7

PyPi Mandates 2FA For Critical Python Projects – Developer Criticized

 2 years ago
source link: https://www.theinsaneapp.com/2022/07/pypi-mandates-2fa-for-critical-python-projects.html
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

PyPi Mandates 2FA For Critical Python Projects – Developer Criticized

PyPI, or the Python Package Index, is giving away 4,000 Google Titan security keys in its move to two-factor authentication (2FA) for critical projects built using the Python programming language.

The maintainers of the official third-party software repository for Python have begun imposing a new two-factor authentication (2FA) condition for projects deemed “critical.”

PyPi Mandates 2FA For Critical Python Projects - Developer Criticized

“We have begun to roll out a 2FA requirement: Soon, maintainers of crucial projects must be 2FA enabled in order to publish, update or modify them,” Python Package Index said last week in a tweet.

It added that the 2FA requirement covers any maintainer of a critical program (both ‘Maintainers’ and ‘Owners’).

Developers of critical projects that haven’t turned ON 2FA previously on PyPi will be offered hardware security keys free from the Google Open Source Security Team.

Developers Criticized PyPi And Pushed Back

Screenshot-2022-07-11-222303.png
Screenshot-2022-07-11-222328.png
Screenshot-2022-07-11-222404.png

PyPI is managed by the Python Software Foundation and houses over 350,000 projects. Over 3,500 of these projects are tagged with “critical” designations.

The repository maintainers state that any project that has accounted for more than 1% of downloads in the past 6 months is considered critical. This determination will be recalculated daily.

However, once a project is classified as critical, it’s expected to keep that designation indefinitely even if it falls off the top 1% of downloads.

This move is seen as an effort to improve supply chain security for the Python ecosystem. It comes after a series of security incidents that have targeted open-source repositories over the past months.

Bad actors stole NPM developer accounts last year to insert malicious code in popular packages “ua–parser-js”, “coa”, and “rc.” This prompted GitHub to tighten security at the NPM registry by requiring admins and maintainers to have 2FA starting in the first quarter of 2022.

PyPi stated that “Ensuring that most popular projects have these protections from account takeover is one of our larger efforts to improve security in the Python ecosystem for all PyPI user,”

Related Popular Stories:

Let's fix the way you consume content. Stay up-to-date, ahead of the curve, and get smarter every day. Don't wait, Download the app today! Reinvent the way you feed your curiosity!

Download App


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK