Launchpad itself

Do launchpad admins spoof user identities?

Asked by Frans Gifford

I got an email claiming my user account had added a new admininstrator to a user group I own (I hadn't), and then another saying a launchpad administrator had removed it again.

Was my account compromised or are launchpad admins in the habit of spoofing user id's to mess with people's permissions?

Everything I publish on launchpad is Free Software, so if you don't have 30 seconds available to contact me, or the other group administrators with a membership request, I'd rather you take a copy of the code and fork-off rather than encouraging me to move over to git(orious|hub).

Question information

Language:
English Edit question
Status:
Solved
For:
Launchpad itself Edit question
Assignee:
No assignee Edit question
Solved by:
William Grant
Solved:
Last query:
Last reply:
Revision history for this message
Curtis Hovey (sinzui) said : 		#1

Launchpad Admins cannot pretend to be other users, which is why they cannot even deactivate your account (only the owner of the email address can login and accept account changes). If someone had modified your credentials to do, so you would have received and email stating your credentials were modified and asked you to contact us if you did not do so.

Launchpad admins can remove any user from a team. They can also add one (and possibly to the wrong team if they typed the wrong Launchpad-Ids), but that notification will state who added the user. Which user was supposedly made an admin of which team?

Revision history for this message
Curtis Hovey (sinzui) said : 		#2

Was this ~linaro-android-bot-maintainers which is the only team you admin, thus the only team you have power to add a member to?

Revision history for this message
Frans Gifford (fgiff) said : 		#3

Correct, and the group added/removed was linaro-sysadmins, which seems reasonable enough, but the email I got makes it look like my account did this, which it didn't:

<most email headers removed>
From: Linaro Android Bot Maintainers <email address hidden>
Subject: linaro-sysadmins joined linaro-android-bot-maintainers
Message-Id: <email address hidden>
Date: Mon, 10 Sep 2012 21:08:06 -0000
Reply-To: Linaro Android Bot Maintainers <email address hidden>
Sender: <email address hidden>
Errors-To: <email address hidden>
Precedence: bulk
X-Generated-By: Launchpad (canonical.com); Revision="15924";
 Instance="launchpad-lazr.conf"
X-Launchpad-Hash: 0a92139696c18e8303cbd0617ce35f43be11e174
X-Originating-IP: 217.69.89.162

Hello Frans Gifford,

Linaro System Administrators (linaro-sysadmins) has been added as a
member of Linaro Android Bot Maintainers (linaro-android-bot-
maintainers) by Frans Gifford (fgiff). Follow the link below for more
details.

    https://launchpad.net/~linaro-android-bot-maintainers/+member
/linaro-sysadmins

-- =

You received this email because you are an admin of the Linaro Android Bot =
Maintainers team.

Revision history for this message
Best William Grant (wgrant) said : 		#4

A Launchpad administrator changed the owner to ~linaro-sysadmins (I'm trying to find out why). Changing a team owner adds the old and new owners as admins automatically to avoid accidentally revoking anyone's access, and bug #1049487 means that the person credited with the admin change is the old owner, not the person actually performing the change.

Revision history for this message
Frans Gifford (fgiff) said : 		#5

Thanks William Grant, that solved my question.