The RFC to require MFA on accounts that own a gem with over 180 million downloads has been accepted and currently is being rolled out 🎉 In the last section of the RFC, it stated that

Once the rollout of the top 100 most downloaded gems is successfully rolled out, a similar rollout will be done for more gems. The details of this phase will be fleshed out in another RFC.

This issue is being opened to create a discussion on how we should implement this phase in the current MFA rollout! The ideas formed here will guide what will be drafted in a formal RFC.

Topics to discuss

• What metric should the rollout be based on? Based on discussions on the original RFC, there seems to be two possible solutions. Open to other ways we can approach this.
  • Dependency chain popularity. Popular gems’ transitive dependencies would require MFA
    • How is this going to be calculated? Number of dependents?
  • Total download count
    • Decrease the current require MFA threshold to desired threshold
• How many gems/accounts should have MFA required? All gems? Exclude personal projects as they won’t be a part of any supply chains?
  • From the original RFC, “We don't need to enfor[c]e mfa on gems if they are just personal projects. Anything below 20k downloads would fall this category for me (includes 83% of gems)” (ref)
• number of rollouts or cohorts

Other package ecosystems

Npm has rolled out the following policy:

In February we enrolled all maintainers of the top-100 packages on the npm registry in mandatory 2FA, and in March we enrolled all npm accounts in enhanced login verification. On May 31, we will be enrolling all maintainers of the top-500 packages in mandatory 2FA. Our final cohort will be maintainers of all high-impact packages, those with more than 500 dependents or 1 million weekly downloads, whom we plan to enroll in the third-quarter of this year…