GitHub Mandates 2FA and Short-Lived Tokens - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: September 23, 2025, 12:26:29 pm
content: https://thehackernews.com/2025/09/github-mandates-2fa-and-short-lived.html?QuoteDamm ... I'm using TOTP , and have no FIDO

author: jpanhalt
author_rank: Super Contributor
timestamp: September 23, 2025, 01:00:24 pm
content: A quick search of Google about using a Windows 7 machine with FIDO 2fa seems to indicate such users are screwed. Does anyone know for sure?

author: golden_labels
author_rank: Super Contributor
timestamp: September 23, 2025, 01:03:31 pm
content: The Hacker News didn’t made that clear enough, to put it lightly:the change is for the npm registry, not the GitHub service.

author: ataradov
author_rank: Super Contributor
timestamp: September 23, 2025, 05:06:20 pm
content: Yeah, it is strange to link to hackernews when the first link in the so called act of journalism links to the actual source that is much better written and does not really need clarification.They are doing this because NPM is under constant attack and code is pulled automatically from there.

author: bingo600
author_rank: Super Contributor
timestamp: September 24, 2025, 11:50:09 am
content: Quote from: ataradov on September 23, 2025, 05:06:20 pmSorry guyzz.I'm not into NPM development, and unfortunately just saw the main article on HN, and didn't follow sub-links.I mistook, after skimming HN the article that they would skip TOTP for all github access.I believed that it was worth notifying about a link the article here, to inform people about the new measures.Based on the above, and not having time to read all sub-links as i should have.I'll limit my postings in Security.

author: golden_labels
author_rank: Super Contributor
timestamp: September 25, 2025, 12:07:58 am
content: No worries. Nothing wrong on your end. You did fall victim to the journalist. I myself noticed something is off merely after I proceeded to writing a comment. Only then it hit me, that what I want to write doesn’t fit well with the view of GitHub I hold.Don’t make this mistake stop you from sharing in the future!That I pointed at the article being misleading, shouldn’t be taken as me finding Microsoft’s decision acceptable. The change affects only publishing in the npm repository, which makes it incomparably less impactful and not as easy to paint as unwanted.I’d argue it’s still a problem. A choice being rational is not the same as the choice being fine.(1)But whereas it was trivial to outline the trouble, where we were talking about the GitHub platform, now it’s much more hazy, a part of multiple larger issues.(1)Despite drawing such a connection is both a common mistake in reasoning and a rhetorical device.

author: ataradov
author_rank: Super Contributor
timestamp: September 25, 2025, 01:44:20 am
content: They are trying to address only one issue here, and the solution they propose will do that. There was a few attacks where developer's account gets taken over and malware is placed instead. Many of those repos are very old (7+ years) and developer may not be even there, but because of their age they are included in a lot of other stuff. Once a change is made, all other stuff is rebuilt, which amplifies the malware.This is going to be a bigger and bigger issue. Now that people figured out they can publish malware on Steam, there will be no end to that. And unless those games are virtualized somehow, I don't see a solution. Better isolation on the OS level can address some, but not all leaks.

author: Siwastaja
author_rank: Super Contributor
timestamp: September 25, 2025, 08:11:27 am
content: Central software/library databases where everybody pulls code should be difficult to use, so this time the change is good.Youalwayshave the option to publish your code elsewhere, and youalwayshave the option to pull the libraries you use from anywhere."Everybody getting the same library from the same place to do everything" is appealing, but colossally dangerous practice. The alternative, everybody using whatever libraries downloaded from whatever places carries different types of risks - maybe the risk is even bigger on average, but all eggs are not in the same basket, so large-scale disasters do not happen.Central repositories are obvious targets for very nasty large-scale attacks, and making them more difficult to use serves two purposes:- The obvious one of reducing number of such attacks- Making using them less appealing, which would be a sane thing to do. Developers overuse libraries, create over-dependent projects, and depend too much on single point of failures, all for the impression of "convenience".

author: golden_labels
author_rank: Super Contributor
timestamp: September 25, 2025, 10:46:41 am
content: “I don't see a solution.”— maybe it’s the result of seeing it as a technical issue or being constrained by assumptions?Instead, look beyond. Did you consider questioning the assumptions? Did you even realized there are any? Recognize this as almost entirely a societal problem. Its technical butt is relevant only to poor attempts in symptom management.⁂Siwastaja points to “centralized software/library databases.” Correct, but requires one more adjective. Let’s group such services into two categories.(1)They’re distinguished by the intent and management style:(2)Databases run with the primary intent to be useful to the community. Usually controlled by a team of people dedicated to that intent.Databases run with the primary intent to serve a business model based on aggregation. Usually controlled by managers focused on maximizing their usefulness to meeting business goals.Where is the difference? In the missing adjective; notice that generally one group iscurated, while the other one is not. This is not a coincidence. For an aggregation business to make good money, it must at the same time: collect possibly much work of others without paying them much (preferably nothing), and put possibly little effort into the process of collection and republishing. Curating content stands in striking opposition to both these requirements. You reduce inflow by one or two orders of magnitude (no moreis-odd), authors may demand some contribution (not necessarily financial, may be in coöperation), and the process of curating itself is costly (requires quality workers and a solid chunk of worktime).⁂This is one factor, but there is another one. You might’ve observed, correctly, that I skipped a large chunk of the databases landscape. Take for example (one of many!)AUR. Which is best described by the community’s own chatbot as“The trash heap of Arch. Dig around enough and maybe you will find some gold.”Accurately. And, while it’s being patrolled for problematic entries, Arch Wiki gives you a red warning box.(3)Basically anybody can publish in AUR, with no overview until a problem is detected, and with no particularly strong security being enforced on contributors. I argue it’s not an issue — and I’m not mad.For as long as history remembers,(4)humans had an important freedom. A freedom that is not only among the hardest to be deprived of, but through millennia its use was mandatory. That’s the freedom of choosing whom to trust. Almost every aspect of life required human interaction, demanded knowing and judging another person, and determining, if they’re worth of trust or not. Words “human interaction” and “knowing” are crucial here, remember them. While it may seem a dangerous approach, in many situations it didn’t change at all. Go to friends’ home for a dinner and whether you end up poisoned or not depends on your judgment.Since forever using that freedom included choosing suppliers of your food, people helping you to build shelter, tool makers if you needed them, shepherds if you owned a herd, cooks if you were rich enough to afford one. This did start to change in 19th century,(5)but a major shift happened in the late 20th and 21st centuries. In particular in developed countries and urbanized areas, the connection between suppliers and consumers (as human beings) weakened. In many cases it disappeared completely. You no longer interact with anybody, you no longer know anybody. The advent of the internet and giant platforms accelerated and exaggerated it even further: what people really “choose” is a photo and a few meaningless lines of marketing nonsense, which they can click or not. The entire “trust” part is gone, at best delegated to the worst possible agent: the platform.⁂The two issues support and mutually amplify each other. Making the mix worse than its ingredients. This mix is not rooted in technology or security. And, similar to how painkillers are not solving a decaying tooth, no amount of security juice is the right answer.⁂As for Microsoft’s decision, they’re pretty tame compared to others like Apple or Alphabet. Which of course is not ok, but also not something that can be ignored. In that matter Microsoft acted relatively user-friendly by relying on FIDO2. They might’ve demanded a custom smartphone app.(1)This isn’t a clear cut. Many instances don’t fit either of the groups. No need to remind me of that. It’s meant to draw an image. To not be accused of being blind, examples: PyPi on one end, Microsoft’s own winget on the other.(2)But not funding or theresultingprofit. While there is a very strong correlation, neither is important for this picture.(3)“AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.” —AW: AUR(4)From observation of surviving primitive tribes and other hominids we may conclude it’s much longer than that.(5)One might argue that it’s 15th century or even earlier. Perhaps true, but that early only very, very few people would be affected.