3 ms·

I feel like some of the disconnect comes from being a mandate rather than a persuasive recommendation. Imagine that they included some sort of case study to ma

I feel like some of the disconnect comes from being a mandate rather than a persuasive recommendation. Imagine that they included some sort of case study to make it less abstract: Company C uses database driver P. On 2020-01-02 they upgraded their app to the latest version. On 2020-01-04 they noticed that someone stole all their user data. Upon investigation, Package P had a version uploaded on 2019-12-24 that sends all user data to evil.example.com. The tooling to upgrade the package doesn't show diffs, so company C had no way to detect this malicious change. How did such a compromised version get uploaded? Looking at the audit logs, it appeared that there were 2398438 unsuccessful login attempts to package P author's account, before finally uploading the new patch release from the same IP. Company C lost 8 billion dollars as a result of this. If author A had used multi-factor authentication, then this wouldn't have happened, because it would have taken more login attempts than there are atoms in the Universe. Then the author can see "hey I can save the shareholders of some random corporation 8 billion dollars if I make it harder for myself to release software". That's a better incentive than "because I told you to". I know it sounds a bit disingenuous to say this is just for the shareholders of random corporations. I'm being a little snarky. It's also good for your reputation to not get hacked, and using 2FA to log in every time is probably less time overall than reacting to a single compromise. Imagine how many emails you're going to get. Big pain. I just think it's important to show authors the cost/benefit. 2FA is easy. Next time it might not be something that's as easy, though.

zmgsabst 4y ago
I have the feeling that’s because it’s a “best practice” and not a data-driven decision. Wouldn’t they have led with, “we’ve witnessed X attempts and Y takeovers in the past year, so we’re introducing new security measures aimed at…” To me, this seems like more frog-boiling authoritarianism “for our own good”, like the COVID lockdowns, censorship, etc. I’m tired of technology forcing me to do things “for my own good” — and I recommend against companies who engage in those policies. These are all the same arguments trotted out to justify Windows spyware and forced updates that routinely lag my computer for hours — because Microsoft knows better than me how to use my desktop and isn’t shy about pushing me out of the way to do so.
franciscop 4y ago
That leaves a strange taste in my mouth. I love writing open source for both me and other devs to use it and make their lives easier; I understand that big companies will also use it since that's one of the places where devs work, and since I make mostly tools or meta-tools ("dev solutions" and not "business solutions") I'm happy with this arrangement. When I do a more business-like solution, I tend not to publish it as open source and remain on my list of trying-to-monetize side projects. But if you quantify it like this, "this company saved 8 billion dollars out of some extra work on your side, here is a pat in the back because they'd never even consider give back a single cent or helping in any way" it feels a bit strange. I know it's on me, and I just learned this contradictory feeling so need to unravel/understand it, but you def got the opposite feeling from me as expected. Edit: you added the "I know it sounds a bit disingenuous to say this is just for the shareholders of random corporations." later, right? Which kinda reflects a bit of this feeling
- jrockway 4y ago
  With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. If open source was just hobbyists making stuff for hobbyists, it might not even require a login to update a package. With companies involved, they to reduce this risk, and this comes at the cost of people not involved with the company's business. I can see why authors get annoyed; they are being required to change their workflow for a use case that doesn't interest them. Being asked to do boring work for free is not a great solution to anything. Personally, I don't have a horse in this game. I always use 2FA when it's available. I have already made the necessary adjustments in my workflow. But I get why people are annoyed that they have to change something. Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts.
  - deleted 4y ago
    [deleted]
  - tsimionescu 4y ago
    > Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts. That is just entitlement on the part of some open source devs. PyPI is already providing a huge service for them: it is publishing their package free of charge. Furthermore, it is maintaining old versions, scanning others for vulnerabilities, replicating across the world, resolving dependencies etc. They have every right to ask anyone who is enjoying their completely free service to put in the minute amount of extra work required to set up 2FA. Of course, anyone is also free but to want to put in that work, and so they can stop delivering their package on PyPI. Absolutely your right as an open source maintainer, and you have no one to answer to if that breaks some builds.
deleted 4y ago
[deleted]
tsimionescu 4y ago
Why are so many arguments acting like the maintainers of PyPI who imposed this change are not themselves open source developers whose time none of us, including those who publish their open source code on PyPI, pay for? PyPI asking for 2FA is in no way different from an open source project asking you to run their unit tests before submitting a PR. Sure, it puts a burden on you, the open source contributor, but it is balanced by removing a burden from the project maintainers.
nemothekid 4y ago
I don't see why people should be persuaded at all. PyPi is a software distribution mechanism to millions of PC globally. PyPi is putting their footdown and saying we are going to do everything in power to prevent PyPi from being used as a global malware distribution system. That involves not only securing our software, but ensuring the people who have the capability to do damage are following appropriate security protocol. It's the responsible thing to do. If a package gets compromised its PyPi that has to do cleanup work. It's like complaining that the government forces you to wear your seatbelt.
- pyrale 4y ago
  > It's the responsible thing to do. Also, conveniently, it's the thing whose cost is not paid by the people deciding to enforce it. > If a package gets compromised its PyPi that has to do cleanup work. Yeah, that's the very essence of being a distribution tool.
  - samastur 4y ago
    What costs? You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. It costs you exactly zero except a couple of minutes to set it up.
    - pyrale 4y ago
      > You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. That's one of the reasons I believe 2FA is mostly security theater. That and people insisting they need their shitty app on my unsecured phone. It's not two-factor if all of it is running on the same hardware.
      - nemothekid 4y ago
        >That's one of the reasons I believe 2FA is mostly security theater It's something you know + something you own. That's 2FA.
NoGravitas 4y ago
> Then the author can see "hey I can save the shareholders of some random corporation 8 billion dollars if I make it harder for myself to release software". That's a better incentive than "because I told you to". To be quite honest, I would rather the shareholders of some random corporation do lose 8 billion dollars. In fact, I would be willing to pay a small amount to see it.
- jrockway 4y ago
  Yeah, I totally get that. I think that's why some authors just removed their modules.

