4 ms·

> At GitHub, we believe that our unique position as the home for all developers means that we have both an opportunity and a responsibility to raise the bar for

> At GitHub, we believe that our unique position as the home for all developers means that we have both an opportunity and a responsibility to raise the bar for security across the software development ecosystem. The fact that GitHub assumes to be in this position is alarming. Combined with this enforcement which I do not appreciate, I’m reconsidering my investment and will actively start migrating off of GitHub.

kmlx 4y ago
> The fact that GitHub assumes to be in this position is alarming. it's kind of true, isn't it (for certain programming languages)?
staticassertion 4y ago
- natly 4y ago
  A nicer tone wouldn't hurt.
  - staticassertion 4y ago
    I don't see what's mean about what I said, I'm quite excited to see this change already having positive impact.
    - tarboreus 4y ago
      Going to second that your tone is a bit on the snooty side. I'll go ahead and join OP and "self-select" my way out of the all-encompassing developer community that GitHub represents, leaving you pro coders to it. Enjoy the walls around your garden.
      - staticassertion 4y ago
        Excellent stuff :)
        pc86 4y ago
        I have a hard time believing that you're unintentionally being an asshole in this thread, it's so on the nose that I have to believe it's on purpose.
        staticassertion 4y ago
        I'm just celebrating a successful deployment of something I've wanted for a long time. It's already being effective and it's not even rolled out yet.
        natly 4y ago
        You know full well that your tone from the perspective of the person you responded to is very harsh, please try to be more respectful.
        staticassertion 4y ago
        I wouldn't classify it as very harsh at all.
- zmgsabst 4y ago
  > so if people like you, who don't care about that, select yourselves out - perfect! This is an ad hominem. You don’t know anything about security measures they do or do not take — just that they don’t appreciate a vendor mandating their security policy from a position of presumed authority. That kind of bad faith comment isn’t constructive.
  - Arnavion 4y ago
    >just that they don’t appreciate a vendor mandating their security policy from a position of presumed authority. The account is with the vendor in question. The vendor is literally the only entity in a position of authority.
    - zmgsabst 4y ago
      Can you name another example of a major vendor demanding policy from its customers?
      - akerl_ 4y ago
        https://antivirus.com/2021/11/25/google-is-making-2fa-mandatory-and-its-happening-before-2022/ https://antivirus.com/2021/11/25/google-is-making-2fa-mandat... https://techcrunch.com/2021/12/02/facebook-two-factor-mandatory/ https://techcrunch.com/2021/12/02/facebook-two-factor-mandat... https://www.wsj.com/articles/tech-companies-push-users-to-adopt-two-factor-authentication-11635807088 https://www.wsj.com/articles/tech-companies-push-users-to-ad... https://www.twilio.com/blog/mandatory-2fa-account-login https://www.twilio.com/blog/mandatory-2fa-account-login
- jacobsenscott 4y ago
  totp on gh doesn't "secure your dependencies" in any meaningful way though. For example npm and rubygems and dockerhub, and pretty much any other library packaging system don't pull code from gh, so the code on gh doesn't need to match the code in the library you are actually installing and running. git secures itself. You can't "sneak" malicious code into a library if you can log into a dev's gh account. All you can do is add commits. It would be an obvious commit and the dev wouldn't push it to their package host.
- ipaddr 4y ago
  How is this a win for you? Now you can blindly trust any github account now that they are 2fa to update their dependencies? That assumption doesn't make sense. First the dependencies don't have to live on github or they could have been added by a non 2fa before this change This is going to lock many out causing fewer packages to be updated meaning things are less trustworthy on github People who use 2fa are not related to the same group who updates their dependencies
  - deadbunny 4y ago
    How is enforced 2FA going to "lock people out" of coding/updating packages?
  - gamacodre 4y ago
    > People who use 2fa are not related to the same group who updates their dependencies This does raise the question though - should they be related? If so, why? If not, why not? From TFA, it seems github believes that a positive correlation there is worth pursuing and they offer reasons, though I have no idea how their corporate-blog-speak relates to their actual motives here.
JJAcedL 4y ago
I mean... they are the default home for most open source
LudwigNagasena 4y ago
I hate those paternalistic ethics. Your responsibility is not to get hacked. My responsibility is to make sure I don’t leak my credentials. Telling people how to live is not your responsibility.

