lucene-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Uwe Schindler" <...@thetaphi.de>
Subject RE: issues.apache.org compromised: please update your passwords
Date Wed, 14 Apr 2010 06:44:10 GMT
> > > Hi Grant,
> > >
> > >  It is that user, who is assigned to the very early JIRA issues,
> e.g.:
> > >  https://issues.apache.org/jira/browse/LUCENE-1
> > >
> > >  I changed the password of this user in response to that email (for
> security), but I think we should simply let infra remove it. The
> problem is, almost anybody can instruct JIRA to reset the password and
> let JIRA send it again to the "email" which is the public java-dev
> list. And then it is public again.
> >
> > If the user is still needed (for whatever reason) maybe the user can
> > be disabled, or maybe they can be removed from the list of users who
> > have update access to the JIRA.
> >
> > But so long as the user is not an administrator, then it's no
> > different really from any other account that can be created by Joe
> > Public.
> 
> Yes, that account has no special access. If someone wants to unassign
> the 319
> issues this user is the 'assignee' of, then the account can be deleted:
> 
> https://issues.apache.org/jira/secure/IssueNavigator.jspa?sorter/order=
> ASC&sorter/field=priority&assignee=java-
> dev%40lucene.apache.org&reset=true&assigneeSelect=specificuser&mode=hid
> e
> 

I disabled the account by assigning a dummy eMail and gave it a random password.

I was not able to unassign the issues, as most issues were "Closed", where no modifications
can be done anymore. Reopening and changing assignment and reverting to closed is too risky,
as after reopening you don’t know anymore which issues you need to revert to closed after
unassignment...

Uwe


---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: java-dev-help@lucene.apache.org


Mime
View raw message