11–18 of 18 posts
How reasonable is github's account recovery process? I imagine it won't be long until a high impact maintainer loses their phone and doesn't have any recovery codes saved.
https://github.blog/changelog/2022-10-25-improved-account-re...
Earlier quoted context omitted.
> A package is marked as a high impact package when they have more than 1 million weekly downloads or have more than 500 dependents.
For such a short blog that I actually clicked on, this is embarrassing. Not reading the article is probably on par with not getting past the 2nd sentence. Am intrigued why this is npm only when they already seem to have some of the strictest publishing requirements around, 2fa or one time passwords are mandatory now I thought?
It's not a policy for github accounts, but I can understand the confusion given it is posted on the github blog - the npm blog has been merged into it.
That's also why the policy is npm only, github don't own other registries to set policy (though I'll note pypi at least is setting a similar policy)
It feels odd that Github is deciding this policy. A high-impact package on another forge wouldn't be subject to the same constraint.
At least they gave away security keys to try and spin it in a positive light: https://pypi.org/security-key-giveaway/ (well sort of, if you already have 2FA on, no key for you valued maintainer)
Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let you be really really sure it was the maintainer who did it? Realistically, github wants your phone number for reasons.
https://docs.npmjs.com/configuring-two-factor-authentication
Github allowed node-ipc maintainer to stay after he intentionally distributed malware. This move is just security theater in that light. What will 2FA do? Let you be really really sure it was the maintainer who did it? Realistically, github wants your phone number for reasons.
pypi.org (the Python Package Index) did the same thing in July, with some amount of criticism from the community: https://news.ycombinator.com/item?id=32037562 At least they gave away security keys to try and spin it in a positive light: https://pypi.org/security-key-giveaway/ (well sort of, if you already have 2FA on, no key for you valued maintainer)
I get the general "You not trusting your dependencies is your problem", but at the same time it's really only a minor annoyance.
It feels odd that Github is deciding this policy. A high-impact package on another forge wouldn't be subject to the same constraint.
GitHub owns and operates npm, so they certainly have the authority and ability to enforce it. I doubt requiring the same of packages hosted elsewhere is feasible.