Tag: mozilla

happy bmo push day!

release tag

the following changes have been pushed to bugzilla.mozilla.org:

  • [1448681] Bugmail Message-ID header format changed without changing In-Reply-To/References, breaking threading
  • [1440829] Bugzilla comment for Phabricator commit should include entire commit message, not just first line
  • [1449413] Refactor circleci container building stuff
  • [1449156] Bugzilla::Memcached should use smaller timeouts and ping servers at instantiation time
  • [1449168] Remove warning –function from jobqueue worker
  • [1441063] Misleading bugzilla comment when asking for re-review
  • [1200695] API-key-creation emails should reflect if the action was a result of auth delegation
  • [1450008] documentation link in API errors is wrong
  • [1450010] The jobqueue supervisor’s pidfile should not be stored in the data directory
  • [1441897] Improve opengraph metadata for bug pages
  • [1447027] Document and tweak vagrant vm to support testing emails
  • [1441244] prevent compounding error messages in tests
  • [1450343] Make the SES handler use Bugzilla::Logging and log more details

discuss these changes on mozilla.tools.bmo.

happy bmo push day!

release tag

the following changes have been pushed to bugzilla.mozilla.org:

  • [1443559] Remove “Urgency” (mapped to priority) field from the “form.doc” bug form for MDN content bugs
  • [1441903] Cleanup Makefile.PL
  • [1444088] review link for patches on the requests page no longer shows up
  • [1444627] Display saved searches on MyDashboard as an inline list
  • [1439993] Remove COMPILE_DIR => setting from Bugzilla::Template when effective group != webservergroup to prevent filesystem permission errors
  • [1437238] Create override parameters for mailer configuration.
  • [1427503] Allow all users to use Duo as the MFA provider.
  • [1443162] Attachment links should include urlbase
  • [1445041] if memcached server does not end with a port, append :11211
  • [1445098] flush stdout on cereal daemon
  • [1445066] Clicking “Last search results” sometimes results in an error
  • [1445042] log heartbeat errors
  • [1441181] Implement new process model for running multiple email jobqueue daemons
  • [1445700] apache_size_limit should be 800_000 when Linux::Smaps is not installed
  • [1446042] Please remove the IPC request form in Bugzilla
  • [1443058] Backport 1087400 to bmo – CGI 4.05 throws tons of “CGI::param called in list context” warnings
  • [1446156] mkdir template_cache: Permission denied
  • [1440328] Mentor email addresses not obfuscated when signed out
  • [1447221] memcache no longer returning results due to mismatched key handling in get vs. set
  • [1447291] Remove Apache2::Log from PhabBugs/Push in favor of logging framework
  • [1447289] heartbeat check should not check for enabled features
  • [1444008] Form action injection in Bugzilla /user_profile (leads to XSS/single-factor credential leakage)

discuss these changes on mozilla.tools.bmo.

happy bmo push day!

release tag

the following changes have been pushed to bugzilla.mozilla.org:

  • [1437383] Create User.pm PhabBugz class for loading of a user object from phabricator
  • [1441329] Fix typos in the PhahBugz User.pm module
  • [1438206] Process SES email bounces properly
  • [1441475] BMO is vulnerable to reverse tabbnabbing
  • [1437384] phabbugz_feed.pl in PhabBugz extension should be extended to also query for new users in Phab
  • [1403344] Extract schema migration code from checksetup.pl and expose via docker container command
  • [1429621] Add Saved Searches to My Dashboard
  • [1433299] Link in summary is broken
  • [1384313] Can’t build the docs from within the vagrant box
  • [1441569] remove_idle_group_members.pl fails on vagrant box
  • [1440239] Assign a secure revision to the `secure-revision` group project
  • [1437646] Support Mozlog logs using Log::Log4perl
  • [1442099] Add memcached tracing to help debug weirdness in cloud env
  • [1442288] Bugzilla::Logging should log when a program is being run interactively
  • [1442520] move inbound_proxies to localconfig
  • [1402494] BMO Integration User is a full administrative user on Phabricator
  • [1443003] Port bug 1175211 to Harmony branch (Undefined subroutine &Bugzilla::CGI::SERVER_PUSH)
  • [1273381] Improve bugzilla object performance by using Class::XSAccessor for object accessors
  • [1419973] Modify product selector layout on Browse and Enter Bug pages
  • [1429344] Review requests in requests dropdown should link to MozReview or GitHub instead of Bugzilla details page
  • [1433573] Display the short URL link even for queries without any results
  • [1443049] is_interactive() must be declared before log4perl config is loaded
  • [1343248] Migrate secbugstats scripts to bmo production
  • [1441181] Implement new process model for running multiple email jobqueue daemons

discuss these changes on mozilla.tools.bmo.

Small Pull Requests, a week-ish later

I think this “chains of PRs” thing is working quite well. I’ve been playing around with how I name the branches, and thinking harder about automating it.

