6 ms·

I feel like there are still too many hands in this particular cookie jar. MFA or no. On average, how many other organizations & human developers are somehow inv

I feel like there are still too many hands in this particular cookie jar. MFA or no. On average, how many other organizations & human developers are somehow involved in the dependency graph of a modern node.js project? I fail to see how MFA resolves the fundamental trust equation. Bad code is bad code, doesn't matter what the authentication system says about the actor's identity. I can create 2FA-enabled GH accounts all day named after JK Rowling characters without anyone at GH sending me a security nastygram or banning me for identity violations. Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. To be clear: I strongly disagree with any notion that GitHub should require photo ID to open an account. But, perhaps a "verified user" option (extending to "verified org" if all users are compliant) might provide another path.

TAForObvReasons 4y ago
OpenSSF, which includes Google and Microsoft, has discussed real name verification requirements. That's definitely where the big money is pushing
yjftsjthsd-h 4y ago
> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. As a nice bonus, this is a great way to stop people from contributing to projects for free out of the goodness of their hearts. /s
- Aeolun 4y ago
  How so? I’m already contributing with an account that is astoundingly easy to resolve to my real name. Adding government issued ID to that equation would change nothing for me. I guess it might be problematic if you want to contribute to politically controversial stuff.
  - teddyh 4y ago
    This is the most literal version of “I have nothing to hide, so therefore neither does anyone else” I have seen in recent times.
    - Aeolun 4y ago
      Nowhere do I say that nobody has anything to hide. Hell, I have stuff to hide, but none of that is connected to my public Github account. I was simply challenging the assertation that contributions would dry up when required to identify yourself, and I don’t think that’s true. I can’t be the only one that has only a mildly pseudonymous account.
  - zorpner 4y ago
    Is the assertion here that people who have a troublesome family history, or a stalker, or debt, or who wish to change their lives, or are from a place where their social or racial group might be persecuted, or who simply wish to write code separately from their day-to-day, should not be allowed to do so?
  - yjftsjthsd-h 4y ago
    It's nice that you Have Nothing to Hide, but not everyone wants to - or can - live like that. It's not just politically sensitive stuff (though that's a good reason); some of us like having privacy, and there's no reason that we should have to give up our pseudonymity or anonymity in order to share our code with the world.
    - tomnipotent 4y ago
      An individuals anonymity does not take precedence over a professional supply chain that requires transparency, especially in the context of Top-N packages. The Linux kernel is one such example that does not accept anonymous contributions.
      - dividedbyzero 4y ago
        > An individuals anonymity does not take precedence over a professional supply chain that requires transparency An individual may choose to not be an unpaid yet completely exposed part of such a professional supply chain, to be pressured and shamed in real life by whoever sees fit to do so. There should be such a supply chain, by all means, run by companies for companies with paid or otherwise fairly compensated contributors, vetted and named and identified and badged and protected by corporate legal, but I'm quite sure forcing the wider open source community into that mold would destroy most of what makes it so successful.
joekrill 4y ago
> I feel like there are still too many hands in this particular cookie jar. MFA or no. On average, how many other organizations & human developers are somehow involved in the dependency graph of a modern node.js project? What does that really matter, though? You could ask the same of _any_ modern application, NodeJS or otherwise: "On average, how many other organizations & human developers are somehow involved in the dependency graph of a modern application?". Look at your web browser alone. You have an open source rendering engine. The JavaScript engine. The underlying libraries used to handle things like SSL, TCP/IP, DNS lookups. It runs on an OS that likely has layers and layers of open source code. Which runs on hardware from various manufacturers with firmware written by many people spread across many organizations.
- Santosh83 4y ago
  The difference is people have become conditioned to trust corporations and organisations, so the software/hardware you mentioned have people or addresses who must answer if they get compromised. Whether they answer is a different thing, and whether this is a good model for everyone is another question. NPM packages on the other hand are dependent on random individuals for integrity and society doesn't trust individuals as much as registered entities, especially profit making ones.
rektide 4y ago
First, yes: there absolutely should be better tools for authors to sign & authenticate their own tools, with heightened cryptographic authentication means. Projects like sigstore get this (and wish to respect privacy![1]). But what's spoken of here is a deep imposition, and doesn't empower authors, but demands of them. > I fail to see how MFA resolves the fundamental trust equation Nothing ever will. Your desire for a cathedral is incompatible fundamentally & at every level with the bazaar. Trying to drive open-source society towards an industrialized security state for the convenience of your probably non-contributing, not-paying industrialized software production needs is vastly unfair. If you have needs, you need to take your own responsibility. If you have risks, you need to pay to hedge them. Go hire NodeSource to help you get the Certified Modules you can trust. Go sign contracts with authors to get the support you need. Heck, just checkin your package-lock.json and go see what you are downloading: npm is immutable! You could literally do anything to help safeguard yourself, but you ask for absolute protection, something that even the biggest best corporations can never truly promise. Trying to prevent even one reasonably placed malicious employee from causing disruption is a near impossible task. But you ask for a fundamental safety. This is laughable. None of us can expect nor deserve that. > Until GitHub requires government-issued photo ID in addition to MFA What a vile & fascist imposition this would be! Woe be unto us if industrialzied software so hotly presses for it's own security that it embraces such ludicrous & perverse a cowardice as this. Relying on github as your source of trust, and pressuring them to pressure the world into turning over core information, is just as antithetical as I can image to the open source behavior & society that has advanced us so far. What a terrible thing to wish for! Egads, gross. [1] https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://news.ycombinator.com/item?id=31533997 https://news.ycombinator.com/item?id=31533997
- strawhatguy 4y ago
  Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it pulls in, are your problem, no one else's. Code appropriately.
  - 4y ago
doliveira 4y ago
Do we need to go this far? Why not just require a DNS which is what all of web security is centered around anyway? Most "serious" packages in Maven Central do have a dedicated DNS, for instance, even though there's the fallback of using io.github.username as the namespace. I feel like providing a namespace and starting to incentivize for it to correspond to a real DNS would be a good start.
grenran 4y ago
my69thaccount 4y ago
> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. To be clear: I strongly disagree with any notion that GitHub should require photo ID to open an account. But, perhaps a "verified user" option (extending to "verified org" if all users are compliant) might provide another path. this is absolutely dystopian. Please don't give microsoft any more ideas.
Gordonjcp 4y ago
Any government in particular? What about software developers that don't drive?
arinlen 4y ago
> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. This suggestion sounds like a way to create new and far bigger problems without doing anything to solve the original problem. Let's keep the problem in perspective, shall we? You want to freely access code contributed by someone over the internet, and you want to trust it's provenance. This does not change at all if you throw government-issued IDs into the mix, nor does this affect any of the attack vectors exploited by bad actors.

