I received an update to a bugreport, but responding to it bounced.

I don't know if this is a one-off experiment or a common setup, but
I find it bad for Salse to inject automated emails to Debbugs: Debbugs
is supposed to be usable with email interaction.

Arguably, such setup is spam: I is a bot that messes with the bugs but
is not accountable for its actions, since it is only a one-way
communication. Sure, I can then investigate the email and figure out
which non-email side channel might reach the true originator of the
bot activity, but I have no interest in that added burden laid on me.

The concrete incidence is https://bugs.debian.org/972695#28

Am I missing something sensible here, or do others also see a problem
in this setup?

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

El 31/5/25 a las 18:19, Jonas Smedegaard escribió:

The concrete incidence is https://bugs.debian.org/972695#28

Am I missing something sensible here, or do others also see a problem
in this setup?

That's an automatically triggered message created by a gitlab hook,
which parses the commit message for "closes: #nnnnn" and notifies the bug submitter when it's known that the bug is fixed in salsa.

I don't see a big problem in those messages being "noreply",
considering that they are generated automatically, but
maybe the wording:

(this message was generated automatically)

could be improved to

(this message was generated automatically, please do not reply)

or alike.

Thanks.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Quoting Santiago Vila (2025-05-31 20:17:59)

El 31/5/25 a las 18:19, Jonas Smedegaard escribió:

The concrete incidence is https://bugs.debian.org/972695#28

Am I missing something sensible here, or do others also see a problem
in this setup?

That's an automatically triggered message created by a gitlab hook,
which parses the commit message for "closes: #nnnnn" and notifies the bug submitter when it's known that the bug is fixed in salsa.

The problem is that the confident submitter is a bot.

In the concrete case, I replied to point out that the bug closure was a mistake. That reply bounced.

Is it wrong of me to cc the "person" interacting with a bugreport?

Is it wrong of me to expect being able to reach that "person"? Easily?

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private --==============24827157952475419=MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Description: signature
Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

-----BEGIN PGP SIGNATURE-----

wsG7BAABCgBvBYJoO1taCRAsfDFGwaABIUcUAAAAAAAeACBzYWx0QG5vdGF0aW9u cy5zZXF1b2lhLXBncC5vcmdHhBA9pTpaZmzTgRNlBlOPVz9ZnVDQT9Cz0VI9PUBA KhYhBJ/j6cNmkaaf9TzGhCx8MUbBoAEhAAAgVw/+Lc4jNtgePL+IE55/5zFZWsJo jaMhYTHAGjUELSggMJVGI36VJu9X+c5K39nfdG06o5e5zoNKLDWN5YQNUcttGt0Y Dy6hqeN6FdcGzQdwfMeLXO/DykAd2BS6fV3fmpIPz+Gk/1cTiCx7iJA6J0gl84PC g+5VLw/qJiCbQzgXCa2hE3QJwASCT3/gqocSufGEqhzce29cWn/VuEDopx9o7are xQEF7QXKMTINU/N8HQMkT1cQU7Pq/foyXBjEOdsZ9TATZLqSmwalA3sQ/Y3PGPuD Hi6JM5t6l1rKr8pnIHaQBP+rR7w01PYda8lSV8CxWf1BqZ26uQa6zVbOiPB4ztn1 qj7kHd0LqwB/kzcrrK8mg+WVw1RT9QMNqbwZcRTb

El 31/5/25 a las 21:41, Jonas Smedegaard escribió:

That's an automatically triggered message created by a gitlab hook,
which parses the commit message for "closes: #nnnnn" and notifies the bug
submitter when it's known that the bug is fixed in salsa.

The problem is that the confident submitter is a bot.

In the concrete case, I replied to point out that the bug closure was a mistake. That reply bounced.

Is it wrong of me to cc the "person" interacting with a bugreport?

Is it wrong of me to expect being able to reach that "person"? Easily?

For comparison: A long time ago, messages sent to debian-devel-changes
had the name of the maintainer in the From: field, but the maintainer
was not the real person sending those messages, so the name was "fake".

Now those messages have a From: field like this:

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

and everybody looking at those messages will know that replying to them
will only bother the ftpmasters, not the maintainer who
uploaded the package.


