4 ms·

This is laughable. First of all, it's the slippery slope fallacy. 2FA is not a burden and you can't get any reasonable person worked up because of it. The insi

This is laughable. First of all, it's the slippery slope fallacy. 2FA is not a burden and you can't get any reasonable person worked up because of it. The insinuation that this might lead to other sorts of control is pointless; this possibility has always existed. Second of all, package indexes have a responsibility to the programming community as a whole and as such I do expect them to make some reasonable demands. This is not infringing on open-source developers' freedom, since nobody forces them to release their code on an official package index. This post really reads like a storm in a teacup.

throwawaybutwhy 4y ago
Not a storm in a teacup. Being forced to accept unvetted electronic devices from a 'Foundation' instead of using TOTP rings a whole lot of alarm bells. * How do we know that these ain't fitted with GPS trackers? * Why are maintainers forced to give up their snail mail addresses? * How will the keys be re-issued? Who's going to pay for this? * Oh, and there's still the silly geo-fencing issue: 'Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, United Kingdom, and the United States'
- Tainnor 4y ago
  Nobody is forcing anyone to use particular devices. Those are optional. Only 2FA itself is mandatory.
- duskwuff 4y ago
  You are assuming that the contributors are required to use these specific devices. This is incorrect. PyPI is offering free U2F devices to a subset of the affected developers, but they are free to use their own U2F devices (or a TOTP client) instead. > Oh, and there's still the silly geo-fencing issue The list of countries makes this sound like an export control issue. It's a legal restriction, not a deliberate choice PyPI made.
  - throwawaybutwhy 4y ago
    Timeo Danaos et dona ferentes. All in all, bad optics and fishy offerings. TOTP is definitely OK.
echelon 4y ago
This last decade has played host to some of the most fascinating series of debates, an almost visceral push and pull, concerning individualism vs collectivism, distribution of control vs centralization of power. - COVID vaccine mandates - Cryptocurrency - Deplatforming - Abortion - Closed platforms beating open web - Monopolies controlling tech - One party governments gaining in power Strict control over package indices is one manifestation of this. Controlling a blast radius (safety) vs unlimited, unfettered publication (freedom). Power structures are everywhere.
- Tainnor 4y ago
  How anyone can get this worked up because of 2FA is simply beyond me. I guess some people just have to feel like rebels all the time.
  - cowtools 4y ago
    2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device. If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to.
    - eropple 4y ago
      > 2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device. TOTP-compliant services happily accept codes generated from non-mobile devices. 1Password even includes it (which is a unification of factors I don't personally trust, so I don't use it, but it's there if it fits your own threat model). They can also run on Android, etc. devices that literally-not-figuratively never touch the Internet, if device separation is a concern for you. If your hangup is Duo or Okta or similar--well, there's always the choice not to work at places that necessitate them for 2FA. > If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to. Even developers don't want to touch GPG. That's why they don't and a large part of why things like Git commit signing are (IME) so rare.
jka 4y ago
It seemed clearly-written and thought-provoking to me; the author doesn't claim that 2FA is a burden, either. Writing and distributing software should be straightforward so that everyone can participate. And consuming software should be safe so that people and infrastructure are protected. Finding a security model that achieves both should be the goal. PyPi appear to have walked a reasonable line on this so far, and it's worth considering and discussing what the future could be like.
- ev1 4y ago
  Another reasonable point here is that pypi is also offering package owners ~$75 (edit: didn't realise they were sold in 1-packs now) in modern usb-c fido2 keys if you have one that is now marked as critical.

throwawaybutwhy 4y ago

Not a storm in a teacup. Being forced to accept unvetted electronic devices from a 'Foundation' instead of using TOTP rings a whole lot of alarm bells. * How do we know that these ain't fitted with GPS trackers? * Why are maintainers forced to give up their snail mail addresses? * How will the keys be re-issued? Who's going to pay for this? * Oh, and there's still the silly geo-fencing issue: 'Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, United Kingdom, and the United States'

Tainnor 4y ago
Nobody is forcing anyone to use particular devices. Those are optional. Only 2FA itself is mandatory.
duskwuff 4y ago
You are assuming that the contributors are required to use these specific devices. This is incorrect. PyPI is offering free U2F devices to a subset of the affected developers, but they are free to use their own U2F devices (or a TOTP client) instead. > Oh, and there's still the silly geo-fencing issue The list of countries makes this sound like an export control issue. It's a legal restriction, not a deliberate choice PyPI made.
- throwawaybutwhy 4y ago
  Timeo Danaos et dona ferentes. All in all, bad optics and fishy offerings. TOTP is definitely OK.

echelon 4y ago

This last decade has played host to some of the most fascinating series of debates, an almost visceral push and pull, concerning individualism vs collectivism, distribution of control vs centralization of power. - COVID vaccine mandates - Cryptocurrency - Deplatforming - Abortion - Closed platforms beating open web - Monopolies controlling tech - One party governments gaining in power Strict control over package indices is one manifestation of this. Controlling a blast radius (safety) vs unlimited, unfettered publication (freedom). Power structures are everywhere.

Tainnor 4y ago
How anyone can get this worked up because of 2FA is simply beyond me. I guess some people just have to feel like rebels all the time.
- cowtools 4y ago
  2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device. If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to.
  - eropple 4y ago
    > 2FA is a major pain in my ass and it is the only reason why I am forced to own and use a "modern smartphone" which is essentially a corporatist surveillance device. TOTP-compliant services happily accept codes generated from non-mobile devices. 1Password even includes it (which is a unification of factors I don't personally trust, so I don't use it, but it's there if it fits your own threat model). They can also run on Android, etc. devices that literally-not-figuratively never touch the Internet, if device separation is a concern for you. If your hangup is Duo or Okta or similar--well, there's always the choice not to work at places that necessitate them for 2FA. > If more organizations just allowed me to have custodianship over my own keys like GPG for example, I could choose my own level of security by using a GPG smartcard if I wanted to. Even developers don't want to touch GPG. That's why they don't and a large part of why things like Git commit signing are (IME) so rare.

jka 4y ago

It seemed clearly-written and thought-provoking to me; the author doesn't claim that 2FA is a burden, either. Writing and distributing software should be straightforward so that everyone can participate. And consuming software should be safe so that people and infrastructure are protected. Finding a security model that achieves both should be the goal. PyPi appear to have walked a reasonable line on this so far, and it's worth considering and discussing what the future could be like.

ev1 4y ago
Another reasonable point here is that pypi is also offering package owners ~$75 (edit: didn't realise they were sold in 1-packs now) in modern usb-c fido2 keys if you have one that is now marked as critical.