3 ms·
I think it's more about GitHub's image and its self-imposed viewpoint that it needs to keep the software landscape secure. Requiring 2fa drastically reduces the
by judge2020 3y ago
I think it's more about GitHub's image and its self-imposed viewpoint that it needs to keep the software landscape secure. Requiring 2fa drastically reduces the number of ways a repo that is a building block for x% of a country's GDP gets compromised - now the only path is if the author intentionally hands over the repo/their account to a bad actor or e.g. posts their 2fa secrets on the internet for anyone to use.
- zamadatix 3y agoThere are also plenty more ways for it get compromised which don't involve the owner handing over anything - say simply accepting a merge which adds a cool feature while still compromising the other users of the project. Github still gets the same marginal image impact risk because ultimately the security of billions of dollars or X% of a country's GDP isn't protected by requiring a hobby developer to 2FA their afternoon code changes. You can't make them interested in protecting your billions via secure account login. Instead it's done by the billion dollar companies or countries themselves because they are the only ones with resources large enough to protect that much asset in a useful way. All this ignoring the same impact can be had by the author simply having a mistake and not fixing it over holiday vacation, no malicious actors required in the first place.