5 ms·

With all due respect to James, without whom I probably wouldn't have my current job (I've been programming in Django since the 0.96 days, that is 16 years now),

With all due respect to James, without whom I probably wouldn't have my current job (I've been programming in Django since the 0.96 days, that is 16 years now), I think Armin is right on this one: > PyPI asks for 2FA today, what might they ask for tomorrow? Yes, slippery slopes are real because they happen, especially in this very tense and very non-rational geo-political climate. Yes, today it might just be "use 2FA with you still want to actively maintain your own package", tomorrow it might be "boo-hoo-hoo, you've followed/liked Putin/Xi/whoever the powers that be don't like, you're a threat to liberal democracy, we can't leave critical infrastructure in your hands, bye-bye", and there will be nothing for the package maintainer left to do at that point.

kevinh 4y ago
How does mandating 2FA get them any closer to that second point? If they wanted to start with that, they could. They're two separate issues.
- bjt2n3904 4y ago
  The entirety of the last decade in open source software development can be summarized as this: it is morally reprehensible for your project to not support the causes du jour. You must adopt a COC. You must rename your branch from "master" to "main". You must use "inclusive" language in your documentation. Why? Because you must assume the responsibility for everything your project touches. A bad person uses your leftpad.js to perpetuate badness. You must stop them. Someone might get their feelings hurt. You must preemptively protect them. This is an impossible task. 2FA is fine, sure. I use it myself, and advocate for others to do so as well. But I'm sick and tired of the "harm reduction" mantra that means I have to entirely rewrite my documentation every 6 months.
  - kevinh 4y ago
    If the last decade has been all about that, then clearly a 2FA mandate won't lead to it, since it's already here. FWIW, I have multiple open source projects. I don't have a COC. I haven't renamed any of my branches. I haven't gotten any pushback.
elteto 4y ago
Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense. Look, publishing to PyPI is not a right. If typing 6 digits is too much burden you can drop a source tarball in some web page and call it a day, you don't have to go through PyPI. Done. I, for one, I'm very very glad that a piece of _critical infrastructure_ that I depend on is a bit more secure.
- paganel 4y ago
  > Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense. The 2FA thingie is not implemented because of some random dude who might want to steal a bitcoin or two, is implemented against state actors. This being the US we're talking about (and the West more generally) the state actors taken into consideration are: China, Russia, Iran, probably North Korea (probably in this order). Hence my mention of China and Russia in my initial comment.
sleepybrett 4y ago
If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain attacks' we've been seeing in the open source community for years now. If they continue, in spite of your protest, you can always distribute your library some other way or retire it.
- pyrale 4y ago
  The author of the article this thread is about is litterally pushing further down that particular slope: > And if your package gets established and has people regularly using it, you have some responsibility not to mess with those users. If you want to make backwards-incompatible changes, for example, communicate them and bump the major version number. If you want to stop maintaining the package, post an announcement about it and be willing to hand over to someone else to continue work.
  - donaldstufft 4y ago
    Not really, none of those things are things he is suggesting PyPI should do, but rather social expectations that come from being a maintainer of a large project.
    - nomdep 4y ago
      Sure, but they have the same implicit “… or else”, meaning losing the capacity to publish again on PyPI until they “fix their attitude”
_greim_ 4y ago
> PyPI asks for 2FA today, what might they ask for tomorrow? If and when they start policing political views of their maintainers, it would be fair to criticize them. But the theoretical possibility of such a thing happening has no relevance to whether 2FA is a reasonable request.
- paganel 4y ago
  Are the 2FA dongles provided by Google available to maintainers that reside in countries the US (and the West generally) doesn't generally like? I'm thinking, explicitly, at China, Russia and Iran. Most probably no, even though I'd love to be proven wrong on this. As such, this is already a political thing.
  - giaour 4y ago
    PyPI supports TOTP 2FA: https://pypi.org/help/#totp https://pypi.org/help/#totp TOTP is defined in a freely available RFC (https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238) and is implemented by a wide variety of applications and libraries, both proprietary and open source.
    - paganel 4y ago
      Yes, I know, I've implemented it on the server side once, but I was curious why did Google (the company) feel the need to get involved with those thousands of physical dongles as long as almost any Android or iPhone can handle this, hence my question. Because I suppose there aren't thousands of contributors who don't have an iPhone nor an Android phone. Or maybe it's just a marketing ploy? I still don't get it.
      - giaour 4y ago
        Dongles are generally understood to be more secure than TOTP because they have to be physically stolen (unlike TOTP seeds, which are just information). Google is giving away thousands of physical keys maybe to drum up goodwill among the python community, maybe because it's a trivial expense for them and they have an institutional interest is seeing PyPI succeed. I dunno, but it doesn't really seem all that sinister. Just FYI, you don't need a smartphone to use TOTP. You can download 'pyotp' from PyPI and use it with any python interpreter. Anybody publishing packages to PyPI would have access to that.

