113
Would you trust an open source software maintained by a developer who you disagree with politically (or otherwise don't like the developer)? (sh.itjust.works)
submitted 1 year ago by to c/asklemmy@lemmy.world
104 comments fedilink hide all child comments
 

"Trust" as in: trust it enough to run it on your machine.

(And assuming that you can't understand code yourself)

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 year ago (5 children)

jdupes: it's great software. The author left GitHub not because of Microsoft, but because he refused to implement 2fa on his account, which GitHub made mandatory.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 7 points 1 year ago* (last edited 1 year ago) (2 children)

    Oh I would not trust software from a developer who does not understand the importance of MFA.

    I mean, there's probably nothing wrong with it, but that's such a basic security issue that I would have zero faith they built the rest right.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    Well, its importance is IMO overblown. MFA as it's usually implemented:

    • sms
    • email
    • TOTP

    Sms and email are not really secure and TOTP is basically just a second password except you don't use it directly, but use numbers derived from the password.

    The more secure alternatives (hardware keys) are really uncommon even among tech people, let alone the general population.

    Not saying I think it's useless, I use MFA everywhere (because two passwords are better than one) but all in all it's much less secure than people assume.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 year ago

    Granted the forms of mfa available without a hardware key are far from perfect. But they are better then no extra authentication method.

    A good plan violently executed now is better than a perfect plan executed next week

  • permalink
  • fedilink
  • source
  • parent