4 ms·
How is this a win for you? Now you can blindly trust any github account now that they are 2fa to update their dependencies? That assumption doesn't make sense
by ipaddr 4y ago
How is this a win for you? Now you can blindly trust any github account now that they are 2fa to update their dependencies? That assumption doesn't make sense.
First the dependencies don't have to live on github or they could have been added by a non 2fa before this change
This is going to lock many out causing fewer packages to be updated meaning things are less trustworthy on github
People who use 2fa are not related to the same group who updates their dependencies
- deadbunny 4y agoHow is enforced 2FA going to "lock people out" of coding/updating packages?
- gamacodre 4y ago> People who use 2fa are not related to the same group who updates their dependencies This does raise the question though - should they be related? If so, why? If not, why not? From TFA, it seems github believes that a positive correlation there is worth pursuing and they offer reasons, though I have no idea how their corporate-blog-speak relates to their actual motives here.