Making popular Ruby packages more secure

This is great news! I like how the article cites evidence that MFA is disproportionately effective against account takeover.<p>If the rubygems devs are looking for other highly effective wins against supply chain attacks: I think the next thing is deeper support for lockfiles. Although Ruby has Gemfile.lock, it&#x27;s not a true lockfile in the same way that package managers in the javascript&#x2F;go&#x2F;python ecosystems are. Specifically, locking versions is optional, there&#x27;s no locking by hash (Github issue: <a href="https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems&#x2F;issues&#x2F;3379" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems&#x2F;issues&#x2F;3379</a>), and there&#x27;s no capability to lock local or source-only dependencies by hash. By comparison: go modules, pipenv, npm, yarn, nuget, composer, and gradle already support locking by hash.

This is a great first step to making dependencies more secure in the Ruby ecosystem. Congrats to the whole team for getting this done!

I applaud the move in the right direction, but please add support for webauthn. OTPs are really inconvenient in comparison.<p>It looks like maybe it&#x27;s been in flight for a while? <a href="https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems.org&#x2F;pull&#x2F;2108" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rubygems&#x2F;rubygems.org&#x2F;pull&#x2F;2108</a>

I really wish more package managers added support for OIDC based authentication+authorization for package publishing. PyPi has an ongoing PR for this: <a href="https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;10970" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pypa&#x2F;warehouse&#x2F;issues&#x2F;10970</a> with some really great UX. You specify a repository name on GitHub and GitHub actions there get publishing rights automatically.<p>While 2FA is good, having a purpose limited JIT token for publishing packages is what will actually reduce risk. Otherwise, as it stands - PATs leaked from one project can be used across any of your other packages on all package managers.

Fantastic work by the RubyGems maintainers. Congratulations on the rollout, and please consider WebAuthn support in a future iteration!

As part of a team of maintainers of a popular (declining) gem, shame they don&#x27;t make a mention of the extremely valid &quot;gem is owned by a team, and anyone may push&quot; model. I regret that the MFA token for many gems such as this may end-up in 1Password or similar, shared, along side the other credentials, rather than on a separate device or similar.

Throwing the black hat on for a moment surely I would just move towards the subdependencies of these popular gems (which realistically is where you would be targeting anyways I imagine) and can fairly reliably expect that my malicious changes get picked up upstream in due course.<p>Am I missing something here?

Anyone know what happens to the people who won&#x27;t activate MFA within the time-period? I&#x27;m guessing they&#x27;ll be unable to publish, but still be able to login to their account to setup MFA, even after MFA started to become mandatory?

Does MFA exists to force people to have&#x2F;carry all the time smart phones or there&#x27;s a way to use it without a phone? I mean in practice for repositories like npm or rubygems?

How about cryptographically signed packages as the next step? It boggles my mind that most popular package managers like npm, pip and cargo don&#x27;t have verification of package authenticity before installing built in.