curtis Hovey (sinzui)]

Fix released with Launchpad 1.1.6.