4 ms·
> The upshot of all this is that admins who enabled some form of two-factor authentication (2FA) in GitLab are safe and unaffected by the vulnerability. And of
by metaphor 2y ago
> The upshot of all this is that admins who enabled some form of two-factor authentication (2FA) in GitLab are safe and unaffected by the vulnerability. And of course you enabled 2FA, didn't you?
...which begs the question: What US federal agencies aren't deploying their GitLab instances behind CAC auth at a minimum?
- codeslave13 2y agoYou would be very very surprised how many federal agencies still use just a pw for vpn etc access to their whole network. Or maybe you wouldn’t.
- mugsie 2y agoBasically all of them? Even the DOD Iron bank / repo1 has non CAC modes behind an auth provider. They have forced 2FA on from what I can see now though