On Tuesday, September 6, 2022 Vitaly Zaitsev via devel wrote:
If
you want to enforce such a policy, find sponsors and buy devices for all
Fedora contributors.
I kind of agree with this. See what PyPi is doing[1]. I don't think anyone who
maintains one package should get one, but perhaps provenpackagers or those who
maintain more than X packages should be required to have *some kind* of MFA
enabled.
[1]:
https://pypi.org/security-key-giveaway/
--
Maxwell G (@gotmax23)
Pronouns: He/Him/His