{"id":19573,"date":"2022-07-12T06:10:21","date_gmt":"2022-07-12T14:10:21","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/07\/12\/news-13306\/"},"modified":"2022-07-12T06:10:21","modified_gmt":"2022-07-12T14:10:21","slug":"news-13306","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/07\/12\/news-13306\/","title":{"rendered":"PyPI starts rolling out required 2FA for important projects"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Tue, 12 Jul 2022 13:35:15 +0000<\/strong><\/p>\n

The Python Package Index (PyPI) says it has begun rolling out a two-factor authentication (2FA) requirement<\/a> which enforces maintainers of critical projects to have 2FA<\/a> enabled to publish, update, or modify them. PyPI plays an important role in the Python developers’ ecosystem.<\/p>\n

Python repository<\/h2>\n

PyPi is the<\/em> repository of software for the Python programming language. Python is a high-level, interpreted, general-purpose programming language. And it is a very popular language often used on servers to create web applications.<\/p>\n

Many web developers, and others, use Python packages or add-on libraries from other developers as building blocks to develop their own projects. The Python Software Foundation (PSF) manages the PyPI repository where Python developers can get third-party developed open-source packages for their projects.<\/p>\n

Critical projects<\/h2>\n

The projects rated as critical by the PSF are those that are in the top 1% of downloads. Maintainers of such projects should have received an email about the new requirement. The requirement will go into effect in the coming months. Based on the 1% rule, over 3,500 projects have received the critical designation.<\/p>\n

The good news is that every project has the option to set 2FA as required. And, to ensure that maintainers of critical projects have the ability to implement strong 2FA with security keys, the Google Open Source Security Team has provided a limited number of security keys to distribute among critical project maintainers.<\/p>\n

The reason<\/h2>\n

As you can imagine, unauthorized access to a project that many other depend on opens up the possibilities of a software supply chain attack. So, introducing the 2FA factor for critical projects decreases the possibility that someone might introduce malicious code into a popular project.<\/p>\n

We have all seen the problems with Log4j<\/a>. For those that missed it, Log4j is an open source logging library written in Java developed by the Apache Software Foundation. Millions of applications use it, and some of them are enormously popular, so the potential reach of this problem turned out to be enormous.<\/p>\n

A similar problem that remains unresolved by these new requirements is the use of packages which are purposedly named after popular projects to confuse users into downloading a malicious version<\/a>.<\/p>\n

Mixed feelings<\/h2>\n

As you would expect on Twitter, there are some mixed feelings among those impacted by this new requirement. Ranging from developers saying goodbye to their popular project to those wondering why 2FA wasn\u2019t already mandatory in the first place.<\/p>\n

For all those with unanswered questions, PyPI has put up a FAQ about the 2FA implementation, along with the key giveaway<\/a>.<\/p>\n

The post PyPI starts rolling out required 2FA for important projects<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Pieter Arntz| Date: Tue, 12 Jul 2022 13:35:15 +0000<\/strong><\/p>\n

PyPI is rolling out a 2FA requirement for maintainers of critical projects. <\/p>\n

The post PyPI starts rolling out required 2FA for important projects<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10598,24553,26929,26930,1804],"class_list":["post-19573","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-2fa","tag-log4j","tag-psf","tag-pypi","tag-reports"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=19573"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19573\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=19573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=19573"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=19573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}