4 ms·

The problem here is that it uses twofactorauth.org I submitted two PRs for sites that have 2FA that they didn’t have. One they argued about whether it’s a big

The problem here is that it uses twofactorauth.org I submitted two PRs for sites that have 2FA that they didn’t have. One they argued about whether it’s a big enough site to include (a commercial vps/server hosting company across ~5 countries) and never approved, the other they complained that the site doesn’t document it well enough so it must not exist (despite me using it). I gave up when they then got a bad reply from the company in question (saying they only support sms) and changed my PR despite me telling them it’s wrong (because customer service reps never get anything wrong?)

conorgil145 8y ago
That is frustrating. I have been contributing to the twofactorauth.org project, but I am still new to the community there. It is a really great resource of information with over 1,000 sites as of today. I am not aware of any other data sources that could provide similar information, but if you know of any, please do share! 2FA Notifier uses twofactorauth.org as a data feed, but does not rely on that data alone. I have made updates to the data already to help it work better for the use-case that 2FA Notifier is trying to solve. I am looking to create a community around the support of data for 2FA Notifier. We would still use the twofactorauth.org data as a main source and contribute changes back to that project. However, I can see 2FA Notifier having a different set of criteria and processes so that we could move more quickly to get the data into production so that it is useful for users of 2FA Notifier. Will you contribute data to the 2FA Notifier project? I can reach out to you offline if you're interested. I'd love to chat!
- stephenr 8y ago
  > Will you contribute data to the 2FA Notifier project? Given that's its a chrome extension, and I neither use Chrome or have it installed, that seems unlikely. You're free to merge my PR's (linked below in the reply to @davis) into your data set, but honestly I'd say at this point unless something changes they are a dubious choice of data (see further response to @davis below)
  - conorgil145 8y ago
    Gotcha. If you happen to use Firefox, I published the extension to the FF store yesterday too [1]. I will definitely take a look at your PRs. I see that you linked them below. I plan to review all of the outstanding PRs in the twofactorauth.org project to see if there are good data cleanup/improvements that I can take advantage of too. [1] https://addons.mozilla.org/en-US/firefox/addon/2fa-notifier/ https://addons.mozilla.org/en-US/firefox/addon/2fa-notifier/
    - stephenr 8y ago
      Sorry - Safari here. If you get to the point of a Safari version, I'd definitely try it out.
      - conorgil145 8y ago
        Gotcha. It will likely be...a while before I get around to writing a Safari extension, but I am certainly open to it! I honestly don't know the first thing about creating an extension for Safari. I wish they would just get on board and support the WebExtension standard #wishfulthinking
carterehsmith 8y ago
"they argued about whether it’s a big enough site to include" Wow. That sounds ridiculous. But if you try and track that site ... From https://twofactorauth.org/ https://twofactorauth.org/ "Made with tea by Josh Davis..." Then you follow this "Josh Davis" link to https://joshldavis.com/ https://joshldavis.com/ ... and you find this: " Splootysplotty: Open Source Alternative to Lewis Carroll’s Jabberwocky" " 'Twas haplex and kuffle problem. Projects Dalo and Jotts voluck. It's not folazy as Lablem, But merely fosts toontruck. " ...interesting.
- davis 8y ago
  Haha. That's a satirical article I created to poke fun at open source naming schemes. I buried the lede on that article (which is confusing in retrospect).
- stephenr 8y ago
  > Wow. That sounds ridiculous. Tell me about it. They literally just had to click "Merge PR", but instead chose to go looking at the sites rank on Alexa. When I suggested that they should codify their "only top 200K on Alexa" guideline, I got zero response, predictably.
davis 8y ago
Hey Stephen. I created twofactorauth.org but am no longer the maintainer but if you send me links to the pull requests, I'll take a look.
- stephenr 8y ago
  Hey, the two PR's are here: https://github.com/2factorauth/twofactorauth/pulls?utf8=&q=is%3Apr+author%3Astephenreay+ https://github.com/2factorauth/twofactorauth/pulls?utf8=&q=i... As mentioned, one has been merged, but with incorrect information. The company in question (VentraIP) has actually got a better document about this now (https://ventraip.com.au/faq/article/two-factor-authentication-faq-vipcontrol/ https://ventraip.com.au/faq/article/two-factor-authenticatio...), but I'm honestly beyond done with the current maintainers of that repo so I'm not willing to add further info to the PRs.
- stephenr 8y ago
  Hey again, so I got curious about this "Alexa ranking" requirement - and it's fucking crazy bananas at this point. The current maintainers are actively removing data that doesn't meet the "Alexa 200K" "requirement", and other PRs have been closed as "not in Alexa 100K". https://github.com/2factorauth/twofactorauth/search?q=alexa&type=Issues https://github.com/2factorauth/twofactorauth/search?q=alexa&... If this were a project I'd started and saw the new maintainers doing what they are, I'd be livid. I cannot fathom the scenario where it makes sense to remove correct, useful information like this.
  - scrollaway 8y ago
    Given how popular this became, it's starting to sound like 2factorauth shouldn't be a Github project at all. A semantic type wiki sounds more appropriate. Seen this sort of stuff before. I'm betting that the maintainers are just overwhelmed with PRs for something that is essentially a side project for everyone involved. The solution to this sort of thing is to reduce maintenance burden.
    - stephenr 8y ago
swrobel 8y ago
+1 their maintainers have been horrible to deal with in my experience
philliphaydon 8y ago
I registered 2factor.io a few years ago to build a chrome / FF extension to do what this site does and wanted to put it on GH for the community to maintain cos i knew there were sites I didn’t know exist. Just ended up doing other things instead :( I think the domain has lapsed now.
- stephenr 8y ago
  A fork of this site/data has crossed my mind. The extra data being removed/refused is all there, it just has to be mereged, or the delete reverted.

