5 ms·

Tell HN: Google issue tracker does not allow viewing issues unless signed-in

69 points by MikeUt 5y ago

As the title says. Visiting either the domain (https://issuetracker.google.com/ https://issuetracker.google.com/) or a specific issue (https://issuetracker.google.com/issues/190835083 https://issuetracker.google.com/issues/190835083) presents only a sign-in screen. This is for merely viewing issues, not submitting or commenting on them, so arguments about limiting abuse do not apply.

easton 5y ago
It’s probably because someone was lazy and didn’t want to put a 404 screen up for if the issue was private. But this is lame.
- nguyenkien 5y ago
  They just required everyone to sign in to use it.
  - bootloop 5y ago
    He didn't say it was a permission issue, he said someone was to lazy to handle the use-case for users which are not logged in.
    - nguyenkien 5y ago
      It's clearly they made it for one use case, you have to login to use it.
oauea 5y ago
This is becoming more and more widespread, Atlassian is another company doing this. Although their case seems to be one more of incompetence than malice, since the issue page loads, shows you the entire page, then redirects you to their SSO system just as you're about to start reading. It's rather infuriating.
- tyingq 5y ago
  That sounds bad, especially if the documentation gives the impression that the data is only visible when logged in. It appears possible to make it public (e.g https://jira.atlassian.com/browse/JRASERVER-38101 https://jira.atlassian.com/browse/JRASERVER-38101). I guess the controls are too coarse though?
  - pc86 5y ago
    Atlassian just makes terrible software.
- wdfx 5y ago
  This infuriates me every time I go to some atlassian issue or doc page. I'm either logged in or not. Just show me the content and don't take it away from me for a pointless Auth check flow!!
- 0x77617472 5y ago
  Oracle / Java / JDK download is another one. Requiring you to login to download any non-latest version.
aikinai 5y ago
I guess the insinuation is that Google’s trying to force people to sign up for Google accounts? Seems to me like the cohort of users trying to file or check on Google issues without a Google account is minuscule and absolutely not worth spending development time on.
- MikeUt 5y ago
  The insinuation is that locking read-only access behind sign-in requirements is spreading, making preserving privacy online even more difficult.
blikdak 5y ago
Is this for an Open Source or other project? Not that I think there's any distinction at Alphabet anymore of course.
- abrowne 5y ago
  The listed link goes to a Android bug on the "Android Public Tracker".
- throwaways885 5y ago
  This application is the internal tool called 'Buganizer' that everyone at Alphabet use to file bugs. It's exposed externally in a limited way that allows people to file bugs for Google products (such as Android), but generally, not much else.
  - lumpa 5y ago
    Here's an interesting article that has more details about it: How I hacked Google’s bug tracking system itself for $15,600 in bounties by Alex Birsan https://www.freecodecamp.org/news/messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5/ https://www.freecodecamp.org/news/messing-with-the-google-bu...
- kop316 5y ago
  I know this is at least true for AOSP. I tried looking for/filing a bug with AOSP, and I wasn't even allowed to look for similar bugs unless I was signed in. I get requiring to sign in to file a bug, but I was a lot less interested in even trying to when the entire thing was walled off.
extra88 5y ago
I thought this was posted because it was a change but the Wayback Machine's information indicates it's been the case since at least 2017. https://web.archive.org/web/20170308160950/https://issuetracker.google.com/ https://web.archive.org/web/20170308160950/https://issuetrac...
x86_64Ubuntu 5y ago
I'm getting tired of everything requiring you to "sign-in" for even cursory viewing of data. I have noticed some things bucking the trend like ordering online from a restaurant. But more often than not, things seem to require some kind of account they can mine for contacts.
- gumby 5y ago
  Well to the restaurant it is more important to do business with you than to collect your data. While the issue tracker isn't Google's actual business, collecting data is.
- gxs 5y ago
  I stopped using thewirecutter.com for this reason (there are workaraounds, but in the end not worth the trouble). An account is now required just to read reviews. Over the years I've stopped using a number of sites - it's such an inconvenience to manage email/pws for a million different sites, not to mention a privacy issue.
yreg 5y ago
The obvious privacy drawback aside, this also hides the content from search engines - be it Google or others. (And other crawlers.) That upsets me more.
Game_Ender 5y ago
This is Google's internal company wide issue tracker exposed to the public [0]. It was built requiring sign on because that is the default way a mature company builds tools so it can properly handle authz and authn. My guess is nobody in that management chain cares enough to go through the effort of getting a mostly internal and collaborators system working without any auth. 0 - https://developers.google.com/issue-tracker https://developers.google.com/issue-tracker

