7 ms·

Honestly I don't think this is a hill you want to die on. "The greater your influence, the greater your responsibilities" is something society generally agrees

Honestly I don't think this is a hill you want to die on. "The greater your influence, the greater your responsibilities" is something society generally agrees is reasonable in most domains, and this is just a manifestation of that principle in the case of OSS and supply-chain integrity. The principle is pretty universal in modern society though. If you see an unreasonable responsibility being placed on you, for sure, complain about that. But if you don't think the responsibility itself (2FA in this case) is unreasonable, and in fact think it should be mandated on everyone, "it's a slippery slope!" and "it's not fair!" are not going to be compelling counterarguments for most people. It goes against what people expect in society.

frenet 4y ago
Fundamentally I agree with you. But I also think it easy to get the idea that "no responsibility" is a prevailing view. Or at least that it has to be. There are plenty of people who want to do their best. I would certainly considered the author's software involvement to be part of that. It is just hard to do. And increasing hard not only because of software but society at large (like job and housing markets). So the problem exists regardless of various positions on the issue. Or put another way. If we want open source developers who favor responsibility we have to make it easy for those developers. Otherwise we only end up with people who are fine with throwing things over the wall.
CJefferson 4y ago
That doesn't seem to apply to companies -- they make billions from open source and give back little, or nothing, to the majority of the authous and packages whose work they build on. Now that's fine under open source licenses -- but if you want the "free", you also have to take the "no warranty".
TAForObvReasons 4y ago
2FA attempts to assert "the person who is publishing the package to the registry is someone that the registry expects" As a user installing from a registry, you are trusting both the publisher AND the distributor. Consider an attack where the distributor is adding malicious code to 1% of installs. The publisher is not involved in the process and (unless code signing is involved) has no influence. But if code signing is involved, why is 2FA even needed? The signatures themselves should be sufficient proof. So 2FA overall is a solution in the lens that the distributor intermediates the relationship. This need not happen. People can chuck tarballs and post signatures, establishing more direct trust compared to the indirect solution.
- woodruffw 4y ago
  > 2FA attempts to assert "the person who is publishing the package to the registry is someone that the registry expects" This is not what 2FA asserts in the context of PyPI. It’s used solely for logins to the web frontend, which is where users can manage their projects and the permissions associated with those projects. The idea is to make account takeover more difficult, since that’s (frequently) the first step in malicious package takeover. Assuming that you’re using API tokens to publish to PyPI (which you absolutely should be), having 2FA enabled on your account will not affect any ordinary publishing workflows. We have separate plans to improve PyPI’s support for code signing.
- staticassertion 4y ago
  They solve different problems. Given a signed package I can say "this is signed by that key". I can't say how that key was registered, or who registered it, etc. 2FA would be where that key registration actually happens.
- dataflow 4y ago
  That's not even the point of the blog post to begin debating it here. If the the author believes that then he can write a blog post about how 2FA is bad. That's not what we have here though. In fact, he instead says "it's a sensible thing" and his complaint is that it's a slippery slope: "More importantly though is what could come next. There is a hypothetical future where the rules tighten."
jnovek 4y ago
When we write software as part of a job, we have all kinds of staff who support the project —- project managers, product managers, QA, marketing and sales, security etc etc. It really seems that, for open source projects, the author is expected to be responsible for everything. I think it would be a great benefit to all of us if people who wanted to open up code but didn’t want to add responsibility to their own world felt welcome to do so. I think it’s a problem worth solving.
- dataflow 4y ago
  > It really seems that, for open source projects, the author is expected to be responsible for everything. If you wrote "for underfunded projects" I would agree with you. It's a pretty universal fact of life regardless of the nature of the source. > I think it’s a problem worth solving. Definitely, I don't think anyone is against a solution to this problem. The question is what we can expect before the envisioned solution is finally created by someone and provided to us.
- deleted 4y ago
  [deleted]
- saagarjha 4y ago
  What’s interesting is that we don’t really have this kind of structure in place elsewhere to my knowledge, outside of open source software. There’s a limit to how much legal liability you can shed, and even after that social liability is much more fickle.
  - dataflow 4y ago
    > What’s interesting is that we don’t really have this kind of structure in place elsewhere to my knowledge, outside of open source software. https://developer.apple.com/support/authentication/ https://developer.apple.com/support/authentication/ ?
    - saagarjha 4y ago
      Not for 2FA, for absolving yourself of all responsibility.

