Jonathan,

Your perspective on costs seems extremely developed-country-centric, and I'd like to suggest you check your (financial) privilege. I don't know where you're from; I'm from the US, but I am well aware of the reality of many open source contributors from countries where the exchange rate against the US dollar is awful.

You may not see this sort of cost as a barrier to contribution, but I can assure you that other casual contributors may, and likely would. You have to realize that the cost of the token isn't necessarily the only factor that contributes to the overall cost of obtaining such a device. International shipping costs can easily triple this dollar amount, to say nothing of other associated costs such as import duties, etc. There are plenty of countries where such tokens are not domestically available, and must be shipped from abroad.

This just isn't as simple or straightforward as you seem to want it to be. Erecting financial barriers to contribution is dangerous, and has unintended consequences.

Respectfully,
Alex Perez

Jonathan Wright via devel wrote on 9/6/22 2:14 PM:


On Tue, Sep 6, 2022 at 3:52 PM Vitaly Zaitsev via devel <devel@lists.fedoraproject.org> wrote:
On 06/09/2022 19:49, Michael Catanzaro wrote:
> Of course, hardware authenticators would be even more secure, and it
> sure seems pretty reasonable to expect that people with commit access to
> Fedora packages are able to purchase a $25 or 30€ security key [1][2].

Having to pay even $25 for a hobby project is not acceptable, IMO. If
you want to enforce such a policy, find sponsors and buy devices for all
Fedora contributors.
Fedora must be looked at as more than just a "hobby project" even though it is a hobby for some.

It's an OS that many rely on and $25 is a somewhat trivial cost for improved security.

With your suggestion of sponsors to cover such devices - how does that work for new packagers?  It seems pretty impossible to do such a thing and tons of money would simply be wasted on packagers that did very little to nothing after becoming a packager.

--
Sincerely,
   Vitaly Zaitsev (vitaly@easycoding.org)
_______________________________________________
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue


--
Jonathan Wright
AlmaLinux Foundation
Mattermost: chat


_______________________________________________
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue