There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

0x2d ,

comic sans

SubArcticTundra OP ,
@SubArcticTundra@lemmy.ml avatar

Coding instantly feels more fun

0x2d ,

comic code

Kolanaki ,
@Kolanaki@yiffit.net avatar

2FA is enshittification now?

I mean… I guess in a way it is a symptom of it, if you consider the growing concern of hacking part of enshittification and this, a method of stopping or at least slowing an attack down, being a product of that.

It’s more of an anti-enshittification device that just comes with a slight bit of shittiness in the form of another step to logging in.

SubArcticTundra OP ,
@SubArcticTundra@lemmy.ml avatar

Yeah, it just winds me up when sites impose these bits of shittiness on you without allowing you to opt out. Because I was happy to sacrifice a bit of my account’s security for convenience

ignotum ,

Keepass (open source password manager) can auto-fill not just username and password, but also generate and fill in one-time codes

Reduces the security the 2FA provides, but after i started using that it was pretty much zero extra effort to log in

planish ,

It isn’t enshitification in the sense of trying to make the platform make money, but it is throwing up new roadblocks in the way of using the platform. It makes it harder to just show up, register, and post code. It creates multiple tiers of users who have different privileges on the platform. And from here it would be easier to move to, with some of the same justifications, some sort of requirement to pay for code hosting.

hanna ,

I was more annoyed at the ssh key requirement lol, I know it’s more secure etc etc but im not working on anything sensitive, it’s just annoying

SubArcticTundra OP ,
@SubArcticTundra@lemmy.ml avatar

Yeah exactly, this is what I mean. I still haven’t figured out how to set that up so I have to paste the key in from my password manager every time I want to push. I hate when they paternalisticly decide what ought to be best for me

jet ,

Not sensitive for you. But GitHub has started to look at supply chain attacks. So I’m popular module which isn’t very sensitive is used biological projects that are. The account that maintains the module is exploited and that causes lots of havoc

lemann ,

Please make a U-turn at the next junction and follow all signs to !unpopularopinion

SubArcticTundra OP ,
@SubArcticTundra@lemmy.ml avatar

I was actually considering posting it there at first. Would have fitted there better it seems

Spliffman1 ,
@Spliffman1@lemmy.world avatar

This is not enshitification in any way, shape or form

cooopsspace ,

/thread

solidgrue ,
@solidgrue@lemmy.world avatar

2FA on a major code supply chain is the antithesis of enshitification.

bilb ,
@bilb@lem.monster avatar

I don’t think so. Enforcing two-factor auth to be allowed to do certain things with an account just makes sense. It’s definitely not an attempt to squeeze profit out of users per se, but rather an attempt to limit liability and the risk of costly support problems caused by passwords being compromised.

mp3 ,
@mp3@lemmy.ca avatar

I think it’s even more important with contributors of large projects and libraries used by a vast amount of software out there.

It’s not inconceivable that someone’s account gets hijacked, and someone uses their trusted account to add a small snippet of malicious code in a commit, enabling a supply-chain attack.

despotic_machine ,
@despotic_machine@lemmy.world avatar

deleted_by_author

    •
    ScaredDuck ,

    Sorry but what’s the problem? Just use a TOTP authenticator, they work completely offline and are even more secure than SMS 2FA. For Android I would recommend Aegis.

    despotic_machine ,
    @despotic_machine@lemmy.world avatar

    deleted_by_author

    •
    jet ,

    you can use totp on your computer, bitwarden does it just fine from the desktop

    ScaredDuck ,

    For a completely offline solution KeepassXC also can do TOTP.

    Underuse3862 ,

    Yubikey is another offline option. It also has a TOTP app that runs on Windows/Mac/Linux for anything that doesn't support security keys.

    pgetsos ,
    @pgetsos@kbin.social avatar

    There are many options for a PC application as well

    Doug ,

    Is it requiring a cell for being the 2fa piece? I don’t use GitHub but I’d be surprised if they did. There’s been plenty of options for a while now. Email, authenticators, u2f keys. You should be able to enable 2fa that will use the same data you’re using to access GitHub.

    despotic_machine ,
    @despotic_machine@lemmy.world avatar

    deleted_by_author

    •
    jet ,

    you can get a google voice number and use it on your computer.