kevinh 4y ago

How does mandating 2FA get them any closer to that second point? If they wanted to start with that, they could. They're two separate issues.

bjt2n3904 4y ago
The entirety of the last decade in open source software development can be summarized as this: it is morally reprehensible for your project to not support the causes du jour. You must adopt a COC. You must rename your branch from "master" to "main". You must use "inclusive" language in your documentation. Why? Because you must assume the responsibility for everything your project touches. A bad person uses your leftpad.js to perpetuate badness. You must stop them. Someone might get their feelings hurt. You must preemptively protect them. This is an impossible task. 2FA is fine, sure. I use it myself, and advocate for others to do so as well. But I'm sick and tired of the "harm reduction" mantra that means I have to entirely rewrite my documentation every 6 months.
- kevinh 4y ago
  If the last decade has been all about that, then clearly a 2FA mandate won't lead to it, since it's already here. FWIW, I have multiple open source projects. I don't have a COC. I haven't renamed any of my branches. I haven't gotten any pushback.

elteto 4y ago

Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense. Look, publishing to PyPI is not a right. If typing 6 digits is too much burden you can drop a source tarball in some web page and call it a day, you don't have to go through PyPI. Done. I, for one, I'm very very glad that a piece of _critical infrastructure_ that I depend on is a bit more secure.

paganel 4y ago
> Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense. The 2FA thingie is not implemented because of some random dude who might want to steal a bitcoin or two, is implemented against state actors. This being the US we're talking about (and the West more generally) the state actors taken into consideration are: China, Russia, Iran, probably North Korea (probably in this order). Hence my mention of China and Russia in my initial comment.

sleepybrett 4y ago

If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain attacks' we've been seeing in the open source community for years now. If they continue, in spite of your protest, you can always distribute your library some other way or retire it.

pyrale 4y ago
The author of the article this thread is about is litterally pushing further down that particular slope: > And if your package gets established and has people regularly using it, you have some responsibility not to mess with those users. If you want to make backwards-incompatible changes, for example, communicate them and bump the major version number. If you want to stop maintaining the package, post an announcement about it and be willing to hand over to someone else to continue work.
- donaldstufft 4y ago
  Not really, none of those things are things he is suggesting PyPI should do, but rather social expectations that come from being a maintainer of a large project.
  - nomdep 4y ago
    Sure, but they have the same implicit “… or else”, meaning losing the capacity to publish again on PyPI until they “fix their attitude”

_greim_ 4y ago

> PyPI asks for 2FA today, what might they ask for tomorrow? If and when they start policing political views of their maintainers, it would be fair to criticize them. But the theoretical possibility of such a thing happening has no relevance to whether 2FA is a reasonable request.

paganel 4y ago
Are the 2FA dongles provided by Google available to maintainers that reside in countries the US (and the West generally) doesn't generally like? I'm thinking, explicitly, at China, Russia and Iran. Most probably no, even though I'd love to be proven wrong on this. As such, this is already a political thing.
- giaour 4y ago
  PyPI supports TOTP 2FA: https://pypi.org/help/#totp https://pypi.org/help/#totp TOTP is defined in a freely available RFC (https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238) and is implemented by a wide variety of applications and libraries, both proprietary and open source.
  - paganel 4y ago
    Yes, I know, I've implemented it on the server side once, but I was curious why did Google (the company) feel the need to get involved with those thousands of physical dongles as long as almost any Android or iPhone can handle this, hence my question. Because I suppose there aren't thousands of contributors who don't have an iPhone nor an Android phone. Or maybe it's just a marketing ploy? I still don't get it.
    - giaour 4y ago
      Dongles are generally understood to be more secure than TOTP because they have to be physically stolen (unlike TOTP seeds, which are just information). Google is giving away thousands of physical keys maybe to drum up goodwill among the python community, maybe because it's a trivial expense for them and they have an institutional interest is seeing PyPI succeed. I dunno, but it doesn't really seem all that sinister. Just FYI, you don't need a smartphone to use TOTP. You can download 'pyotp' from PyPI and use it with any python interpreter. Anybody publishing packages to PyPI would have access to that.