Again, this is not a dichotomy. It’s not because we have a more strict rule on who gets write access that we’re an “unwelcoming community”. It’s not because I can’t get commit access legally that I’ll “find someone else’s credentials”.
No one will “hack” someone else’s account to commit genuine code to LLVM, but it is not uncommon for hackers to introduce hidden code to harmless projects.
Revoking unused rights (partially or completely) is a fundamental part of risk mitigation. Open source projects are not immune to being targeted by rogue actors.
Totally agree. This is way more important than anything we’ve been discussing in this thread so far. It is, as I understand, the key motivation behind, but the direction we went was a red herring.
Not true. One of the points in the scorecard you pointed out is the “principle of least privilege”. Removing write access to all repos and make it granular, moving people as triage, separate releases from code all work towards that goal and are “more important” than removing old accounts, yes.
However, old accounts do have a higher risk of being misused by bad actors. Those emails may not exist anymore, the domain was hijacked by hackers after expiration, the authors don’t look at the messages anymore. All of those are very easy avenues into hijacking someone’s Github account.
Usually, when accounts are hijacked, they don’t do anything, just keep it dormant, until when they need it. If something happens later on, the author does not correlate the events.
This is much more likely to work on older unused accounts than people still working on Github repos. There was an incident where someone reported a leaked key. This is from someone who is monitoring emails and validating them. But we don’t know if the leaked key got used (unlikely, due to - I assume - early detection).
However, there could be any number of leaked keys from a number of old accounts, or previous domains hijacked and their accounts already in the hands of hackers and we don’t know.
Now, I don’t want to use falacies myself. This is not an argument for “slippery slope”, it’s not a “false dichotomy”, and I’m not advocating that we cull everyone because of it.
I’m just saying: removing old accounts “is one of the required steps” in cleaning up and strengthening our security. Just not the most effective one right now.
I still think that @hansw2000 original point to email people would work best for the forgotten accounts than any policy we have today, and will allow us to focus on the real problems, as exposed by @beanz score card point.
No one is doing that, as I explain above. It’s just the higher risk of silent hijacking.
