TheBrokenRail

> Forgejo in particular has self-hosted actions runners that can be registered offline, and the runners themselves can be given labels and execute most existing GitHub actions (in fact, the yaml format they use is intentionally meant to be compatible with GitHub actions).

This is also part of Gitea. Which makes since because Forgejo is a soft-fork of Gitea.

IIRC people actually tried to get rid of that. Thankfully it failed.

I hate these 2FA mandates. I don't use PyPI, but I do use GitHub, which has also announced a 2FA mandate.

I use my GitHub account to make bug reports, small pull requests, and silly personal projects. It is not that important. I want to sacrifice security for convenience on it, and that should be my choice.

I also do not agree with the argument this secures the supply chain because:

1. It ignores supply-chain attacks from people who already have repository access.

2. Most big companies (ie. Google) are probably already using 2FA.

3. And if people are automatically pulling code from random people/groups without checking it... maybe that's what actually needs to be banned.

And that's what I deserve for not reading the entire page. Thanks for the correction.

Firefox doesn't allow users to install unsigned extensions unless they use a beta version, because users apparently can't be trusted to install software. I trust Mozilla to fight for privacy (they're great at it), but I do not trust them in the slightest to fight for user freedom (like accessing banking sites on an "insecure" OS).

This is really minor compared to other parts of Firefox. Notably, Firefox requires all extensions to be signed by Mozilla.

And the only way to turn that restriction off, is to either use Firefox Nightly or Firefox Developer Edition (which is a beta). If you want to use stable Firefox, because you like having a stable web browser, you just can't turn the restriction off. Period. The closest thing you can do is installing it as a "temporary extension" which uninstalls itself when the browser restarts.

It's kind of ridiculous that the default browser of most Linux distros has a Apple-esque mentality of "we get to tell you what you're allowed to install."