4 ms·
So, not only are developers working on open source projects in their free time expected to maintain and provide support for free, they're now also expected to p
by Dayshine 6y ago
So, not only are developers working on open source projects in their free time expected to maintain and provide support for free, they're now also expected to pay in order to provide baseline security for their users?
If NPM or any other package repository introduced this, do you think maintainers of commonly used open source projects wouldn't feel obliged to pay up? Generally immediately after a traumatic event such as having their phone stolen.
Even if you never plan to update your package, you can't fix a security vulnerability without spending money.
- amazingman 6y agoDon’t lose your recovery codes and you should be fine, right?
- Dayshine 6y agoYeah, sure, set up a recovery process I don't need anywhere else in life and hope I never mess that up. Then have several thousand people (or far more if I'm lucky) rely on it, I'm sure that'll go well! I don't need recovery codes for anything in my professional nor personal life outside open source programming.
- Volundr 6y agoI don't think that's true though. I have recovery codes for my MFA for Azure, Google, Fastmail, and many others. I'm wouldn't count on being able to convince support to let me into any of these accounts if I lost my MFA and my backups. They might, but as the article mentioned it'd be hard to do in a way that doesn't defeat the purpose of MFA in the first place.
- amazingman 6y agoYou don’t have any other MFAs you need to manage in your digital life? That seems ... odd. It seems like you’re deciding to make an issue of, well, how MFA is _supposed_ to work.
- Dayshine 6y agoI have other MFAs, but they all have real-world recovery routes.