Hacker News Reader

Comment by paganel | Hacker News Reader

With all due respect to James, without whom I probably wouldn't have my current job (I've been programming in Django since the 0.96 days, that is 16 years now), I think Armin is right on this one:

> PyPI asks for 2FA today, what might they ask for tomorrow?

Yes, slippery slopes are real because they happen, especially in this very tense and very non-rational geo-political climate. Yes, today it might just be "use 2FA with you still want to actively maintain your own package", tomorrow it might be "boo-hoo-hoo, you've followed/liked Putin/Xi/whoever the powers that be don't like, you're a threat to liberal democracy, we can't leave critical infrastructure in your hands, bye-bye", and there will be nothing for the package maintainer left to do at that point.

View on HN

If they slip further down the slope you can, as a maintainer, protest there. 2FA is literally the least you can do to help prevent the kind of 'supply chain attacks' we've been seeing in the open source community for years now. If they continue, in spite of your protest, you can always distribute your library some other way or retire it.

The author of the article this thread is about is litterally pushing further down that particular slope:

> And if your package gets established and has people regularly using it, you have some responsibility not to mess with those users. If you want to make backwards-incompatible changes, for example, communicate them and bump the major version number. If you want to stop maintaining the package, post an announcement about it and be willing to hand over to someone else to continue work.

Not really, none of those things are things he is suggesting PyPI should do, but rather social expectations that come from being a maintainer of a large project.

Sure, but they have the same implicit “… or else”, meaning losing the capacity to publish again on PyPI until they “fix their attitude”

> PyPI asks for 2FA today, what might they ask for tomorrow?

If and when they start policing political views of their maintainers, it would be fair to criticize them. But the theoretical possibility of such a thing happening has no relevance to whether 2FA is a reasonable request.

Are the 2FA dongles provided by Google available to maintainers that reside in countries the US (and the West generally) doesn't generally like? I'm thinking, explicitly, at China, Russia and Iran. Most probably no, even though I'd love to be proven wrong on this. As such, this is already a political thing.

PyPI supports TOTP 2FA: https://pypi.org/help/#totp

TOTP is defined in a freely available RFC (https://www.rfc-editor.org/rfc/rfc6238) and is implemented by a wide variety of applications and libraries, both proprietary and open source.

Yes, I know, I've implemented it on the server side once, but I was curious why did Google (the company) feel the need to get involved with those thousands of physical dongles as long as almost any Android or iPhone can handle this, hence my question. Because I suppose there aren't thousands of contributors who don't have an iPhone nor an Android phone. Or maybe it's just a marketing ploy? I still don't get it.

Dongles are generally understood to be more secure than TOTP because they have to be physically stolen (unlike TOTP seeds, which are just information). Google is giving away thousands of physical keys maybe to drum up goodwill among the python community, maybe because it's a trivial expense for them and they have an institutional interest is seeing PyPI succeed. I dunno, but it doesn't really seem all that sinister.

Just FYI, you don't need a smartphone to use TOTP. You can download 'pyotp' from PyPI and use it with any python interpreter. Anybody publishing packages to PyPI would have access to that.

How does mandating 2FA get them any closer to that second point? If they wanted to start with that, they could. They're two separate issues.

The entirety of the last decade in open source software development can be summarized as this: it is morally reprehensible for your project to not support the causes du jour.

You must adopt a COC. You must rename your branch from "master" to "main". You must use "inclusive" language in your documentation.

Why? Because you must assume the responsibility for everything your project touches. A bad person uses your leftpad.js to perpetuate badness. You must stop them. Someone might get their feelings hurt. You must preemptively protect them.

This is an impossible task. 2FA is fine, sure. I use it myself, and advocate for others to do so as well.

But I'm sick and tired of the "harm reduction" mantra that means I have to entirely rewrite my documentation every 6 months.

If the last decade has been all about that, then clearly a 2FA mandate won't lead to it, since it's already here.

FWIW, I have multiple open source projects. I don't have a COC. I haven't renamed any of my branches. I haven't gotten any pushback.

Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense.

Look, publishing to PyPI is not a right. If typing 6 digits is too much burden you can drop a source tarball in some web page and call it a day, you don't have to go through PyPI. Done.

I, for one, I'm very very glad that a piece of _critical infrastructure_ that I depend on is a bit more secure.

> Dude, how did you go from 2FA for a Python package to Putin in a single sentence? This makes no sense.

The 2FA thingie is not implemented because of some random dude who might want to steal a bitcoin or two, is implemented against state actors. This being the US we're talking about (and the West more generally) the state actors taken into consideration are: China, Russia, Iran, probably North Korea (probably in this order). Hence my mention of China and Russia in my initial comment.

Reply on news.ycombinator.com