PyPi Mandates 2FA For Critical Python Projects – Developer Criticized

2 years ago

source link: https://www.theinsaneapp.com/2022/07/pypi-mandates-2fa-for-critical-python-projects.html
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

PyPi Mandates 2FA For Critical Python Projects – Developer Criticized

Security

PyPI, or the Python Package Index, is giving away 4,000 Google Titan security keys in its move to two-factor authentication (2FA) for critical projects built using the Python programming language.

The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed “critical.”

PyPi Mandates 2FA For Critical Python Projects - Developer Criticized

“We have begun to roll out a 2FA requirement: Soon, maintainers of crucial projects must be 2FA enabled in order to publish, update or modify them,” Python Package Index said last week in a tweet.

It added that the 2FA requirement covers any maintainer of a critical program (both ‘Maintainers’ and ‘Owners’).

Developers of critical projects that haven’t turned ON 2FA previously on PyPi will be offered hardware security keys free from the Google Open Source Security Team.

Developers Criticized PyPi And Pushed Back

PyPI is managed by the Python Software Foundation and houses over 350,000 projects. Over 3,500 of these projects are tagged with “critical” designations.

The repository maintainers state that any project that has accounted for more than 1% of downloads in the past 6 months is considered critical. This determination will be recalculated daily.

However, once a project is classified as critical, it’s expected to keep that designation indefinitely even if it falls off the top 1% of downloads.

This move is seen as an effort to improve supply chain security for the Python ecosystem. It comes after a series of security incidents that have targeted open-source repositories over the past months.

Bad actors stole NPM developer accounts last year to insert malicious code in popular packages “ua–parser-js”, “coa”, and “rc.” This prompted GitHub to tighten security at the NPM registry by requiring admins and maintainers to have 2FA starting in the first quarter of 2022.

PyPi stated that “Ensuring that most popular projects have these protections from account takeover is one of our larger efforts to improve security in the Python ecosystem for all PyPI user,”

Related Popular Stories:

GitHub Attackers Stole Login Details Of 100K NPM Users

Pentagon: Hack Us And Get Upto $110,000

Web Inventor Says Screw Web3 – My Decentralized Internet Doesn’t Need Blockchain

Boycott GitHub Says Software Freedom Conservancy (SFC)

U.S. FCC Commissioner Says “Ban TikTok From Google And Apple”

Let's fix the way you consume content. Stay up-to-date, ahead of the curve, and get smarter every day. Don't wait, Download the app today! Reinvent the way you feed your curiosity!

Download App

Recommend

greyli.com 3 years ago
Cache

从国内的 PyPI 镜像（源）安装 Python 包

从国内的 PyPI 镜像（源）安装 Python 包发表回复不论是使用 pip，还是 Pipenv、Poetry等工具，安装 Python 包的时候会默认从官方的 PyPI 源下载文件，速度比较慢。国...

www.geeksforgeeks.org 3 years ago
Cache

How to Publish Python package at PyPi using Twine module?

Python is so flexible and easy to use because of its available packages that are hosted on pypi.org, Let’s see how to publish your own package on PyPi using Twine module.Requirements:

dev.to 2 years ago
Cache

How to create a PyPi (Python) package

Have you ever wanted to create a Python package so you can type the following? pip install my-awesome-package Enter fullscreen mode Exit fullscreen mode

arpitbhayani.me 2 years ago
Cache

Publish python package on PyPI

Publish python package on PyPIPyPI is the official Python Packages Index. Once you publish it on PyPI then it will can downloaded via a simple command pip install <package>. Life becomes simpler with this one line installat...

bbengfort.github.io 2 years ago
Cache

Packaging Python Libraries with PyPI

Packaging Python Libraries with PyPIJanuary 20, 2016 · 8 min · Benjamin BengfortPackage deployment is something that is so completely necessary, but such a pain in the butt that I avoid it a little bit. However to reuse co...