Jiri Moskovcak jmoskovc@redhat.com writes:
On 04/07/2011 02:01 PM, Denys Vlasenko wrote:
On Thu, 2011-04-07 at 09:34 +0200, Nikola Pajkovsky wrote:
Jiri Moskovcakjmoskovc@redhat.com writes:
I propose a little different solution:
Implement option <minimal-rating>3</minimal-rating>
and then instead of hardcoding the values you can:
if (rating< config->minimal_rating) error_msg(_("Rating is too low, blablablabla...."));
When I was on toilet, I realize, that doesn't make sense at all. See the scenario. Someone wants to report bug, but the backtrace is useless. "The bad guy" change<minimal-rating> to 0 and now "the bad guy" can successfully send totally useless backtrace to bugzilla or whatever. And we definitely don't want this.
The bad guy can always tweak "rating" element in dump dir.
The really bad guy can write a script which talks to Bugzilla and creates quadrazilloin of random bugs.
- or just download the abrt source and remove one line with the
condition which checks the backtrace and build his own packages ;)
yea I know ;)
IOW: you can't defend against significantly bad guys. Therefore, we are not trying to do that. We are only trying to defend against lazy reporters which would submit useless (bad rating) backtraces - if it's easy to do, but which wouldn't bother actively trying to subvert (hack) the tool to achieve this.
I'm a little thickheaded today. What do you want to see in abrt? Hardcoded trashhold with rating-required or minimal-rating?