4 ms·

I used to enjoy sharing some code for the benefit of the community, although less and less since SAS business models, and now AI training. Mandatory 2fa feels

I used to enjoy sharing some code for the benefit of the community, although less and less since SAS business models, and now AI training. Mandatory 2fa feels like a step towards 'MS GitHub Certified Developer & Contributor' program. How else do you 'secure the supply chain' without having identified and accountable developers.

latexr 2y ago
This feels like a slippery slope fallacy. I don’t trust Microsoft and don’t think they have user’s best interests at heart, but 2FA is generally accepted as a positive thing industry-wide. They’re far from the only ones to require it. See for example PyPI. https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ npm is another one, but because it’s owned by GitHub (and thus Microsoft) we can leave it out of the argument.
- eesmith 2y ago
  Why is it a fallacy? I stopped distributing on PyPI before the switch to 2FA because I could see it also going the "Certified Developer & Contributor" route, which is what often happens with centralized systems. PyPI's later switch to 2FA confirmed my belief that they going further along that slope. Centralized systems are hard to manage. We've seen how Anaconda and readthedocs have switched their business models to get more funding. PyPI uses a lot of bandwidth, and needs people to manage all of the attacks and abuse. And you know who has money? Big businesses who want someone else to manage their supply chain. And you know who has the time to help manage these systems? People working for big businesses. PyPI was able to require a change to 2FA in part because there aren't effective alternatives, nor the easy ability to migrate from one to another. Those who don't want to be part of the "industry" have a high switching cost. Also, what does "industry-wide" mean? I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers.
  - MeetingsBrowser 2y ago
    > I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers. a.k.a the "just trust me bro" approach. Unfortunately the days where we can rely on trust alone are largely behind us. Supply chain security is a real thing, even if "security vendors" over-hype it to sound like an impending doomsday. If you work in an important industry, a leaked password should not result in a malicious package being pulled that takes out your <car/power plant/pacemaker/ insert important thing here>.
    - eesmith 2y ago
      > are largely behind us So am I part of this industry or not? What even makes something an "important" industry vs. a non-important industry? It seems odd how you point to "car/power plant/pacemaker" examples when few people with Microsoft GitHub accounts work in real-time systems, much less ones which risk human injury or death. My business works with P.O.s, contracts, wire transfers, one-on-one interactions, customer knowledge of my 25 years of working in this field, and my ability to vet my customers. That's where the "trust me" comes from, not bro-dom, not Microsoft with its long history of security failures.
      - MeetingsBrowser 2y ago
        I didn’t say you aren’t in an important industry. I said if you are in an important industry, a single password should not be the only measure stopping malicious packages to be distributed on your behalf. Your customers can trust you all they want, but can they trust packages are actually coming from you or a compromised account due to a leaked password.

latexr 2y ago

This feels like a slippery slope fallacy. I don’t trust Microsoft and don’t think they have user’s best interests at heart, but 2FA is generally accepted as a positive thing industry-wide. They’re far from the only ones to require it. See for example PyPI. https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ https://blog.pypi.org/posts/2024-01-01-2fa-enforced/ npm is another one, but because it’s owned by GitHub (and thus Microsoft) we can leave it out of the argument.

eesmith 2y ago
Why is it a fallacy? I stopped distributing on PyPI before the switch to 2FA because I could see it also going the "Certified Developer & Contributor" route, which is what often happens with centralized systems. PyPI's later switch to 2FA confirmed my belief that they going further along that slope. Centralized systems are hard to manage. We've seen how Anaconda and readthedocs have switched their business models to get more funding. PyPI uses a lot of bandwidth, and needs people to manage all of the attacks and abuse. And you know who has money? Big businesses who want someone else to manage their supply chain. And you know who has the time to help manage these systems? People working for big businesses. PyPI was able to require a change to 2FA in part because there aren't effective alternatives, nor the easy ability to migrate from one to another. Those who don't want to be part of the "industry" have a high switching cost. Also, what does "industry-wide" mean? I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers.
- MeetingsBrowser 2y ago
  > I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers. a.k.a the "just trust me bro" approach. Unfortunately the days where we can rely on trust alone are largely behind us. Supply chain security is a real thing, even if "security vendors" over-hype it to sound like an impending doomsday. If you work in an important industry, a leaked password should not result in a malicious package being pulled that takes out your <car/power plant/pacemaker/ insert important thing here>.
  - eesmith 2y ago
    > are largely behind us So am I part of this industry or not? What even makes something an "important" industry vs. a non-important industry? It seems odd how you point to "car/power plant/pacemaker" examples when few people with Microsoft GitHub accounts work in real-time systems, much less ones which risk human injury or death. My business works with P.O.s, contracts, wire transfers, one-on-one interactions, customer knowledge of my 25 years of working in this field, and my ability to vet my customers. That's where the "trust me" comes from, not bro-dom, not Microsoft with its long history of security failures.
    - MeetingsBrowser 2y ago
      I didn’t say you aren’t in an important industry. I said if you are in an important industry, a single password should not be the only measure stopping malicious packages to be distributed on your behalf. Your customers can trust you all they want, but can they trust packages are actually coming from you or a compromised account due to a leaked password.