What do you propose? What would constitute a meaningful verification of identity that wouldn't create a near insurmountable hurdle for newcomers or those unable to travel?
GitHub could provide this as a service, perhaps using uploads of whatever state/national ID the user is coming from. Give a little 'verified ID' badge. All banks do things like this for new accounts.
Granted this doesn't stop state-actors, but it should be effective against cyber criminals.
I think a system where it was harder for unknowns/newcomers to contribute but had better security is a good tradeoff. Esp. since it is likely this incident is not unique.
https://www.bankid.com/en/foretag/secure-digital-identificat...
I think India has something similar?
Not sure if open source developers would be so keen on introducing requirements like that into the development process. Some developers want to keep a low profile and not reveal to much about their AFK identity. And nearly all tech for doing stuff like this is proprietary.
How are you going to verify a national ID? By taking a photo of it? What if the photo is edited? By somehow going to the maintainer in person and looking for anti-counterfeiting features in the paper? What if the ID is old enough that it predates these anti-counterfeiting features? Not all countries are Germany.
> or verification by an employer.
What if the maintainer is unemployed? What if the reason the maintainer has enough free time to maintain the package is because they're already retired, and living off their pension or investment returns?
> Both are ubiquitous
From what I've heard in the Internet, some large countries still don't have a national ID.
How many actually existing maintainers in particular of security sensitive parts of open source projects don't have at least some record of employment or education, a modern passport or national ID with eID features, some other comparable form of identification or at least say one reputable person in the community who can verify they are who they say they are?
Are we seriously pretending the standards that exist for ordering a beer in a bar can't be met for software security that literally billions of people depend on?
So just claim that you are verified by your employer? It's fairly easy to setup a web page for a non-existing company...