RubyGems.org MFA: The Past, Present and Future
summary
Accounts with compromised credentials like rest-client, Python's ctx, npm's ua-parser-js let attackers push malicious gem releases; MFA prevents 99.9% of account takeover attacks. Policy requires top gems by download threshold (notifications at 165 million downloads, enforcement at ~180 million), enforces UI+API OTP for privileged actions, adds scoped API keys and per-gem key toggles, plans security‑key support, and relies on a process for voluntary MFA resets. Shopify funds $1,000,000 over four years to support this work.
AI-written summary · about
chapters (12)
- 0:00RubyGems.org MFA intro
- 1:03Why MFA is critical
- 3:55Supply chain attacks
- 8:12How MFA prevents takeovers
- 10:42Creating MFA policy
- 13:12Key MFA design decisions
- 16:29MFA enforcement and API keys
- 19:21Seamless MFA adoption
- 22:15Community concerns
- 24:26Policy rollout status
- 25:53Future MFA plans
- 27:40Summary and call to action