TAForObvReasons 4y ago

OpenSSF, which includes Google and Microsoft, has discussed real name verification requirements. That's definitely where the big money is pushing

yjftsjthsd-h 4y ago

> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. As a nice bonus, this is a great way to stop people from contributing to projects for free out of the goodness of their hearts. /s

Aeolun 4y ago
How so? I’m already contributing with an account that is astoundingly easy to resolve to my real name. Adding government issued ID to that equation would change nothing for me. I guess it might be problematic if you want to contribute to politically controversial stuff.
- teddyh 4y ago
  This is the most literal version of “I have nothing to hide, so therefore neither does anyone else” I have seen in recent times.
  - Aeolun 4y ago
    Nowhere do I say that nobody has anything to hide. Hell, I have stuff to hide, but none of that is connected to my public Github account. I was simply challenging the assertation that contributions would dry up when required to identify yourself, and I don’t think that’s true. I can’t be the only one that has only a mildly pseudonymous account.
- zorpner 4y ago
  Is the assertion here that people who have a troublesome family history, or a stalker, or debt, or who wish to change their lives, or are from a place where their social or racial group might be persecuted, or who simply wish to write code separately from their day-to-day, should not be allowed to do so?
- yjftsjthsd-h 4y ago
  It's nice that you Have Nothing to Hide, but not everyone wants to - or can - live like that. It's not just politically sensitive stuff (though that's a good reason); some of us like having privacy, and there's no reason that we should have to give up our pseudonymity or anonymity in order to share our code with the world.
  - tomnipotent 4y ago
    An individuals anonymity does not take precedence over a professional supply chain that requires transparency, especially in the context of Top-N packages. The Linux kernel is one such example that does not accept anonymous contributions.
    - dividedbyzero 4y ago
      > An individuals anonymity does not take precedence over a professional supply chain that requires transparency An individual may choose to not be an unpaid yet completely exposed part of such a professional supply chain, to be pressured and shamed in real life by whoever sees fit to do so. There should be such a supply chain, by all means, run by companies for companies with paid or otherwise fairly compensated contributors, vetted and named and identified and badged and protected by corporate legal, but I'm quite sure forcing the wider open source community into that mold would destroy most of what makes it so successful.