Of course it’s really ballooning the number unreviewed PRs I have.
I think my new name might be Dylan “Twenty Unreviewed Pull Requests” Hardison.

But some observations:

  1. Even with no automation, this isn’t much more work for me.
  2. Smaller commits lend themselves to drive-by reviews.
  3. I’ve also observed more mistakes being found.

So I’m going to continue to work this way for all larger tasks.

I wonder how many PRs it will be to implement oauth2?

happy bmo push day!

release tag

the following changes have been pushed to bugzilla.mozilla.org:

  • [1433993] Outdated FreeOTP link in user preferences
  • [1433833] Add index to email_rates.message_ts
  • [1436301] Exempt bot accounts from idle group removal
  • [1430259] Update policy code in BMO PhabBugz extension to update custom policy if a private bugs groups have changed.
  • [1343248] Migrate secbugstats scripts to bmo production
  • [1434064] Refactor Project.pm to use Moo for better type checking
  • [1434438] Refactor Revision.pm to use Moo for cleaner type checking
  • [1424363] securemail help page recommends getting a certificate from StartCom
  • [1433400] Prevent cross-site image requests from leaking contents of certain fields due to regex search
  • [1435735] Add script to add email job to jobqueue
  • [1211377] needinfo from someone not in sec group shows warning message even when bug is being removed from sec group
  • [1432296] Prevent bugzilla static assets from being blocked by overly long request URIs

discuss these changes on mozilla.tools.bmo.

Profiling as validation

Among a bunch of other things that are going on, we’re migrating bugzilla.mozilla.org to a new home in AWS.

So the team (bobm and ckolos) have been very dedicated to validating the new stuff is as good, and hopefully better than the old stuff. To this end they’ve been working with another engineer (rpapa) to do load testing. Some of the load testing results have been a bit unusual, perhaps even impossible.

But that’s okay, because I’ve recently made it very easy to profile the code using Devel::NYTProf.
Looking at preliminary profile data, it seems that perhaps the overhead of connecting to mysql may be higher in the new environment.
It could also be something else — more analysis is needed.

I’m sure this must be a thing, but to be honest I haven’t ever read about someone using a profiler in this way, so perhaps is deserves a mention.

My Little Features: Deprecation is Magic

I’m still hammering out what features I want to see land in BMO this year but one thing I’ve come to realize is that often the way forward on an old code base is through careful deprecation.

Adding new features, or even fixing existing bugs is often blocked by the immense weight of past decisions.

Recently we deprecated support for IE 11.
This was magic: We can use more modern javascript features. async/await, arrow functions, and so on make the frontend code much nicer to work with. It puts us on a good footing to remove our use of legacy JS frameworks and (I believe) makes contributions more attractive.

This is not to say we will enthusiastically deprecate everything that holds us back, but a measured approach is called for here.

I’m going to list the things that I intend to deprecate in the first half of 2018. This isn’t a roadmap for 2018 but these deprecations and changes will feed into that.

Server-side bug link tooltips

Right now we spend a lot of time rendering comments.
It would be nice to cache them — but they’re not cache-able in general because they contain user-specific data. That is, if you can see a security bug you’ll be able to see its description in the mouse-over hover of a bug.

After looking at several options for this, I realized it would be better to add the tool-tips client side.

While not a silver bullet, this also paves the way for adopting markdown (something I’m actively working on).

Benefit: Faster page loads, especially on popular bugs with more than a few dozen comments.

Server-side PUSH used in buglist.cgi

So if you use Firefox, you get a much better experience using buglist.cgi. You see the chomping dinosaur while your search results are collected. Unfortunately, this doesn’t work in any other browser, and it isn’t standardized. As a result, we have to be very careful with our load balancers and so on.

Making this fetch() call is pretty easy, but supporting both as an in-page fetch() and an HTTP push is quite hard. So when this switches to a fetch() the HTTP push is going away.
This is almost not a deprecation because the functionality will be mostly the same.

Benefit: Firefox users will get a better UX when request times out, and everyone else will benefit too.

The legacy show bug view will lose inline history

Right now 90% of page views hit a page that uses CSP. But many people
continue to use the legacy HTML view, which cannot do CSP because of the
InlineHistory Bugzilla extension. The legacy bug page is deprecated already
— it does not receive updates and we don’t care much about UX regressions
on it.

Short of just turning it off, I’m going to enable CSP for it. This means
inline history won’t work.

At some point, we’re just going to turn it off, and this is a step towards that.

Benefit: Security, less bad javascript to maintain.

Unsafe links will no longer be linkified

Already javascript: links in the URL field do not work on the main bug view
page. Now all bug URL links that are marked “unsafe” will appear as
clipboard-copyable text areas.

Benefit: Usability, you’ll be able to more easily use test-cases that are javascript: links.