5 ms·
I think that we should impose webauthn 2fa on all npm accounts as the only acceptable auth method if you have e.g., more than 1 million total downloads. Someon
by noodlesUK 1y ago
I think that we should impose webauthn 2fa on all npm accounts as the only acceptable auth method if you have e.g., more than 1 million total downloads.
Someone could pony up the cash to send out a few thousand yubikeys for this and we'd all be a lot safer.
- thewebguyd 1y agoWhy even put a package download count on it? Just require it for everything submitted to NPM. It's not hard.
- ronsor 1y agoBecause then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.
- thewebguyd 1y agoIt's already centralized by virtue of using and relying on NPM as the registry. If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.
- LPisGood 1y agoI don’t understand what benefits this kind of “decentralization” offers
- q3k 1y agoLarger pool of people you can hack/blackmail/coerce into giving you access to millions of systems :)
- deleted 1y ago[deleted]
- kelnos 1y agoDecentralized? This is a centralized package registry. There is nothing decentralized about it.
- jay_kyburz 1y agooh right, good point, I wonder when somebody will just sue NPM for any damage caused. That's really the only way we'll see change I think.
- LtWorf 1y agoDownload counters are completely useless. I could download your package 2 million times in under a minute and cause you to need the 2FA. And true 2FA means you can't automate publishing from github's CI. Python is going the other direction. There is a fake 2FA that is just used to generate tokens and there is a preferential channel to upload to pypi via github's CI. But in my opinion none of this helps with security. But it does help to de-anonymise the developers, which is probably what they really want to do, without caring if those developers get hacked and someone else uses their identity to do uploads.
- ForHackernews 1y agoPyPI already has this. It was a little bit annoying when they imposed stricter security on maintainers, but I can see the need.
- LtWorf 1y agoPypi did that, i got 2 google keys for free. But I used them literally once, to create a token that never expires and that is what I actually use to upload on pypi. (I did a talk at minidebconf last year in toulouse about this). If implemented like this, it's completely useless, since there is actually no 2fa at all. Anyway the idea of making libre software developers work more is a bad idea. We do it for fun. If we have to do corporate stuff we want a corporate salary to go with.
- kelnos 1y agoHow would that work for CI release flows? I have my Rust crates, for example, set up to auto-publish whenever I push a tag to its repo.
- btown 1y agoEven the simplest "any maintainer can click a push notification on their phone to verify that they want to push an update to $package" would have stopped this worm in its tracks!