Skip to main content

On Sale: GamesAssetsToolsTabletopComics
Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
TagsGame Engines

Gitlab just like github is trying to require/mandate 2fa

A topic by GodwayGames created Aug 27, 2025 Views: 193 Replies: 2
Viewing posts 1 to 2
(+2)

https://about.gitlab.com/blog/secure-by-design-principles-meet-devsecops-innovat...

The problem with 2fa is that it has a long history of being used by dataminers and bad faith actors. it can also and frequently does result in account lockouts. I do not care what some random security organization (CISA) that I've never interacted with has to say, developers shouldn't have to worry about 2fa/mfa and it should never be mandatory. you the developer should have the right to protect your code how you see fit, especially if you paying for CI/CD services. Github has already done this before gitlab and it has ended poorly for many developers, it is one of the reasons I left github to begin with. I know a lot of you are developers who might also use these tools and you deserve to be made aware. 

(+3)

You know it's funny; when 2FA first came out, I though "Oh, ok, I guess that makes sense." It was largely voluntary at first, passwords were easy to brute-force or social engineer (especially MOST people's passwords), and it seemed like a reasonable option for highly important things like bank accounts. 

Now, with everything going on, it's clear, like all the rest, that it's just about control. 2FA is laughable when it comes to "security", you can just social engineer your way around it like anything else, and many groups do (to say nothing of all the games you can play with sim cards). But that was never the point. The point was to lock everything down, make everyone identifiable, trackable, etc. And they've done a wonderful job! Basically every major service on the net now requires you to hand over your phone number, which is effectively an ID. Email, youtube, social media, discord, on and on. For "security". Sure.

Remember AIM? Yahoo messenger? Remember when you could just talk to people without the government demanding a vial of your blood and hair samples? Same with forced age check IDs, same with OSes now requiring TPM on the motherboard, Android locking out all apps unless their devs come scraping, begging Google for permission to exist. It's become clear that ownership and anonymity, even the slightest little bit of privacy, are going to be totally unacceptable in the new world that's being built. You don't own your phone, your computer, your car, your tractor. Big corpos do. You draw breath only by their grace, and only with their permission, which can be revoked instantly, without warning or reason. 

What to doooo?