3 ms·
First point.. plus, OTP/MFA authenticated publishing. This OTP/MFA should come from package repositories, before the package is made publicly available. This i
by freakynit 2mo ago
First point.. plus, OTP/MFA authenticated publishing.
This OTP/MFA should come from package repositories, before the package is made publicly available. This is needed so that CD stage is not blocked.
OTP/MFA should be scoped to publishing user/org, not the package. How the OTP/MFA client is managed across the maintainers/org, lies in the scope of maintainers/org.
- pixl97 2mo agoThis still does nothing to prevent anyone from publishing a bad package, for example a compromised device/dev in the organization. A cooldown of a day, and maybe not updating on weekends will save you from that. It's time to stop moving at the speed of stupid.
- vhcr 2mo agoA compromised device still can't access the secure enclave.
- pixl97 2mo agoIt doesn't need to, it just updates the code, you have the human publish.
- freakynit 2mo agoUpdates should be changed to delete + publish, and either should require OTP/MFA. You don't need artificial cooldown if you add a manual, informed action in-between. All these publishes went uninformed to their maintainers.. that's the issue.