"Critical" projects and volunteer maintainers [LWN.net]

"Critical" projects and volunteer maintainers

Posted Aug 1, 2022 13:54 UTC (Mon) by atnot (guest, #124910)
In reply to: "Critical" projects and volunteer maintainers by LtWorf
Parent article: "Critical" projects and volunteer maintainers

> they still require a credit card number to be inserted to accept the order

Other issues aside, I am continuously annoyed by how often US tech companies just assume that everyone must own a credit card. They are not nearly as prevalent or necessary in the rest of the world. I have personally never owned or had the desire to own one, does this really disqualify me from having a popular PyPI library now?

to post comments

"Critical" projects and volunteer maintainers

Posted Aug 1, 2022 15:19 UTC (Mon) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

> They are not nearly as prevalent or necessary in the rest of the world. I have personally never owned or had the desire to own one, does this really disqualify me from having a popular PyPI library now?

No, most places which require it accept a debit card just fine.

"Critical" projects and volunteer maintainers

Posted Aug 1, 2022 16:09 UTC (Mon) by atnot (guest, #124910) [Link]

To clarify, by "Credit Card" I mean what vendors usually mean, which is a card number, expiration date and three digit CVC that is valid with Visa, Mastercard or American Express. These technically come in debit and credit card varieties, but I own neither of those things. I do have an account number with a local mutual bank, but the only thing you can do with that is perform a wire transfer. It's (and trust me from experience there) not something some random website online is going to understand and it's certainly not going to be able to perform any checks on it, whatever they are.

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 13:17 UTC (Wed) by LtWorf (subscriber, #124958) [Link]

Google didn't accept my debt card. It wanted specifically a credit card.

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 15:03 UTC (Wed) by LtWorf (subscriber, #124958) [Link] (3 responses)

> I have personally never owned or had the desire to own one, does this really disqualify me from having a popular PyPI library now?

It disqualifies you from receiving the USB tokens from google. They are only shipped to a very very small list of countries (Austria, Belgium, Canada, France, Germany, Italy, Japan, Spain, Switzerland, UK, USA).

Everyone else must set up 2FA with an authenticator app on the phone.

I plan to try and save the seed and use oathtool to generate the code.

"Critical" projects and volunteer maintainers

Posted Aug 3, 2022 18:01 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

> I plan to try and save the seed and use oathtool to generate the code.

This is exactly what I do. My phone has precisely zero OTP secrets (other than the SIM card for the SMS-based ones…which is at least better than nothing).

"Critical" projects and volunteer maintainers

Posted Aug 4, 2022 3:37 UTC (Thu) by pabs (subscriber, #43278) [Link]

If you are using the 'pass' password manager, there is an pass-otp extension for OTP secrets and the Browserpass web extension has support for both plain pass secrets and and pass-otp OTP secrets. Extracting the OTP seeds from QR codes is possible using other software, although most TOTP supporting sites give you the secret in plain text initially.

https://github.com/tadfisher/pass-otp
https://github.com/browserpass/

"Critical" projects and volunteer maintainers

Posted Aug 4, 2022 6:12 UTC (Thu) by jem (subscriber, #24231) [Link]

What's the problem? Google is a big company which has a functioning web store selling lots of hardware all over the world. So why not this item?

Oh well, there are always competing security keys like the YubiKey.