The page onion.debian.org lists onion services for the Debian project. There are a lot of them, but nothing for:
Part of the problem arises from an unhealthy attitude that bug reporting is a service that benefits the tester. That it is okay to make testers go through cumbersome hoops. Testers are actually contributors. The project should be doing all that it can to make it as easy as possible to submit bug reports because bug reports are inherently labor intensive. Bug reports improve the software for everyone. The tester may or may not even be a stakeholder. They are making a charitable contribution.
The Debian project is unapologetically telling testers to switch to clearnet and mainstream browsers when the bug services discriminate against users based on the network or browser version they use. Yikes. I hate to see Debian go in this direction.
Part of the problem arises from an unhealthy attitude that bug reporting is a service that benefits the tester.
Could you please cite your source? Is there a document or mailing list thread that states that this is the reason that those services do not have onion endpoints?
The Debian project is unapologetically telling testers to switch to clearnet and mainstream browsers when the bug services discriminate against users based on the network or browser version they use.
Where are they saying this? Are they actually treating connections from Tor exit nodes or Torbrowser differently?
Could you please cite your source?
It’s wholly anecdote from decades of experience. AFAIK, there have been no peer reviewed scientific studies about this. But there should be. It would be interesting to research why it is that testers and bug report contributors are generally widely regarded as needy and demanding of favors. That’s not Debian specific. It’s FOSS wide.
The public perception is that devs are the sole contributors and testers are perceived as tasking the devs for their own personal gain. It impacts software quality because I often encounter bug reports that are very old when searching for prior reports of bugs I discover.
A project that effectively promotes good quality makes it very easy to submit bug reports anonymously, without imposing much of an obsticle, so that bug submissions are not disouraged and so everyone has good awareness of the bug history. Debian has been good on this, which is why Debian is a relatively high-quality project. But they are slipping amid the fight against spam and bots.
Where are they saying this?
IRC
Are they actually treating connections from Tor exit nodes or Torbrowser differently?
Yes. It is no longer possible to submit bugs over Tor, and bugs.debian.org quietly drops packets if the user’s user agent is not what they want.
My assumption was that it might be due to the modern onslaught of bots creating reports, and if they were on the 🧅 it’d be more difficult to filter/block bot reports. But that may be a complete misunderstanding on my part of how that all works.
The
bugshost and thereportbugshost would have to be considered separately. Thebugshost is strictly for viewing text, just like the other onion hosts. Thereportbugshost could be abused, but because the Debian project is non-transparent, makes no announcement, we can only guess what’s going on when they silently take a spontaneous action. Only after they express what action they took, and why, can we analyze whether it was sensible and how to move forward. Certainly it would be possible to deploy an onion host that accepts bug reports, and then put the traffic through an appropriate process, such as spamassassin scoring.
