Ross Gardler wrote on 12/13/15 1:01 PM: > Thanks Sam, wrt to MFA do we, as a community, feel that it is a > requirement for the GitHub experiment? For the record I do and I will > say as much in the report unless I'm corrected here.
Personally if Infra wants to require MFA, then I'm happy to require it, even if it means slight changes for people to be able to commit there. In many other places both policy-wise and action-wise we take great care to ensure the security and provenance of our code can definitely be tied to a specific committer. I don't see any reason to lessen that here, even if it requires the extra MFA setup dance for github's services. - Shane > > I'm other words, I assume we are not asking Infra to find another > solution. > Rosa > > > Sent from my Windows Phone > ________________________________ > From: Sam Ruby<mailto:[email protected]> > Sent: 12/13/2015 9:46 AM > To: Ross Gardler<mailto:[email protected]> > Cc: [email protected]<mailto:[email protected]> > Subject: Input for Whimsy board report > > Whimsy status: > > 1) New committer: Craig L Russell > > 2) New repository on GitHub: https://github.com/apache/whimsy > a) ASF hosted clone is not yet available > b) whimsical site (via gitpubsub) is not yet set up > c) auto deploy (also via gitpubsub) is not yet set up > d) updated VM (based on Ubuntu 14.04) is available, but set up is not > yet complete. > > 3) Development: > a) updates to ICLA-lint (clr) and public JSON data (sebb). > b) board agenda reminders is largely complete (rubys). > c) exploratory rewrite of secretary mail function has been posted in > a branch (rubys). > > 4) Issues: > a) some pushback on the infrastructure imposed requirement for > multi-factor authentication (MFA) to be enabled to use GitHub. This > requirement only affects Whimsy committers (people able to directly > push), not other contributors. The issue is that MFA isn't a per- > repository setting, but affects all access to GitHub. > b) incubator agenda reminders discussion appears to have petered out. > board agenda reminders discussion never quite got off the ground - > at least not on dev@whimsical; there was a brief discussion on > board@ > > - Sam Ruby >
