Repository / package admin tasks

[broofa]

Capturing some housekeeping tasks for project owners:

• NPM: Require 2FA for all package owners
• NPM: Add ctavan as owner
• Github: Require 2FA for all members of Kelektiv org (@defunctzombie, is this enabled?)
• Github: Rename repo to "uuid" (@broofa)
• Github: Update repo URL in package.json (@broofa)

[ctavan]

@broofa what's the status on this? I was trying to set up browserstack-based testing through Travis.ci but it seems that I'm lacking permissions. Maybe I need to get admin permissions on this repo in order to do this? Would be great to get this solved so I can move forward with the modernization of this library.

[broofa]

'Promoted you to 'admin' here. See if that fixes the problem.

[ctavan]

@defunctzombie how about 2FA for the kelektiv org? Could you also help me understand what the kelektiv org is and who the members are?

[defunctzombie]

@ctavan @broofa require 2fa is not currently enabled. Would you like me to enable it? When I enabled it everyone in the organization must have 2fa on their account or they will be removed from the organization.

@ctavan kelektiv was created by @ncb000gt as a way of grouping a few commonly maintained and popular modules under an organization rather than a single personal account. Organizations make it easier to manage users as folks come and go.

If there is a better organization to group these under I certainly would not object.

[broofa]

It looks like the kelektiv org consists of just the three of us, right? So... yeah unless either of you two have a reason not to, let's turn on 2FA. I know it's not required, but it's the responsible thing to do.

Regarding what kelektiv is and what the right home for uuid should be, if there's a more suitable organization I'm fine with that. I don't have a specific suggestion there, but how/where to host a long-lived, popular module responsibly is an interesting question. Let me reach out to a couple people and see what they suggest.

[ctavan]

+1 for 2FA

Regarding the org: thanks for the clarification! I did not mean to question whether the current org was a good place for this library, I was just curious.

The only thing that confused me a bit was that the member list of the kelektiv org does not seem to be public. Especially for security related OpenSource projects I would personally prefer to see more transparency in the orgs that effectively control the source code.

@defunctzombie @broofa would it be an option to make the kelektiv member list public as a quick win?

In addition to that I‘m with @broofa in that I find it interesting to reconsider what org would be suitable for very long lived libraries where the set of active maintainers changes over time. I don’t believe that this is an urgent question though.

[broofa]

+1 for making org membership public

[ncb000gt]

@defunctzombie is correct. I had a baby on the way, my second, at the time with a bunch of other obligations and management of the different projects was getting tougher from my personal account. So I looked at moving bcrypt and cron to other projects but it was clear that wasn't going to work out. Thus, kelektiv was born.

I agree with the points about transparency in oss. And, that security should be a top concern. I'm ok with making the member list public and with 2fa so long as everyone else is.

Thanks for bringing this up.

[ctavan]

OK, I think we have votes for:

2FA: @broofa @defunctzombie @ncb000gt @ctavan ✅
Member list public: @broofa @ncb000gt @ctavan ❓

As I have no visibility (yet) into the current member list, could one of you check, if there are additional members that need to be asked?

@defunctzombie fine with public membership as well?

[defunctzombie]

@ncb000gt and @wercker (a bot?) need to enable 2FA on their accounts. Once they have done so I can enable 2FA.

Membership in an organization is a per-user setting. Each person can decide if they want to make their membership public or not. This is personal preference.

[ctavan]

@defunctzombie I'm aware that org admins can specify org visibility for each member separately however I haven't found a way how I could control that on my own for orgs where I'm member but not admin. Where would I change that visibility?

If it turns out not to be possible for group members to control that on their own could you adjust the corresponding settings in the org for all of us?

[defunctzombie]

@ctavan Each user must manage their own visibility. See this guide https://help.github.com/en/github/setting-up-and-managing-your-github-user-account/publicizing-or-hiding-organization-membership

[ctavan]

Oh ok, so does that mean I'm not a member of the org at the moment?

[ncb000gt]

I've updated my 2fa (had turned off to test some things) and made my membership public. Thanks for the reminder.

…

On Sun, Dec 8, 2019, 2:14 PM Christoph Tavan ***@***.***> wrote: Oh ok, so does that mean I'm not a member of the org at the moment? [image: Screenshot 2019-12-08 20 13 51] <https://user-images.githubusercontent.com/508118/70394650-4dbbef00-19f7-11ea-8187-063068ed168c.png> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#338>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAPJFZVDLCZQOERQUVV6ZDQXVBRRANCNFSM4JCNOIPQ> .