    You can get a fido physical key, then you don’t need email or sms at all.

    breadsmasher ,
    @breadsmasher@lemmy.world avatar

    use an authenticator app?

    despotic_machine ,
    @despotic_machine@lemmy.world avatar

    deleted_by_author

    •
    breadsmasher ,
    @breadsmasher@lemmy.world avatar

    What about something like a YubiKey?

    0110010001100010 ,

    Was going to suggest this. Github even has native support for them so you just plug it in and touch the gold pad for your second form. Even easier than a TOTP code.

    auxim ,

    Could Authy be of use for you perhaps? It seems like they have a desktop app, although I have no personal experience with it. Alternatively, GitHub supports the use of Security Keys which are physical devices that you can purchase for 2FA purposes, Yubico works great in my experience but there are other manufacturers, or even DIY solutions.

    lemann ,

    If you use Linux by any chance, there’s a totp Authenticator app on Flathub.

    There also might be an Authenticator app available for Windows too but I haven’t looked into any for it

    roadkill ,

    deleted_by_author

    •
    cooopsspace ,

    Perfect candidate for a Ubikey, you get mail right? Buy two. One for the safe.

    Trainguyrom ,

    I’ve had 3 jobs in a row require Duo and all 3 were companies that invested heavily into being remote/hybrid and are based in farm communities. I don’t think 2FA is going to be a problem for you unless you make it a problem for you

    pikasaurX4 ,

    Which part of this is infuriating you? The fact that a message is popping up or what it’s asking you to do? Or is it the fact that it’s all in comic sans? Honestly, 2FA is a really simple way to greatly improve security on your account. I’m no expert, so maybe it’s got major flaws that I don’t know about, but just set it up really quick and choose to remember your device. Now you’ll never need to worry about it and you won’t see this message

    scrubbles ,
    @scrubbles@poptalk.scrubbles.tech avatar

    I’ve had numerous accounts of people getting my password through a breach or something and 2fa being the only thing that stopped them from getting into my account. On GitHub that’s my strongest logins, don’t know why anyone would be against securing their code

    Rhaedas ,
    @Rhaedas@kbin.social avatar

    Unless you use a VPN/browser security addons (don't know which breaks it). The "register your device" has never stuck for me. But it's not a big deal even then, just another step as long as there are a few options to choose in case one method isn't possible at the time. The "are you a robot" ones though...I really need to get a bot to solve the ones that still pop up for me (definitely VPN).

    SubArcticTundra OP ,
    @SubArcticTundra@lemmy.ml avatar

    Hmm that’s true, I suppose it only needs to happen every time you log in on a new device

    SubArcticTundra OP ,
    @SubArcticTundra@lemmy.ml avatar

    I think what’s infuriating me is that it’s an inconvenience that’s being paternalisticly imposed on me. That’s what makes it feel like enshittification. I don’t really care that much about the security of my account, and having to find my phone and wait for an app to open is just a hassle that I’d prefer to avoid. The fact that they unilaterally decided what ought to be best for me is what annoys me I guess.

    jet ,

    This really isn’t enshittification. Things are not being made worse just to drive someone else’s profit. There isn’t the big fido2 key lobby pushing this in the background. This is a security measure to improve security on a highly technical website that is the target of lots of attacks.

    Its annoying and inconvenient, sure, but not making a service worse to drive profit.

    Doug ,

    Lot of comments here with single down votes. I wonder how salty op is

    jet ,

    Dead Sea levels…

    Microsoft / Github do a ton of shitty things, straight up enshittification textbook stuff… spoiled for choice really… just not 2fa.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • [email protected]
  • lifeLocal
  • goranko
  • All magazines
    •