RubyGems
Would Rubygems like some free MFA tokens from GitHub/Google via OpenSSF? #5170
Replies: 5 comments 2 replies
-
|
Hello! That's really nice offer. I'm moving this to discussions since it is not "bug report" we use GitHub issues for. |
Beta Was this translation helpful? Give feedback.
-
|
@david-a-wheeler Thanks for your offer. I will coordinate your offer to rubygems and bundler dev team. |
Beta Was this translation helpful? Give feedback.
-
|
@david-a-wheeler I send a list of our offer list. Can you confirm it. Thanks.. |
Beta Was this translation helpful? Give feedback.
-
|
Confirmed! And my thanks to EVERYONE, there are a lot of people who depend on your projects. Expect an email in the next few days with the details. |
Beta Was this translation helpful? Give feedback.
-
|
@david-a-wheeler Thanks for your arrangement. We could order them. |
Beta Was this translation helpful? Give feedback.
-
|
We got our tokens. Thanks so much, closing! |
Beta Was this translation helpful? Give feedback.
-
|
Got one also! Thanks! |
Beta Was this translation helpful? Give feedback.
-
Hi! I work with the Developer Best Practices Working Group of the Linux Foundation's Open Source Security Foundation (OpenSSF) "Great Multi-Factor Authentication (MFA) Distribution Project".
We'd like to give your project free MFA hardware tokens from Google and GitHub, for use by your maintainers. We'd especially like to give them to any of your maintainers who aren't already using any. Our goal is to help improve the security of open source software (OSS)/Free Software projects. For example, these tokens can counter attacks that release source code updates and/or packages using stolen passwords.
By 2021-12-20 and preferably much sooner, please let me know:
We would send you coupon codes and validation codes to the private email address. You would then distribute those codes to the maintainers you choose. The recipients would use the coupon codes and validation codes to "buy" the tokens from the Google Store and/or GitHub Shop, who would ship the tokens directly to recipients. These codes are use-once, so make sure you can keep the codes private until they're used by the intended person.
Important: The Google coupon codes must be used by 2021-12-31 on the Google Store or they expire.
How can you trust us? You don't need to. You would get the MFA tokens from Google and GitHub; we're simply offering codes to make them no-cost. We'll provide some documentation on how to use them, but you don't need to use our documents.
To qualify, each token recipient must:
We also need each project that receives coupon codes and/or validation codes
to tell us these numbers (preferably within 30 days of getting the codes):
We ask for this information so we can tell others some simple measures of success. We don't need nor want the names of any individuals participating. It's fine to ask the people who got the codes for that information and provide a best-effort summary.
The MFA tokens are shipped from the US. They can be shipped internationally, but there are various limitations on where each can be shipped.
In particular, we can't ship somewhere if that is forbidden (sanctioned) under US law. So at this time we are unable to ship to individuals in China, Afghanistan, Russia, Ukraine, North Korea, Iran, Sudan, and Syria. Sorry about that. See the Google and GitHub sites for more shipping information. More sanction information is available.
For more information including how-tos and other setup information can be found at the "Great Multi-Factor Authentication (MFA) Distribution Project" site.
Beta Was this translation helpful? Give feedback.
All reactions