3 ms·
I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise hi
by lin83 4y ago
I'm pretty sure the owner of the “Mozilla Team” team PPA [1] has been dead since 2013 [2]. He is also listed as an Administrator. If someone were to comprise his account via his old email, e.g. if he used a now expired domain that could be registered, they could use this PPA to deliver a backdoored Firefox build to thousands of users and steal their passwords, tokens and SSH keys.
Community support is great but without a proper security team and enforced secutiry processes the PPAs are very dangerous.
[1] https://wiki.ubuntu.com/JohnVivirito https://wiki.ubuntu.com/JohnVivirito
[2] https://www.dignitymemorial.com/obituaries/apex-nc/john-vivirito-5422868 https://www.dignitymemorial.com/obituaries/apex-nc/john-vivi...
- hda111 4y agoThanks for letting us know. Will use the snap then.
- cjwatson44 4y agoThanks for the links, which do seem to check out. I've marked John's Launchpad account as "deceased", so it's still visible for archival purposes but even if somebody gains control of his former email address it's no longer possible for them to make any use of his Launchpad account using it.