Fedora: 2FA, or not 2FA, that is the question
Fedora developers are debating whether to mandate two-factor authentication (2FA) for all package maintainers to improve security, with some arguing it would be overly burdensome while others see it as necessary to prevent account compromises that could lead to malicious code being pushed to users.
Background
- Fedora is a popular open-source Linux distribution (like an operating system) sponsored by Red Hat (IBM). The Fedora Project is run largely by volunteers.
- The article discusses a debate over requiring two-factor authentication (2FA) for Fedora contributors who can push code changes. 2FA adds a second check (e.g., a code from an app) beyond a password.
- The catalyst: Fedora recently had a security breach involving its infrastructure, prompting calls for tighter security.
- Some contributors argue mandatory 2FA would be a burden on volunteers and could drive away casual contributors. Opponents counter that the security risk to the broader Linux ecosystem is too large to leave optional.
- This mirrors similar debates in other open-source projects (e.g., the Linux kernel, npm) about balancing security with low-friction contribution.