feature: subscribe to a bug without having an account

[Michael Hope]

gcc-linaro is used in a few outside Linaro projects such as OpenWrt. They'd like to report or subscribe to bugs without creating an account.

This is for people who don't normally use Launchpad. Subscribe is more important than report as I can always report the bug. It would be nice to be able to subscribe others.

The comment that kicked this off was:

<PaulFertser> Too bad linaro's bugtracking system is too weird to allow adding Felix to Cc...

[Robert Collins (lifeless)]

So this is in tension with the 'do not email people that haven't opted in', and I don't understand the difference between 'lp can email the person' and 'the person has an account in LP'.

If its about having to setup a new password, then I think this can be duped on the 'LP is not an openid consumer' bug, otherwise I'd like to understand what the actual scenario is here. (e.g. is it perhaps 'there is no way to invite people to join LP' (as facebook and twitter permit invites to be sent when you reference someone that isn't yet a member).).

[Curtis Hovey (sinzui)]

This relates to bug 344459, and may be a duplicate. Since Lp does not manage passwords, the issue is permitting an user to subscribe or be subscribed via an unknown email address. This leads to two complication that has been discusses in the past:
* This behaviour invites spam and can be considered an attack vector.
* There is no mechanism to verify if the address is mistyped.
* When the wrong address that Lp does not know about for an existing user is typed, a phantom subscription is created that the user cannot control...this is like the SSO/Lp address list mismatch nightmare