zmgsabst 4y ago

I have the feeling that’s because it’s a “best practice” and not a data-driven decision. Wouldn’t they have led with, “we’ve witnessed X attempts and Y takeovers in the past year, so we’re introducing new security measures aimed at…” To me, this seems like more frog-boiling authoritarianism “for our own good”, like the COVID lockdowns, censorship, etc. I’m tired of technology forcing me to do things “for my own good” — and I recommend against companies who engage in those policies. These are all the same arguments trotted out to justify Windows spyware and forced updates that routinely lag my computer for hours — because Microsoft knows better than me how to use my desktop and isn’t shy about pushing me out of the way to do so.

franciscop 4y ago

That leaves a strange taste in my mouth. I love writing open source for both me and other devs to use it and make their lives easier; I understand that big companies will also use it since that's one of the places where devs work, and since I make mostly tools or meta-tools ("dev solutions" and not "business solutions") I'm happy with this arrangement. When I do a more business-like solution, I tend not to publish it as open source and remain on my list of trying-to-monetize side projects. But if you quantify it like this, "this company saved 8 billion dollars out of some extra work on your side, here is a pat in the back because they'd never even consider give back a single cent or helping in any way" it feels a bit strange. I know it's on me, and I just learned this contradictory feeling so need to unravel/understand it, but you def got the opposite feeling from me as expected. Edit: you added the "I know it sounds a bit disingenuous to say this is just for the shareholders of random corporations." later, right? Which kinda reflects a bit of this feeling

jrockway 4y ago
With no data, I'm assuming this is all business-driven. Nobody is compromising software supply chains to make your 3D printer print 8% slower for the lulz. They're doing it to hack companies and compromise user data. If open source was just hobbyists making stuff for hobbyists, it might not even require a login to update a package. With companies involved, they to reduce this risk, and this comes at the cost of people not involved with the company's business. I can see why authors get annoyed; they are being required to change their workflow for a use case that doesn't interest them. Being asked to do boring work for free is not a great solution to anything. Personally, I don't have a horse in this game. I always use 2FA when it's available. I have already made the necessary adjustments in my workflow. But I get why people are annoyed that they have to change something. Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts.
- deleted 4y ago
  [deleted]
- tsimionescu 4y ago
  > Imagine that this was "we'll send you a check for $1000 if you enable 2FA on your account". Bet there would have been zero angry blog posts. That is just entitlement on the part of some open source devs. PyPI is already providing a huge service for them: it is publishing their package free of charge. Furthermore, it is maintaining old versions, scanning others for vulnerabilities, replicating across the world, resolving dependencies etc. They have every right to ask anyone who is enjoying their completely free service to put in the minute amount of extra work required to set up 2FA. Of course, anyone is also free but to want to put in that work, and so they can stop delivering their package on PyPI. Absolutely your right as an open source maintainer, and you have no one to answer to if that breaks some builds.

deleted 4y ago

[deleted]

tsimionescu 4y ago

Why are so many arguments acting like the maintainers of PyPI who imposed this change are not themselves open source developers whose time none of us, including those who publish their open source code on PyPI, pay for? PyPI asking for 2FA is in no way different from an open source project asking you to run their unit tests before submitting a PR. Sure, it puts a burden on you, the open source contributor, but it is balanced by removing a burden from the project maintainers.

nemothekid 4y ago

I don't see why people should be persuaded at all. PyPi is a software distribution mechanism to millions of PC globally. PyPi is putting their footdown and saying we are going to do everything in power to prevent PyPi from being used as a global malware distribution system. That involves not only securing our software, but ensuring the people who have the capability to do damage are following appropriate security protocol. It's the responsible thing to do. If a package gets compromised its PyPi that has to do cleanup work. It's like complaining that the government forces you to wear your seatbelt.

pyrale 4y ago
> It's the responsible thing to do. Also, conveniently, it's the thing whose cost is not paid by the people deciding to enforce it. > If a package gets compromised its PyPi that has to do cleanup work. Yeah, that's the very essence of being a distribution tool.
- samastur 4y ago
  What costs? You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. It costs you exactly zero except a couple of minutes to set it up.
  - pyrale 4y ago
    > You can stuff 2FA token generation in many password managers that run on the very computer on which you develop. That's one of the reasons I believe 2FA is mostly security theater. That and people insisting they need their shitty app on my unsecured phone. It's not two-factor if all of it is running on the same hardware.
    - nemothekid 4y ago
      >That's one of the reasons I believe 2FA is mostly security theater It's something you know + something you own. That's 2FA.

NoGravitas 4y ago

> Then the author can see "hey I can save the shareholders of some random corporation 8 billion dollars if I make it harder for myself to release software". That's a better incentive than "because I told you to". To be quite honest, I would rather the shareholders of some random corporation do lose 8 billion dollars. In fact, I would be willing to pay a small amount to see it.

jrockway 4y ago
Yeah, I totally get that. I think that's why some authors just removed their modules.