Re: [Repo-criteria-discuss] Include Gogs (Notabug.org) for consideration

[Andrew Ferguson]

Hi all,

I thought I would have a look at NotABug.org to see what it would score on the criteria. I have evaluated it according to the latest version of the criteria, and it scores an F. I have attached HTML code listing the evaluation that I think is in an appropriate format for addition to the evaluation page, but below I have added a more detailed explanation for the grade.

C0 (important functionality works with LibreJS enabled) – FAIL. The following features do not work with LibreJS enabled:

Adding Issues (can't upload files, select users, add a description, preview, submit issue)
Delete repository;
Transfer Ownership
Add an SSH key; - can get SSH key but not switch to get HTTPS key
Add label, milestones and assignees to issues
Browse commits; --Clicking to open a commit opens a 404 when LibreJS is running

The following features are OK with LibreJS enabled:

Sign up
Sign in
Sign out
Change repository name;
Change repository description;
Create first project; (stumbles in phone verification)
Fork a repository
Subscribe/unsubscribe to code commit notifications;
Set user permissions

C1 (no other nonfree software required) – FAIL? Much like GitHub, NotABug uses flash for the 'Copy to Clipboard' functionality. Does this mean it fails? (There is no mention of this on GitHub's evaluation).

C2 (does not discriminate against classes of users) – FAIL?. Rather worryingly IMHO, there does not seem to be any Terms of Service for using NotABug. While this could be interpreted as 'everyone is allowed', I'm hesitant to say it passes this. Clarification?

C3 (permits access via Tor) – PASS. Seems to work fine through Tor.

C4 (no odious terms and conditions – FAIL – for the same reasons as C2.

C5 (GPLv3-or-later as much as any other) – PASS – GPLv3 is included in the default list of licenses. There is no mention of 'or-later', but this would be added in the individual source files by the developer, rather than in the license file itself.

C6 (HTTPS) – PASS. NotABug uses HTTPS, and I've run it through some 'HTTPS-checkers' and it seems OK. Is there any specific tests that should be run to confirm this?


What do people on this list think? Is this a fair evaluation? I would also appreciate clarification on C1, C2 and C6.

Regards,
Andrew



HTML evaluation below:

<h3 id="NotABug">NotABug -- F</h3>

<p>Things that prevent <a href="" class="moz-txt-link-rfc2396E" href="https://notabug.org/">"https://notabug.org/">NotABug</a> from moving up to the next grade, <a href="">C</a>:</p>

<ul>
  <li id="NotABug-C0">
    Important site functionality does not work without running nonfree _javascript_.
    (<a href="">C0</a>)
  </li>
 
  <li id="NotABug-C1">
    Flash is required for copying SSH / HTTPS clone URL.
    (<a href="">C1</a>)
  </li>

  <li id="NotABug-C2">
    NotABug have not published a Terms of Service document, therefore it is uncertain whether it discriminates against certain countries or classes of users.
    (<a href="">C2</a>)
  </li>
 
  <li id="NotABug-C4">
    NotABug have not published a Terms of Service document.
    (<a href="">C4</a>)
  </li>
</ul>

On 26/04/16 16:22, Zak Rogoff wrote:

On 04/26/2016 10:04 AM, Mike Gerwitz wrote:

Hey, Ben:

On Tue, Apr 26, 2016 at 00:44:09 -0400, ben wrote:

Gogs is a free software Git service written in Go.  It is under the
Expat (MIT) license.  The instance at notabug.org is open for public
registration.  Upon a cursory examination, it qualifies for the "C"
grade under these criteria. I hope this service can be added to the
evaluations.

Thanks for doing the evaluation!  Would you be able to include your
rationale for each of the criteria?  Otherwise, I'm not sure when others
will have the time.

Zak---would this be good to include?  notabug.org has been increasingly
popular since Gitorious was taken down.

Yes, I would love to have an evaluation of notabug! Someone just needs
to do the actual evaluation and send it to the list to be reviewed, HTML
format it so that it can go onto the page and then, once it's gotten a
final review by the list, send it to address@hidden to put up.