4 ms·
PyPI is rolling out 2FA for critical projects, giving away 4k security keys
- 8organicbits 4y agoThis is a great move. Another I'd love to see is a mechanism to encourage package maintainers to periodically audit who has permission to publish. Sometimes, usually without MFA, accounts that no longer need access get compromised. An easy interface to audit and revoke unneeded access is important.
- jwilk 4y agoRelated: https://news.ycombinator.com/item?id=32026624 https://news.ycombinator.com/item?id=32026624 "Atomicwrites' old versions have been purged from PyPI" https://news.ycombinator.com/item?id=32037562 https://news.ycombinator.com/item?id=32037562 "Congratulations: We now have opinions on your open source contributions"