joekrill 4y ago

> I feel like there are still too many hands in this particular cookie jar. MFA or no. On average, how many other organizations & human developers are somehow involved in the dependency graph of a modern node.js project? What does that really matter, though? You could ask the same of _any_ modern application, NodeJS or otherwise: "On average, how many other organizations & human developers are somehow involved in the dependency graph of a modern application?". Look at your web browser alone. You have an open source rendering engine. The JavaScript engine. The underlying libraries used to handle things like SSL, TCP/IP, DNS lookups. It runs on an OS that likely has layers and layers of open source code. Which runs on hardware from various manufacturers with firmware written by many people spread across many organizations.

Santosh83 4y ago
The difference is people have become conditioned to trust corporations and organisations, so the software/hardware you mentioned have people or addresses who must answer if they get compromised. Whether they answer is a different thing, and whether this is a good model for everyone is another question. NPM packages on the other hand are dependent on random individuals for integrity and society doesn't trust individuals as much as registered entities, especially profit making ones.

rektide 4y ago

First, yes: there absolutely should be better tools for authors to sign & authenticate their own tools, with heightened cryptographic authentication means. Projects like sigstore get this (and wish to respect privacy![1]). But what's spoken of here is a deep imposition, and doesn't empower authors, but demands of them. > I fail to see how MFA resolves the fundamental trust equation Nothing ever will. Your desire for a cathedral is incompatible fundamentally & at every level with the bazaar. Trying to drive open-source society towards an industrialized security state for the convenience of your probably non-contributing, not-paying industrialized software production needs is vastly unfair. If you have needs, you need to take your own responsibility. If you have risks, you need to pay to hedge them. Go hire NodeSource to help you get the Certified Modules you can trust. Go sign contracts with authors to get the support you need. Heck, just checkin your package-lock.json and go see what you are downloading: npm is immutable! You could literally do anything to help safeguard yourself, but you ask for absolute protection, something that even the biggest best corporations can never truly promise. Trying to prevent even one reasonably placed malicious employee from causing disruption is a near impossible task. But you ask for a fundamental safety. This is laughable. None of us can expect nor deserve that. > Until GitHub requires government-issued photo ID in addition to MFA What a vile & fascist imposition this would be! Woe be unto us if industrialzied software so hotly presses for it's own security that it embraces such ludicrous & perverse a cowardice as this. Relying on github as your source of trust, and pressuring them to pressure the world into turning over core information, is just as antithetical as I can image to the open source behavior & society that has advanced us so far. What a terrible thing to wish for! Egads, gross. [1] https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 https://news.ycombinator.com/item?id=31533997 https://news.ycombinator.com/item?id=31533997

strawhatguy 4y ago
Thank you for writing this; far too much entitlement, far too much blame shifting in the parent comment. Ultimately problems with your code, including deps it pulls in, are your problem, no one else's. Code appropriately.
- 4y ago

doliveira 4y ago

Do we need to go this far? Why not just require a DNS which is what all of web security is centered around anyway? Most "serious" packages in Maven Central do have a dedicated DNS, for instance, even though there's the fallback of using io.github.username as the namespace. I feel like providing a namespace and starting to incentivize for it to correspond to a real DNS would be a good start.

grenran 4y ago

my69thaccount 4y ago

> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. To be clear: I strongly disagree with any notion that GitHub should require photo ID to open an account. But, perhaps a "verified user" option (extending to "verified org" if all users are compliant) might provide another path. this is absolutely dystopian. Please don't give microsoft any more ideas.

Gordonjcp 4y ago

Any government in particular? What about software developers that don't drive?

arinlen 4y ago

> Until GitHub requires government-issued photo ID in addition to MFA, I don't think you are going to properly discourage bad or criminal actors. This suggestion sounds like a way to create new and far bigger problems without doing anything to solve the original problem. Let's keep the problem in perspective, shall we? You want to freely access code contributed by someone over the internet, and you want to trust it's provenance. This does not change at all if you throw government-issued IDs into the mix, nor does this affect any of the attack vectors exploited by bad actors.