4 ms·
> I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same in
by MeetingsBrowser 2y ago
> I distribute packages (source and binary wheels) on my own server. None of my commercial customers have ever even asked about 2FA. And if I am in the same industry, I can assure you I have never placed that requirement on my suppliers.
a.k.a the "just trust me bro" approach.
Unfortunately the days where we can rely on trust alone are largely behind us.
Supply chain security is a real thing, even if "security vendors" over-hype it to sound like an impending doomsday.
If you work in an important industry, a leaked password should not result in a malicious package being pulled that takes out your <car/power plant/pacemaker/ insert important thing here>.
- eesmith 2y ago> are largely behind us So am I part of this industry or not? What even makes something an "important" industry vs. a non-important industry? It seems odd how you point to "car/power plant/pacemaker" examples when few people with Microsoft GitHub accounts work in real-time systems, much less ones which risk human injury or death. My business works with P.O.s, contracts, wire transfers, one-on-one interactions, customer knowledge of my 25 years of working in this field, and my ability to vet my customers. That's where the "trust me" comes from, not bro-dom, not Microsoft with its long history of security failures.
- MeetingsBrowser 2y agoI didn’t say you aren’t in an important industry. I said if you are in an important industry, a single password should not be the only measure stopping malicious packages to be distributed on your behalf. Your customers can trust you all they want, but can they trust packages are actually coming from you or a compromised account due to a leaked password.