conorgil145 8y ago

That is frustrating. I have been contributing to the twofactorauth.org project, but I am still new to the community there. It is a really great resource of information with over 1,000 sites as of today. I am not aware of any other data sources that could provide similar information, but if you know of any, please do share! 2FA Notifier uses twofactorauth.org as a data feed, but does not rely on that data alone. I have made updates to the data already to help it work better for the use-case that 2FA Notifier is trying to solve. I am looking to create a community around the support of data for 2FA Notifier. We would still use the twofactorauth.org data as a main source and contribute changes back to that project. However, I can see 2FA Notifier having a different set of criteria and processes so that we could move more quickly to get the data into production so that it is useful for users of 2FA Notifier. Will you contribute data to the 2FA Notifier project? I can reach out to you offline if you're interested. I'd love to chat!

stephenr 8y ago
> Will you contribute data to the 2FA Notifier project? Given that's its a chrome extension, and I neither use Chrome or have it installed, that seems unlikely. You're free to merge my PR's (linked below in the reply to @davis) into your data set, but honestly I'd say at this point unless something changes they are a dubious choice of data (see further response to @davis below)
- conorgil145 8y ago
  Gotcha. If you happen to use Firefox, I published the extension to the FF store yesterday too [1]. I will definitely take a look at your PRs. I see that you linked them below. I plan to review all of the outstanding PRs in the twofactorauth.org project to see if there are good data cleanup/improvements that I can take advantage of too. [1] https://addons.mozilla.org/en-US/firefox/addon/2fa-notifier/ https://addons.mozilla.org/en-US/firefox/addon/2fa-notifier/
  - stephenr 8y ago
    Sorry - Safari here. If you get to the point of a Safari version, I'd definitely try it out.
    - conorgil145 8y ago
      Gotcha. It will likely be...a while before I get around to writing a Safari extension, but I am certainly open to it! I honestly don't know the first thing about creating an extension for Safari. I wish they would just get on board and support the WebExtension standard #wishfulthinking

carterehsmith 8y ago

"they argued about whether it’s a big enough site to include" Wow. That sounds ridiculous. But if you try and track that site ... From https://twofactorauth.org/ https://twofactorauth.org/ "Made with tea by Josh Davis..." Then you follow this "Josh Davis" link to https://joshldavis.com/ https://joshldavis.com/ ... and you find this: " Splootysplotty: Open Source Alternative to Lewis Carroll’s Jabberwocky" " 'Twas haplex and kuffle problem. Projects Dalo and Jotts voluck. It's not folazy as Lablem, But merely fosts toontruck. " ...interesting.

davis 8y ago
Haha. That's a satirical article I created to poke fun at open source naming schemes. I buried the lede on that article (which is confusing in retrospect).
stephenr 8y ago
> Wow. That sounds ridiculous. Tell me about it. They literally just had to click "Merge PR", but instead chose to go looking at the sites rank on Alexa. When I suggested that they should codify their "only top 200K on Alexa" guideline, I got zero response, predictably.

davis 8y ago

Hey Stephen. I created twofactorauth.org but am no longer the maintainer but if you send me links to the pull requests, I'll take a look.

stephenr 8y ago
Hey, the two PR's are here: https://github.com/2factorauth/twofactorauth/pulls?utf8=&q=is%3Apr+author%3Astephenreay+ https://github.com/2factorauth/twofactorauth/pulls?utf8=&q=i... As mentioned, one has been merged, but with incorrect information. The company in question (VentraIP) has actually got a better document about this now (https://ventraip.com.au/faq/article/two-factor-authentication-faq-vipcontrol/ https://ventraip.com.au/faq/article/two-factor-authenticatio...), but I'm honestly beyond done with the current maintainers of that repo so I'm not willing to add further info to the PRs.
stephenr 8y ago
Hey again, so I got curious about this "Alexa ranking" requirement - and it's fucking crazy bananas at this point. The current maintainers are actively removing data that doesn't meet the "Alexa 200K" "requirement", and other PRs have been closed as "not in Alexa 100K". https://github.com/2factorauth/twofactorauth/search?q=alexa&type=Issues https://github.com/2factorauth/twofactorauth/search?q=alexa&... If this were a project I'd started and saw the new maintainers doing what they are, I'd be livid. I cannot fathom the scenario where it makes sense to remove correct, useful information like this.
- scrollaway 8y ago
  Given how popular this became, it's starting to sound like 2factorauth shouldn't be a Github project at all. A semantic type wiki sounds more appropriate. Seen this sort of stuff before. I'm betting that the maintainers are just overwhelmed with PRs for something that is essentially a side project for everyone involved. The solution to this sort of thing is to reduce maintenance burden.
  - stephenr 8y ago

swrobel 8y ago

+1 their maintainers have been horrible to deal with in my experience

philliphaydon 8y ago

I registered 2factor.io a few years ago to build a chrome / FF extension to do what this site does and wanted to put it on GH for the community to maintain cos i knew there were sites I didn’t know exist. Just ended up doing other things instead :( I think the domain has lapsed now.

stephenr 8y ago
A fork of this site/data has crossed my mind. The extra data being removed/refused is all there, it just has to be mereged, or the delete reverted.