frenet 4y ago

Fundamentally I agree with you. But I also think it easy to get the idea that "no responsibility" is a prevailing view. Or at least that it has to be. There are plenty of people who want to do their best. I would certainly considered the author's software involvement to be part of that. It is just hard to do. And increasing hard not only because of software but society at large (like job and housing markets). So the problem exists regardless of various positions on the issue. Or put another way. If we want open source developers who favor responsibility we have to make it easy for those developers. Otherwise we only end up with people who are fine with throwing things over the wall.

CJefferson 4y ago

That doesn't seem to apply to companies -- they make billions from open source and give back little, or nothing, to the majority of the authous and packages whose work they build on. Now that's fine under open source licenses -- but if you want the "free", you also have to take the "no warranty".

TAForObvReasons 4y ago

2FA attempts to assert "the person who is publishing the package to the registry is someone that the registry expects" As a user installing from a registry, you are trusting both the publisher AND the distributor. Consider an attack where the distributor is adding malicious code to 1% of installs. The publisher is not involved in the process and (unless code signing is involved) has no influence. But if code signing is involved, why is 2FA even needed? The signatures themselves should be sufficient proof. So 2FA overall is a solution in the lens that the distributor intermediates the relationship. This need not happen. People can chuck tarballs and post signatures, establishing more direct trust compared to the indirect solution.

woodruffw 4y ago
> 2FA attempts to assert "the person who is publishing the package to the registry is someone that the registry expects" This is not what 2FA asserts in the context of PyPI. It’s used solely for logins to the web frontend, which is where users can manage their projects and the permissions associated with those projects. The idea is to make account takeover more difficult, since that’s (frequently) the first step in malicious package takeover. Assuming that you’re using API tokens to publish to PyPI (which you absolutely should be), having 2FA enabled on your account will not affect any ordinary publishing workflows. We have separate plans to improve PyPI’s support for code signing.
staticassertion 4y ago
They solve different problems. Given a signed package I can say "this is signed by that key". I can't say how that key was registered, or who registered it, etc. 2FA would be where that key registration actually happens.
dataflow 4y ago
That's not even the point of the blog post to begin debating it here. If the the author believes that then he can write a blog post about how 2FA is bad. That's not what we have here though. In fact, he instead says "it's a sensible thing" and his complaint is that it's a slippery slope: "More importantly though is what could come next. There is a hypothetical future where the rules tighten."

jnovek 4y ago

When we write software as part of a job, we have all kinds of staff who support the project —- project managers, product managers, QA, marketing and sales, security etc etc. It really seems that, for open source projects, the author is expected to be responsible for everything. I think it would be a great benefit to all of us if people who wanted to open up code but didn’t want to add responsibility to their own world felt welcome to do so. I think it’s a problem worth solving.

dataflow 4y ago
> It really seems that, for open source projects, the author is expected to be responsible for everything. If you wrote "for underfunded projects" I would agree with you. It's a pretty universal fact of life regardless of the nature of the source. > I think it’s a problem worth solving. Definitely, I don't think anyone is against a solution to this problem. The question is what we can expect before the envisioned solution is finally created by someone and provided to us.
deleted 4y ago
[deleted]
saagarjha 4y ago
What’s interesting is that we don’t really have this kind of structure in place elsewhere to my knowledge, outside of open source software. There’s a limit to how much legal liability you can shed, and even after that social liability is much more fickle.
- dataflow 4y ago
  > What’s interesting is that we don’t really have this kind of structure in place elsewhere to my knowledge, outside of open source software. https://developer.apple.com/support/authentication/ https://developer.apple.com/support/authentication/ ?
  - saagarjha 4y ago
    Not for 2FA, for absolving yourself of all responsibility.