You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2025/06/19 14:10:48 UTC
Bugzilla now requires authentication
All,
The Tomcat project has been using Bugzilla to track issues for more than
20 years.
Recently there has been a significant increase in abusive traffic
targetting the ASF's Bugzilla instances - mostly AI scraping.
To protect the ASF Bugzilla instances and ensure that they remain usable
for the community, the ASF has - with regret - configured all ASF
Bugzilla instances to require authentication in order to access them.
If you need to search bugs, view a bug report, report a bug or otherwise
interact with Bugzilla, you will need to login in first. If you don't
have an ASF Bugzilla account, the link to create one is on the front page.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Bugzilla now requires authentication
Posted by Emmanuel Bourg <eb...@apache.org>.
On 19/06/2025 16:43, Mark Thomas wrote:
> While requiring authentication was a quick short term solution, some
> longer term solutions were discussed which includes migrating away from
> BugZilla. If we did so, GitHub issues is the obvious destination.
>
> When we last discussed moving to GitHub issues in 2022 [1] the consensus
> was not to. Has that view changed since then?
It looks like the Maven project is doing so currently, migrating away
from JIRA. But GitHub isn't free from spam, some projects are even the
target of realistic AI generated reports, I don't think we've received
such reports in Bugzilla yet.
The question is, do we want to sacrifice a bit of our independence to
align the project with the current development practices set by GitHub?
And would we see the things differently if the ASF had a GitLab or Gitea
instance that could provide an experience similar to GitHub but self
hosted? I think this option would have my preference.
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Bugzilla now requires authentication
Posted by Rémy Maucherat <re...@apache.org>.
On Fri, Jun 20, 2025 at 9:06 AM Mark Thomas <ma...@apache.org> wrote:
>
> On 19/06/2025 17:13, Christopher Schultz wrote:
>
> <snip/>
>
> > I guess maybe I don't understand the issue. BZ always required an
> > account to write, and anyone could register for an account. A small
> > hurdle, but present. The same is true for GitHub.
> >
> > I'm not sure why we care about AI scrapers, given that all the mailing
> > lists and source code are also public. Everything produced by the ASF
> > and its committers over the years has already been stolen and had
> > whatever IP protections it had stripped and thrown into a big blender.
> >
> > How does requiring a login to BZ to even *see* the bugs change anything?
> > Or is this an issue of scale? AI scrapers want to pull every bug for the
> > past 20 years and it's killing the service? And GitHub just has
> > effectively-infinite resources?
>
> Exactly. The AI scrapers are hitting the BZ instances hard enough it is
> effectively a DDoS.
>
> The authentication (for now) blocks the more expensive requests.
If it stabilizes things long term that would be awesome. It feels
really snappy again.
> > I have no particular preference. GH integrates nicely with PRs and all
> > of that. If we move to anything, I'd say GH is the way to go. I find
> > JIRA to be insufferable for some reason.
>
> Ack. I'd agree with "not Jira". That pretty much leaves GH issues as the
> only alternative - if we want to switch.
Emmanuel has a point that it gradually makes us too GH dependent. Not so cool.
Rémy
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Bugzilla now requires authentication
Posted by Mark Thomas <ma...@apache.org>.
On 19/06/2025 17:13, Christopher Schultz wrote:
<snip/>
> I guess maybe I don't understand the issue. BZ always required an
> account to write, and anyone could register for an account. A small
> hurdle, but present. The same is true for GitHub.
>
> I'm not sure why we care about AI scrapers, given that all the mailing
> lists and source code are also public. Everything produced by the ASF
> and its committers over the years has already been stolen and had
> whatever IP protections it had stripped and thrown into a big blender.
>
> How does requiring a login to BZ to even *see* the bugs change anything?
> Or is this an issue of scale? AI scrapers want to pull every bug for the
> past 20 years and it's killing the service? And GitHub just has
> effectively-infinite resources?
Exactly. The AI scrapers are hitting the BZ instances hard enough it is
effectively a DDoS.
The authentication (for now) blocks the more expensive requests.
> I have no particular preference. GH integrates nicely with PRs and all
> of that. If we move to anything, I'd say GH is the way to go. I find
> JIRA to be insufferable for some reason.
Ack. I'd agree with "not Jira". That pretty much leaves GH issues as the
only alternative - if we want to switch.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Bugzilla now requires authentication
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Mark,
On 6/19/25 10:43 AM, Mark Thomas wrote:
> On 19/06/2025 15:10, Mark Thomas wrote:
>> All,
>>
>> The Tomcat project has been using Bugzilla to track issues for more
>> than 20 years.
>>
>> Recently there has been a significant increase in abusive traffic
>> targetting the ASF's Bugzilla instances - mostly AI scraping.
>>
>> To protect the ASF Bugzilla instances and ensure that they remain
>> usable for the community, the ASF has - with regret - configured all
>> ASF Bugzilla instances to require authentication in order to access them.
>>
>> If you need to search bugs, view a bug report, report a bug or
>> otherwise interact with Bugzilla, you will need to login in first. If
>> you don't have an ASF Bugzilla account, the link to create one is on
>> the front page.
>
> :(
>
> While requiring authentication was a quick short term solution, some
> longer term solutions were discussed which includes migrating away from
> BugZilla. If we did so, GitHub issues is the obvious destination.
I guess maybe I don't understand the issue. BZ always required an
account to write, and anyone could register for an account. A small
hurdle, but present. The same is true for GitHub.
I'm not sure why we care about AI scrapers, given that all the mailing
lists and source code are also public. Everything produced by the ASF
and its committers over the years has already been stolen and had
whatever IP protections it had stripped and thrown into a big blender.
How does requiring a login to BZ to even *see* the bugs change anything?
Or is this an issue of scale? AI scrapers want to pull every bug for the
past 20 years and it's killing the service? And GitHub just has
effectively-infinite resources?
> When we last discussed moving to GitHub issues in 2022 [1] the consensus
> was not to. Has that view changed since then?
>
> I have no strong preference for either. My concerns are more around if
> we migrated, what would we migrate and how would we do it. We have a
> *lot* of historical data. We have a couple of smaller projects we can
> use to test any migration if we decide to go that way.
I have no particular preference. GH integrates nicely with PRs and all
of that. If we move to anything, I'd say GH is the way to go. I find
JIRA to be insufferable for some reason.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: Bugzilla now requires authentication
Posted by Mark Thomas <ma...@apache.org>.
On 19/06/2025 15:10, Mark Thomas wrote:
> All,
>
> The Tomcat project has been using Bugzilla to track issues for more than
> 20 years.
>
> Recently there has been a significant increase in abusive traffic
> targetting the ASF's Bugzilla instances - mostly AI scraping.
>
> To protect the ASF Bugzilla instances and ensure that they remain usable
> for the community, the ASF has - with regret - configured all ASF
> Bugzilla instances to require authentication in order to access them.
>
> If you need to search bugs, view a bug report, report a bug or otherwise
> interact with Bugzilla, you will need to login in first. If you don't
> have an ASF Bugzilla account, the link to create one is on the front page.
:(
While requiring authentication was a quick short term solution, some
longer term solutions were discussed which includes migrating away from
BugZilla. If we did so, GitHub issues is the obvious destination.
When we last discussed moving to GitHub issues in 2022 [1] the consensus
was not to. Has that view changed since then?
I have no strong preference for either. My concerns are more around if
we migrated, what would we migrate and how would we do it. We have a
*lot* of historical data. We have a couple of smaller projects we can
use to test any migration if we decide to go that way.
Mark
[1] https://lists.apache.org/thread/9dstc1j7ld1ol3rbm5zpm8wnx29jyold
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org