GitHub security improvements, shady vendor practices

And the first topic on our agenda is something that both of us, I think, is good news.

GitHub released... two changes last week, and I will say like kind of quietly released.

The only reason I knew that these had happened is because of other accounts that I follow.

I haven't seen GitHub be very loud about it.

I will talk about them one at a time, kind of in the order that I found out about them.

It's a slightly different order when they came out.

But the first thing I learned about is that NPM has added what they're calling preventative protection for high impact accounts.

And what that means is if one of these high impact accounts changes the email address associated with the account, there is an automatic or sorry, changes the email address or uses a 2FA recovery code.

The account is placed on an automatic 72 hour read only hold.

And an alert gets sent to the previous email address.

And what this does is this creates a mechanism when the maintainer gets locked out by a threat actor.

The threat actor can't actually do anything with the account.

So the things that they said in the announcement that they freeze are not an exhaustive list.

They're saying that it's security-related things.

Let me see if I can find the list.

Publishing.

managing tokens, changing package visibility, modifying org or team membership.

So all of that is frozen.

So this only applies to what they call high impact accounts, which they don't define in this blog, but from what I've heard kind of through other channels might be packages with more than a million downloads.

So, you know, very popular accounts.

And, you know, the goal here again, is to shut down one of the more common but not exclusive account takeover mechanisms.

So this is going back to, I guess, the human path being exploited.

If somebody gets locked out, for example, we saw a lot of those social engineering related attacks earlier and last year where the attacker would get a hold of something related to the maintainer's account.

For example, they might send them a phishing email or something like that.

They would use that to gain access, change the email, get them locked out, et cetera.