3 ms·

Is the linked PPA [1] actually maintained by Mozilla or is it volunteers? I can't tell. The uploader looks like a freelancer and the PPA owner hasn't been activ

by lin83 4y ago

Is the linked PPA [1] actually maintained by Mozilla or is it volunteers? I can't tell. The uploader looks like a freelancer and the PPA owner hasn't been active on Mozilla's Bugzilla in over a decade. [1] https://launchpad.net/~mozillateam/+archive/ubuntu/ppa https://launchpad.net/~mozillateam/+archive/ubuntu/ppa

jcastro 4y ago
People in this thread (and the author of the article) are under the assumption that Mozilla is running this PPA, it's run by the community. That being said ricotz has been participating in the Ubuntu community for a very long time, and from a practical standpoint you'll probably be ok. There's a good reason for Ubuntu to push people away from PPAs as distribution methods for end users and instead use them for what they were original supposed to be used for, make it easy for distro developers to fire up repos for testing/development with the intent of that work making it back into distro and Debian. Snaps have lots of problems but using the distro-staging PPA isn't a good idea either.
- lin83 4y ago
  I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise his account via his old email, e.g. if he used a now expired domain that could be registered, they could use this PPA to deliver a backdoored Firefox build to thousands of users and steal their passwords, tokens and SSH keys. Community support is great but without a proper security team and enforced secutiry processes the PPAs are very dangerous. [1] https://wiki.ubuntu.com/JohnVivirito https://wiki.ubuntu.com/JohnVivirito [2] https://www.dignitymemorial.com/obituaries/apex-nc/john-vivirito-5422868 https://www.dignitymemorial.com/obituaries/apex-nc/john-vivi...
  - hda111 4y ago
    Thanks for letting us know. Will use the snap then.
  - cjwatson44 4y ago
    Thanks for the links, which do seem to check out. I've marked John's Launchpad account as "deceased", so it's still visible for archival purposes but even if somebody gains control of his former email address it's no longer possible for them to make any use of his Launchpad account using it.

by lin83 4y ago

jcastro 4y ago

People in this thread (and the author of the article) are under the assumption that Mozilla is running this PPA, it's run by the community. That being said ricotz has been participating in the Ubuntu community for a very long time, and from a practical standpoint you'll probably be ok. There's a good reason for Ubuntu to push people away from PPAs as distribution methods for end users and instead use them for what they were original supposed to be used for, make it easy for distro developers to fire up repos for testing/development with the intent of that work making it back into distro and Debian. Snaps have lots of problems but using the distro-staging PPA isn't a good idea either.

lin83 4y ago
I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise his account via his old email, e.g. if he used a now expired domain that could be registered, they could use this PPA to deliver a backdoored Firefox build to thousands of users and steal their passwords, tokens and SSH keys. Community support is great but without a proper security team and enforced secutiry processes the PPAs are very dangerous. [1] https://wiki.ubuntu.com/JohnVivirito https://wiki.ubuntu.com/JohnVivirito [2] https://www.dignitymemorial.com/obituaries/apex-nc/john-vivirito-5422868 https://www.dignitymemorial.com/obituaries/apex-nc/john-vivi...
- hda111 4y ago
  Thanks for letting us know. Will use the snap then.
- cjwatson44 4y ago
  Thanks for the links, which do seem to check out. I've marked John's Launchpad account as "deceased", so it's still visible for archival purposes but even if somebody gains control of his former email address it's no longer possible for them to make any use of his Launchpad account using it.