Collective security wisdom and Internet RFC recommendations state that a form using the GET method, or links with GET parameters, must only be used for things that have no side-effects: viewing a bug report, for example, or searching for one. But if the action is to delete something or to edit it in any way, then the action should only be reachable via a form using the POST method. The Google Web Accelerator brought this issue to the forefront recently, but the recommendation is sound in all contexts. (Read up on "CSRF" (Cross-Site Request Forgery) attacks for more on this.) While clicking a bugnote's "Edit" link did not immediately edit data, it was probably changed to a button to match visually with the "Delete" and "Make Private" buttons, which, since they do change data, must be buttons.