> One could imagine that an index would like to enforce cryptographic signing of newly released packages. Or the index wants to enable reclaiming of critical packages if the author does not respond or do bad things with the package. For instance a critical package being unpublished is a problem for the ecosystem. One could imagine a situation where in that case the Index maintainers take over the record of that package on the index to undo the damage. Likewise it's more than imaginable that an index of the future will require packages to enforce a minimum standard for critical packages such as a certain SLO for responding to critical incoming requests (security, trademark laws etc.).

And the fact that they are missing means the burden is on each and every user. Which means that the same work is repeated many times, if it is done at all. A large corporation can afford to sink bajillion dollars in making the supply chain ending at these language forges somewhat sane, but can the same be said for small companies and projects?

If one looks at recent happenings in the open-source world, that doesn't seem very far off at all. See for example this recent news item[1] in response to a call by people at Google for extreme measures including complete legal registration(!!!) of everyone working on software that *they* have happened to *decide* to use in a critical context[2].

[1] https://lwn.net/Articles/866909/
[2] https://security.googleblog.com/2021/02/know-prevent-fix-...

Posted Jul 11, 2022 14:38 UTC (Mon) by nim-nim (subscriber, #34454) [Link]

Ronacher: Congratulations: We Now Have Opinions on Your Open Source Contributions

The thing about the Security Keys, which PyPI doesn't make a big deal of in their announcement - but will be apparent to people who have them - is that they're _much_ less burdensome than approaches like TOTP as well as obviously delivering better security properties. You just tap the Security Key to have it signify that yup, you are still you, done. There are no codes to manually transcribe or copy-paste, there's no step where you, the poor human, are given responsibility for inhuman tasks like correctly matching text strings (is this lwn.net or lvvn.net? My typeface could make those look similar).

So this is actually much less friction (at least if you aren't Russian or otherwise unable to take advantage of their offer) than just switching on TOTP for these "critical" packages.

Suppose PyPI had decided to instead spend this money on having humans audit top-1% critical package changes. Briefly that's better, perhaps, than 2FA but I don't think the money would last long, and of course once the money runs out you go back to the same state as before.

It's actually disappointing to me that most organisations don't give these things (FIDO Security Keys) away, at my own employer I raised this, but it got shot down in a sort of "I don't understand why this is worth having" way that did not give an improved impression of senior management's security know-how. Actually all I wanted was the option to use the Security Keys I already own instead of TOTP, but they were resistant to that idea too.

Posted Jul 11, 2022 16:25 UTC (Mon) by NYKevin (subscriber, #129325) [Link]

Really, the question is: "Do you want to get panicked emails on weekends about this code, or do you want to let someone else sign up to get panicked emails about this code, or do you want to tell people not to use this code if they might write panicked emails?" These are all possibilities an original author might reasonably choose, and the choice should influence how the code gets used by other people and what policies get built around the project.

Posted Jul 11, 2022 18:16 UTC (Mon) by farnz (subscriber, #17727) [Link]

The problem right now is that various open source packages have evolved organically into packages that people rely on, and thus some developers are being told "hey, this thing you published? It's critical infrastructure now, and we need you to stop treating it like a spare time project and start treating it like something that we all depend on". And this is a problem, because some of those developers don't want to act like it's critical infrastructure - and definitely don't want to do that if they're not being paid for it - but if we simply rip their packages out of the ecosystem, we destroy the critical infrastructure.

I don't, by the way, have a good answer to this - there's lots of bad answers, but the fundamental is that we've taken dependencies in critical infrastructure on code that no-one is willing to maintain as critical infrastructure, and now we're paying the price of not thinking about maintenance of those dependencies up-front.

Ronacher: Congratulations: We Now Have Opinions on Your Open Source Contributions

Ronacher: Congratulations: We Now Have Opinions on Your Open Source Contributions

The cultural norms of "lone individual library marker" had their moment, but as the OSS community and stack matures, it's all about responsibility. Burden, if you will. A community of maintainers, with code review, etc is _so_ much better.

The current run towards 2FA fits that antipattern perfectly. Perhaps Google, Facebook et al are promoting it somewhat (or surfing on it, I don't know). After all, their business model relies on regarding people as cattle. Taking the individual person out of the security equation should be a significant cost-saver there.

Me? I think security *involves* people. First would be that each person understands their security situation as well as possible. Second, they decide whether they go with a 2FA dongle, an encrypted key file on their device or whatever else.

But then you can't regard them as cattle.