4 ms·

2FA pushed me out of github, but M/S Copilot in github created the road out. Now seems people's chats and posts are being used to train AI. I wonder how long b

by jmclnx 2y ago

2FA pushed me out of github, but M/S Copilot in github created the road out. Now seems people's chats and posts are being used to train AI. I wonder how long before Cell Phone Providers start using Text Messages to train AI (or sell to AI people).

giancarlostoro 2y ago
Given how awful some text messages I get from relatives read, I really hope not. The worst types of typos. The only thing I want them to train properly is voice to text. It cannot for the life of itself ever get anything right. I have to scream at Siri a dozen times.
eesmith 2y ago
2FA also pushed me out, and Copilot locked the door ... to be fair, unless a client comes with bucket full of money with a key on top.
bluish29 2y ago
> 2FA pushed me out of github I don't understand why would something like that be a reason to avoid github (or any service) in itself? In this era, 2FA is important security measurement and it is not like they enforce only SMS as the only 2FA form.
- marcosdumay 2y ago
  Modern 2FA is "something you know" and "something you subscribe for".
  - cuu508 2y ago
    What do you mean? GitHub supports TOTP, Webauthn on free accounts.
    - cuu508 2y ago
      To answer myself, from reading the other comments, it sounds like GitHub started to require 2FA at some point, and some people refused to set it up. The problem was not some inadequacy of GitHub's 2FA implementation, but the fact it is mandatory. (I had 2FA set up a long time ago, so didn't notice the policy change)
- eesmith 2y ago
  To start with, I don't have two devices, only a laptop. (And a backup laptop and desktop at home, but I typically don't work there.) Correct, I have no smart phone. Second, it's not an important security measurement for me. I didn't go into FOSS to be part of someone's supply chain. I do it as a way to share my knowledge of how one might solve a problem. If you want use my code, then inspect it to make sure it does what you want, or pay me for commercial support. Neither require 2FA. Might someone take over the account? Sure, I suppose. But I'm not into "community building" or GitHub's gamification, and my primary repos are all local, so if that happens and GitHub's support didn't help, I could start a new account. Again, don't depend on me for your supply chain without a commercial support agreement. When Microsoft switched GitHub to require 2FA I concluded it was because they wanted to assure their corporate and government clients that it was "safe" for them. Those profits subsidize Microsoft's free hosting plans, so my presence there was helping contribute to Microsoft's already excessive market power. Third, the change was driven from on high, with no chance for me to decide what was appropriate for my projects. I concluded Microsoft was so powerful they could make such paternalistic changes because they knew network effect was on their side that they could have little concern about the small number of people leaving or getting upset. Fourth, my FOSS projects on GitHub were labors of love that were a net negative on my income. I was not going to spend any money on new hardware or waste my time figuring out how to get things working under a new system when I was already hosting most of my work on Sourcehut, which is much more aligned to my ethical and moral views. I still don't know how many security keys I'm supposed to have (how often should I expect to lose one? should I store the backups off-site at a friend's place?), or how often am I supposed to test they work? And then I hear about issues about lock-in and how attestation requirements might prevent FOSS solutions ad prevent people from backing up one's own security keys, and issues with resident vs. non-resident keys, and being able to register multiple keys. It's all learnable, but I simply don't care enough. And I don't see why I should care about all this when the paying customers of my software have all been fine with only a tar.gz, license agreement, and support contract.
alright2565 2y ago
> 2FA pushed me out of github I've seen several folks have this opinion... and it just doesn't make any sense? SMS for 2FA is problematic for many reasons, but Github offers TOTP & U2F/passkey 2FA, which have zero privacy implications.
- ProllyInfamous 2y ago
  2FA is why I can no longer utilize online banking (which is frustrating).

by jmclnx 2y ago

giancarlostoro 2y ago

Given how awful some text messages I get from relatives read, I really hope not. The worst types of typos. The only thing I want them to train properly is voice to text. It cannot for the life of itself ever get anything right. I have to scream at Siri a dozen times.

eesmith 2y ago

2FA also pushed me out, and Copilot locked the door ... to be fair, unless a client comes with bucket full of money with a key on top.

bluish29 2y ago

> 2FA pushed me out of github I don't understand why would something like that be a reason to avoid github (or any service) in itself? In this era, 2FA is important security measurement and it is not like they enforce only SMS as the only 2FA form.

marcosdumay 2y ago
Modern 2FA is "something you know" and "something you subscribe for".
- cuu508 2y ago
  What do you mean? GitHub supports TOTP, Webauthn on free accounts.
  - cuu508 2y ago
    To answer myself, from reading the other comments, it sounds like GitHub started to require 2FA at some point, and some people refused to set it up. The problem was not some inadequacy of GitHub's 2FA implementation, but the fact it is mandatory. (I had 2FA set up a long time ago, so didn't notice the policy change)
eesmith 2y ago
To start with, I don't have two devices, only a laptop. (And a backup laptop and desktop at home, but I typically don't work there.) Correct, I have no smart phone. Second, it's not an important security measurement for me. I didn't go into FOSS to be part of someone's supply chain. I do it as a way to share my knowledge of how one might solve a problem. If you want use my code, then inspect it to make sure it does what you want, or pay me for commercial support. Neither require 2FA. Might someone take over the account? Sure, I suppose. But I'm not into "community building" or GitHub's gamification, and my primary repos are all local, so if that happens and GitHub's support didn't help, I could start a new account. Again, don't depend on me for your supply chain without a commercial support agreement. When Microsoft switched GitHub to require 2FA I concluded it was because they wanted to assure their corporate and government clients that it was "safe" for them. Those profits subsidize Microsoft's free hosting plans, so my presence there was helping contribute to Microsoft's already excessive market power. Third, the change was driven from on high, with no chance for me to decide what was appropriate for my projects. I concluded Microsoft was so powerful they could make such paternalistic changes because they knew network effect was on their side that they could have little concern about the small number of people leaving or getting upset. Fourth, my FOSS projects on GitHub were labors of love that were a net negative on my income. I was not going to spend any money on new hardware or waste my time figuring out how to get things working under a new system when I was already hosting most of my work on Sourcehut, which is much more aligned to my ethical and moral views. I still don't know how many security keys I'm supposed to have (how often should I expect to lose one? should I store the backups off-site at a friend's place?), or how often am I supposed to test they work? And then I hear about issues about lock-in and how attestation requirements might prevent FOSS solutions ad prevent people from backing up one's own security keys, and issues with resident vs. non-resident keys, and being able to register multiple keys. It's all learnable, but I simply don't care enough. And I don't see why I should care about all this when the paying customers of my software have all been fine with only a tar.gz, license agreement, and support contract.

alright2565 2y ago

> 2FA pushed me out of github I've seen several folks have this opinion... and it just doesn't make any sense? SMS for 2FA is problematic for many reasons, but Github offers TOTP & U2F/passkey 2FA, which have zero privacy implications.

ProllyInfamous 2y ago
2FA is why I can no longer utilize online banking (which is frustrating).