Hacker News Reader

Comment by noodlesUK | Hacker News Reader

I think that we should impose webauthn 2fa on all npm accounts as the only acceptable auth method if you have e.g., more than 1 million total downloads.

Someone could pony up the cash to send out a few thousand yubikeys for this and we'd all be a lot safer.

View on HN

Why even put a package download count on it? Just require it for everything submitted to NPM. It's not hard.

Because then it's extra hassle and expense for new developers to publish a package, and we're trying to keep things decentralized.

It's already centralized by virtue of using and relying on NPM as the registry.

If we want decentralized package management for node/javascript, you need to dump NPM - why not something like Go's system which is actually decentralized? There is no package repository/registry, it's all location based imports.

I don’t understand what benefits this kind of “decentralization” offers

Larger pool of people you can hack/blackmail/coerce into giving you access to millions of systems :)

Decentralized? This is a centralized package registry. There is nothing decentralized about it.

oh right, good point, I wonder when somebody will just sue NPM for any damage caused. That's really the only way we'll see change I think.

Download counters are completely useless. I could download your package 2 million times in under a minute and cause you to need the 2FA.

And true 2FA means you can't automate publishing from github's CI. Python is going the other direction. There is a fake 2FA that is just used to generate tokens and there is a preferential channel to upload to pypi via github's CI.

But in my opinion none of this helps with security. But it does help to de-anonymise the developers, which is probably what they really want to do, without caring if those developers get hacked and someone else uses their identity to do uploads.

Even the simplest "any maintainer can click a push notification on their phone to verify that they want to push an update to $package" would have stopped this worm in its tracks!

How would that work for CI release flows? I have my Rust crates, for example, set up to auto-publish whenever I push a tag to its repo.

PyPI already has this. It was a little bit annoying when they imposed stricter security on maintainers, but I can see the need.

Pypi did that, i got 2 google keys for free. But I used them literally once, to create a token that never expires and that is what I actually use to upload on pypi.

(I did a talk at minidebconf last year in toulouse about this).

If implemented like this, it's completely useless, since there is actually no 2fa at all.

Anyway the idea of making libre software developers work more is a bad idea. We do it for fun. If we have to do corporate stuff we want a corporate salary to go with.

Reply on news.ycombinator.com