I think this case is quite similar. The visible name is "fake"
and maybe it's not proper for salsa to send messages
to the BTS with a real name using a noreply address.

However, I think most people consider those messages to be useful,
so philosophical objections aside regarding whether or not those
message should be sent at all, I would try to improve the way
they are sent.

Maybe some Salsa admin has something to say about this?
(I'm adding them in the Cc).

Thanks.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sat, 31 May 2025 20:17:59 +0200, Santiago Vila <sanvila@debian.org>
wrote:

I don't see a big problem in those messages being "noreply",
considering that they are generated automatically,

Answers to these messages shouldnt result in a generic bounce.

Greetings
Marc
--
---------------------------------------------------------------------------- Marc Haber | " Questions are the | Mailadresse im Header Rhein-Neckar, DE | Beginning of Wisdom " |
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi!

Arguably, such setup is spam: I is a bot that messes with the bugs but
is not accountable for its actions, since it is only a one-way
communication. Sure, I can then investigate the email and figure out
which non-email side channel might reach the true originator of the
bot activity, but I have no interest in that added burden laid on me.

The concrete incidence is https://bugs.debian.org/972695#28

Am I missing something sensible here, or do others also see a problem
in this setup?

It is an intentional feature implemented with Salsa webhooks (https://salsa.debian.org/salsa/salsa-webhook) that notifies the bug
report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972695 that
the maintainer merged https://salsa.debian.org/apache-team/apache2/-/merge_requests/43. It
used the headers:

From: Yadd <noreply@salsa.debian.org>
To: 972695-submitter@bugs.debian.org

The From address is indeed generic. It looks that there was an attempt
to use real From addresses in https://salsa.debian.org/salsa/salsa-webhook/-/commit/7c77c31af01a3f8f964de7b2a45ebd539b37a3b9
6 years ago but maybe the webhook payload does not have it?

I wonder also if the To-addresses are ideal I participated in the bug
but I didn't get any email. Only you got it as the submitter. We could
perhaps argue that the notification wasn't "spammy enough", because
the participants didn't get the original notification nor your reply
now.

Your reply had:

To: 972695-quiet@bugs.debian.org,
972695-submitter@bugs.debian.org, Yadd <noreply@salsa.debian.org>

I am wondering did you add this 972695-quiet@bugs.debian.org manually
or was it in the Reply-To headers? In this case it would have been
best for all participants to get your update.

What comes to suggestions on the email contents, they should go into https://salsa.debian.org/salsa/salsa-webhook/-/blob/master/templates/close.erb. I don't maintain this script - you should open a MR to have the
maintainers review and approve it.

Thanks!

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Quoting Otto Kekäläinen (2025-06-01 08:07:01)

Your reply had:

To: 972695-quiet@bugs.debian.org,
972695-submitter@bugs.debian.org, Yadd <noreply@salsa.debian.org>

I am wondering did you add this 972695-quiet@bugs.debian.org manually
or was it in the Reply-To headers? In this case it would have been
best for all participants to get your update.

I simply did a reply-to-all in my MUA.

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Jonas,

Le 2025-05-31 21:41, Jonas Smedegaard a écrit :

The problem is that the confident submitter is a bot.

In the concrete case, I replied to point out that the bug closure was a mistake. That reply bounced.

Is it wrong of me to cc the "person" interacting with a bugreport?

Is it wrong of me to expect being able to reach that "person"? Easily?

I suppose that in this specific case you wanted to interact with the
author of the commit, not with the bot or the author of the bot or its
admin.

It is not wrong, however with the current state of anti-spam measures
having bots that send mail with a "From: " address that could belong to
any foreign domain is not a good practice. So the sender address will
probably have to remain as it is, as arguably a bounce is a better
feedback here than silently accepting a message that will be ignored.

But the "Reply-To: " field of the bot message could certainly be
populated with the names and addresse(s) of the author and/or committer
(and NNN@b.d.o). Would that work for your case?

Cheers,

--
Julien Plissonneau Duquène

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Quoting Julien Plissonneau Duquène (2025-06-01 12:05:43)

Hi Jonas,

Le 2025-05-31 21:41, Jonas Smedegaard a écrit :

The problem is that the confident submitter is a bot.

In the concrete case, I replied to point out that the bug closure was a mistake. That reply bounced.

Is it wrong of me to cc the "person" interacting with a bugreport?

Is it wrong of me to expect being able to reach that "person"? Easily?

I suppose that in this specific case you wanted to interact with the
author of the commit, not with the bot or the author of the bot or its admin.

It is not wrong, however with the current state of anti-spam measures
having bots that send mail with a "From: " address that could belong to
any foreign domain is not a good practice. So the sender address will probably have to remain as it is, as arguably a bounce is a better
feedback here than silently accepting a message that will be ignored.

But the "Reply-To: " field of the bot message could certainly be
populated with the names and addresse(s) of the author and/or committer
(and NNN@b.d.o). Would that work for your case?

Not entirely sure, but yes, that sounds like a sensible solution to me.

- Jonas

--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sun, Jun 01, 2025 at 12:15:33PM +0200, Jonas Smedegaard wrote:

Quoting Julien Plissonneau Duquène (2025-06-01 12:05:43)

Hi Jonas,

Le 2025-05-31 21:41, Jonas Smedegaard a écrit :

The problem is that the confident submitter is a bot.

In the concrete case, I replied to point out that the bug closure was a mistake. That reply bounced.

Is it wrong of me to cc the "person" interacting with a bugreport?

Is it wrong of me to expect being able to reach that "person"? Easily?

I suppose that in this specific case you wanted to interact with the author of the commit, not with the bot or the author of the bot or its admin.

It is not wrong, however with the current state of anti-spam measures having bots that send mail with a "From: " address that could belong to any foreign domain is not a good practice. So the sender address will probably have to remain as it is, as arguably a bounce is a better feedback here than silently accepting a message that will be ignored.

But the "Reply-To: " field of the bot message could certainly be
populated with the names and addresse(s) of the author and/or committer (and NNN@b.d.o). Would that work for your case?

Not entirely sure, but yes, that sounds like a sensible solution to me.

I agree, that looks like a good plan.

Additionally, Adam D. Barratt from DSA has just made noreply@salsa
discard any messages sent to it, on my request. This way, if someone
replies to all and forgets to drop noreply@ from the CC: list, there
will be no bounce noise.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEst7mYDbECCn80PEM/A2xu81GC94FAmg92isACgkQ/A2xu81G C95aYxAAyhTu/aFeFUx8lS/ylJUM8wkA4KFuRF3Cak3E2ITLrna0gdSHY5H3DHpJ znSUxH+vpbFus5/rsOvKkB+Ivs7gowxerhVUO8UCKV0AFNvWjEi1qi4kx/8qZ7Q4 fJT1646Q7CyAiGoraNRkml8dBeztz+1AchlRP9UBzuv6JYJBHOKGx+u1EsVxXMrf bAcvKok3IW3H1vFSyQM9ZH63yuk4PK8uZXLz5jKPnZ/Md9vQS3aSLevBD29Kq5xh sf+TtH+8wQxq6oCyOPVvCHsk7fXPSkbUN8n0QDK/NeD13D96Jd32wybA5sZPa3c3 pDP9CWuDlbcV309KantAjJBUTM39jFZBi3aigz3x78QZkyTUATjVKwswgji2UPdz H/bdDQmMJhRGSsXwuP83kZ0msM/ZxJmTCdI/lO4X05Ec1eJ8/AS97rYdSMzcgj8/ Nklky3qtf+iFPnHYUUUFcsWcygpnihDi+frYlfeaI+lCJvjBH4IvC42rfrHC5Vvl V/GeNm6HkISK06Oio0Rhnkrq9cL5IWMne+8Bi0Xj2cow/6dbjlJs1Qgbk5xUH0vs zjaRfk0NDUtELqgexg1SKbkvg3F9/pj51RYF1+u96wA6cWfn5X4wJCFMX06y4kDB 2XWZCwU+fp5IYEvT+2iS2tWIdTopWlTSaXd8KMrO8YIVPtOPmeU=
=Msr6
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)