<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi,<div><br></div><div>It's me who have claimed the team for prevent this to happen.</div><div><br></div><div>Administrators of Pkg-javascript please reclaimed the launchpad team.</div><div><br></div><div><br></div><div>Freely,<br>Valentin OVD <br><br><br><div>> From: dkg@fifthhorseman.net<br>> To: feedback@launchpad.net; pkg-javascript-devel@lists.alioth.debian.org<br>> Date: Fri, 23 Jan 2015 16:34:23 -0500<br>> Subject: Re: [Pkg-javascript-devel] Launchpad: Claim existing team<br>> <br>> On Fri 2015-01-23 15:17:19 -0500, Launchpad wrote:<br>> <br>> > vovd (vovd) tried to claim the Launchpad<br>> > team named Debian Javascript Maintainers (pkg-javascript-devel-lists) (which is<br>> > associated with pkg-javascript-devel@lists.alioth.debian.org).<br>> ><br>> > To finish claiming that team, making vovd (vovd)<br>> > its owner, just follow the link below.<br>> ><br>> > https://launchpad.net/token/s82RbqGNq9Zn29808FhD<br>> <br>> This is a troubling situation. Launchpad sends this token, but the<br>> owner is a publicly-archived mailing list.<br>> <br>> All an attacker needs to do is submit a request to claim the team, then<br>> read the archive to find the token and claim the team.<br>> <br>> Should launchpad have a warning against assigning group ownership to a<br>> public mailing list?<br>> <br>> fwiw, i've been on the Debian Javascript Maintainers mailing list for<br>> over a year and i've never heard of anyone named vovd.<br>> <br>> --dkg<br>> <br>> _______________________________________________<br>> Pkg-javascript-devel mailing list<br>> Pkg-javascript-devel@lists.alioth.debian.org<br>> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel<br></div></div> </div></body>
</html>