Debian’s maintainer of the Meson build system package is calling attention to the unfortunate state of Debian’s bug tracker in 2026. Editing bug data within Debian’s bug tracker still relies on writing custom-formatted emails and submitting them via your mail client. There still is no modern web UI for managing the Debian bug tracker as it was largely written in the early 90s.
Jussi Pakkanen is the creator project leader of the Meson build system. Jussi also maintains the Meson package for upstream Debian too.
Pakkanen is shining light on the unfortunate state of the Debian bug tracker in 2026:
“Using an email client as the only way of modifying bugs (which is how the Debian bug tracker works) is not only a bad idea, it is terrible idea. To me managing bugs is so awful that it is actively pushing me away from contributing to Debian. The bug statuses on Meson are not kept up to date because I prefer that to having to deal with the bug tracker. I suspect I am not alone in this. In any case it is a major hurdle for new developers and might even cause some people to drop out entirely.
…
There is no web UI for manipulating bug data. Instead you write an email in a custom format, send that to a specific email address and wait for things to happen.
…
How does security on the system work?It doesn’t. The email interface is 100% open. Anyone can send edit any bug in any way just by sending a suitably crafted email to the control address. If a 4chan script kiddie would want to screw up the entire Debian bug repository, they could do so fairly easily.
There is an actual term for this approach: security through obscurity. The fact that the main bug tracker of the OS that runs the world does not have strict authentication in place does not fill me with warm fuzzies.”
Those wishing to read more about Jussi’s thoughts on his experiences with the sad state of the Debian Bug Tracker can do so via his personal blog.
