GitHub: High-impact package maintainers now require 2FA
1–10 of 18 posts
Re: GitHub: High-impact package maintainers now require 2FA
#2*npm package maintainers
Is high impact a defined term here?
Re: GitHub: High-impact package maintainers now require 2FA
#3*npm package maintainers Is high impact a defined term here?
> A package is marked as a high impact package when they have more than 1 million weekly downloads or have more than 500 dependents.
Re: GitHub: High-impact package maintainers now require 2FA
#4Is this for Go modules and python and PHP and C libraries?
Re: GitHub: High-impact package maintainers now require 2FA
#5It feels odd that Github is deciding this policy.
A high-impact package on another forge wouldn't be subject to the same constraint.
Re: GitHub: High-impact package maintainers now require 2FA
#6It feels odd that Github is deciding this policy. A high-impact package on another forge wouldn't be subject to the same constraint.
GitHub owns and operates npm, so they certainly have the authority and ability to enforce it. I doubt requiring the same of packages hosted elsewhere is feasible.
Re: GitHub: High-impact package maintainers now require 2FA
#7*npm package maintainers Is high impact a defined term here?
> A package is marked as a high impact package when they have more than 1 million weekly downloads or have more than 500 dependents.
For such a short blog that I actually clicked on, this is embarrassing.
Not reading the article is probably on par with not getting past the 2nd sentence.
Am intrigued why this is npm only when they already seem to have some of the strictest publishing requirements around, 2fa or one time passwords are mandatory now I thought?
Re: GitHub: High-impact package maintainers now require 2FA
#8How reasonable is github's account recovery process? I imagine it won't be long until a high impact maintainer loses their phone and doesn't have any recovery codes saved.
Re: GitHub: High-impact package maintainers now require 2FA
#9Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let you be really really sure it was the maintainer who did it? Realistically, github wants your phone number for reasons.
Re: GitHub: High-impact package maintainers now require 2FA
#10Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let you be really really sure it was the maintainer who did it? Realistically, github wants your phone number for reasons.
This is not a security measure against real maintainer going mental and breaking everything. I am sure you can understand that different problems need different measures.