69 points by MikeUt 5y ago

easton 5y ago

It’s probably because someone was lazy and didn’t want to put a 404 screen up for if the issue was private. But this is lame.

nguyenkien 5y ago
They just required everyone to sign in to use it.
- bootloop 5y ago
  He didn't say it was a permission issue, he said someone was to lazy to handle the use-case for users which are not logged in.
  - nguyenkien 5y ago
    It's clearly they made it for one use case, you have to login to use it.

oauea 5y ago

This is becoming more and more widespread, Atlassian is another company doing this. Although their case seems to be one more of incompetence than malice, since the issue page loads, shows you the entire page, then redirects you to their SSO system just as you're about to start reading. It's rather infuriating.

tyingq 5y ago
That sounds bad, especially if the documentation gives the impression that the data is only visible when logged in. It appears possible to make it public (e.g https://jira.atlassian.com/browse/JRASERVER-38101 https://jira.atlassian.com/browse/JRASERVER-38101). I guess the controls are too coarse though?
- pc86 5y ago
  Atlassian just makes terrible software.
wdfx 5y ago
This infuriates me every time I go to some atlassian issue or doc page. I'm either logged in or not. Just show me the content and don't take it away from me for a pointless Auth check flow!!
0x77617472 5y ago
Oracle / Java / JDK download is another one. Requiring you to login to download any non-latest version.

aikinai 5y ago

I guess the insinuation is that Google’s trying to force people to sign up for Google accounts? Seems to me like the cohort of users trying to file or check on Google issues without a Google account is minuscule and absolutely not worth spending development time on.

MikeUt 5y ago
The insinuation is that locking read-only access behind sign-in requirements is spreading, making preserving privacy online even more difficult.

blikdak 5y ago

Is this for an Open Source or other project? Not that I think there's any distinction at Alphabet anymore of course.

abrowne 5y ago
The listed link goes to a Android bug on the "Android Public Tracker".
throwaways885 5y ago
This application is the internal tool called 'Buganizer' that everyone at Alphabet use to file bugs. It's exposed externally in a limited way that allows people to file bugs for Google products (such as Android), but generally, not much else.
- lumpa 5y ago
  Here's an interesting article that has more details about it: How I hacked Google’s bug tracking system itself for $15,600 in bounties by Alex Birsan https://www.freecodecamp.org/news/messing-with-the-google-buganizer-system-for-15-600-in-bounties-58f86cc9f9a5/ https://www.freecodecamp.org/news/messing-with-the-google-bu...
kop316 5y ago
I know this is at least true for AOSP. I tried looking for/filing a bug with AOSP, and I wasn't even allowed to look for similar bugs unless I was signed in. I get requiring to sign in to file a bug, but I was a lot less interested in even trying to when the entire thing was walled off.

extra88 5y ago

I thought this was posted because it was a change but the Wayback Machine's information indicates it's been the case since at least 2017. https://web.archive.org/web/20170308160950/https://issuetracker.google.com/ https://web.archive.org/web/20170308160950/https://issuetrac...

x86_64Ubuntu 5y ago

I'm getting tired of everything requiring you to "sign-in" for even cursory viewing of data. I have noticed some things bucking the trend like ordering online from a restaurant. But more often than not, things seem to require some kind of account they can mine for contacts.

gumby 5y ago
Well to the restaurant it is more important to do business with you than to collect your data. While the issue tracker isn't Google's actual business, collecting data is.
gxs 5y ago
I stopped using thewirecutter.com for this reason (there are workaraounds, but in the end not worth the trouble). An account is now required just to read reviews. Over the years I've stopped using a number of sites - it's such an inconvenience to manage email/pws for a million different sites, not to mention a privacy issue.

yreg 5y ago

The obvious privacy drawback aside, this also hides the content from search engines - be it Google or others. (And other crawlers.) That upsets me more.

Game_Ender 5y ago

This is Google's internal company wide issue tracker exposed to the public [0]. It was built requiring sign on because that is the default way a mature company builds tools so it can properly handle authz and authn. My guess is nobody in that management chain cares enough to go through the effort of getting a mostly internal and collaborators system working without any auth. 0 - https://developers.google.com/issue-tracker https://developers.google.com/issue-tracker