kmlx 4y ago

> The fact that GitHub assumes to be in this position is alarming. it's kind of true, isn't it (for certain programming languages)?

staticassertion 4y ago

natly 4y ago
A nicer tone wouldn't hurt.
- staticassertion 4y ago
  I don't see what's mean about what I said, I'm quite excited to see this change already having positive impact.
  - tarboreus 4y ago
    Going to second that your tone is a bit on the snooty side. I'll go ahead and join OP and "self-select" my way out of the all-encompassing developer community that GitHub represents, leaving you pro coders to it. Enjoy the walls around your garden.
    - staticassertion 4y ago
      Excellent stuff :)
      - pc86 4y ago
        I have a hard time believing that you're unintentionally being an asshole in this thread, it's so on the nose that I have to believe it's on purpose.
        staticassertion 4y ago
        I'm just celebrating a successful deployment of something I've wanted for a long time. It's already being effective and it's not even rolled out yet.
        natly 4y ago
        You know full well that your tone from the perspective of the person you responded to is very harsh, please try to be more respectful.
        staticassertion 4y ago
        I wouldn't classify it as very harsh at all.
zmgsabst 4y ago
> so if people like you, who don't care about that, select yourselves out - perfect! This is an ad hominem. You don’t know anything about security measures they do or do not take — just that they don’t appreciate a vendor mandating their security policy from a position of presumed authority. That kind of bad faith comment isn’t constructive.
- Arnavion 4y ago
  >just that they don’t appreciate a vendor mandating their security policy from a position of presumed authority. The account is with the vendor in question. The vendor is literally the only entity in a position of authority.
  - zmgsabst 4y ago
    Can you name another example of a major vendor demanding policy from its customers?
    - akerl_ 4y ago
      https://antivirus.com/2021/11/25/google-is-making-2fa-mandatory-and-its-happening-before-2022/ https://antivirus.com/2021/11/25/google-is-making-2fa-mandat... https://techcrunch.com/2021/12/02/facebook-two-factor-mandatory/ https://techcrunch.com/2021/12/02/facebook-two-factor-mandat... https://www.wsj.com/articles/tech-companies-push-users-to-adopt-two-factor-authentication-11635807088 https://www.wsj.com/articles/tech-companies-push-users-to-ad... https://www.twilio.com/blog/mandatory-2fa-account-login https://www.twilio.com/blog/mandatory-2fa-account-login
jacobsenscott 4y ago
totp on gh doesn't "secure your dependencies" in any meaningful way though. For example npm and rubygems and dockerhub, and pretty much any other library packaging system don't pull code from gh, so the code on gh doesn't need to match the code in the library you are actually installing and running. git secures itself. You can't "sneak" malicious code into a library if you can log into a dev's gh account. All you can do is add commits. It would be an obvious commit and the dev wouldn't push it to their package host.
ipaddr 4y ago
How is this a win for you? Now you can blindly trust any github account now that they are 2fa to update their dependencies? That assumption doesn't make sense. First the dependencies don't have to live on github or they could have been added by a non 2fa before this change This is going to lock many out causing fewer packages to be updated meaning things are less trustworthy on github People who use 2fa are not related to the same group who updates their dependencies
- deadbunny 4y ago
  How is enforced 2FA going to "lock people out" of coding/updating packages?
- gamacodre 4y ago
  > People who use 2fa are not related to the same group who updates their dependencies This does raise the question though - should they be related? If so, why? If not, why not? From TFA, it seems github believes that a positive correlation there is worth pursuing and they offer reasons, though I have no idea how their corporate-blog-speak relates to their actual motives here.

JJAcedL 4y ago

I mean... they are the default home for most open source

LudwigNagasena 4y ago

I hate those paternalistic ethics. Your responsibility is not to get hacked. My responsibility is to make sure I don’t leak my credentials. Telling people how to live is not your responsibility.