Conversation

Notices

1. Embed this notice
   Kornel (kornel@mastodon.social)'s status on Thursday, 26-Sep-2024 23:51:54 JST Kornel

   • Matthew Lyon

   @stonebear @mattly To me account security in shared environments is like hygiene. When one person's security stinks, it affects others. To me the real rudeness is in doubling down on bad hygiene when told that your security stinks.

   Supply chain security in OSS is already a hot mess, and doesn't need even more worrying about impersonation just because someone *wants* to have poorer security to show a computer who's the boss.

   • Matthew Lyon repeated this.
   • Embed this notice
     Kornel (kornel@mastodon.social)'s status on Friday, 27-Sep-2024 02:51:06 JST Kornel

     • Matthew Lyon

     @mattly @stonebear I'm just talking about 2FA. It's perfectly reasonable to require 2FA on all accounts. It's safer to err on the side of requiring unimportant accounts to have 2FA, than risking an important user to have an account compromised.

     That is entirely orthogonal to the funding structure. The risk and responsibility exists due to code sharing and trust structures, regardless whether people are paid for it or not.

     On Star Trek they'd require you to have 2FA too.