From:
mikael.barbero@xxxxxxxxxxxxxxxxxxxxxx <mikael.barbero@xxxxxxxxxxxxxxxxxxxxxx>
Date: Wednesday, 28. February 2024 at 15:28
To: security@xxxxxxxxxxxxxxxxxxxxxx <security@xxxxxxxxxxxxxxxxxxxxxx>
Cc: Fischer, Sebastian <sebastian.a.fischer@xxxxxxxxxxxxx>
Subject: [External] Important: Implementation of Mandatory 2FA Across all Eclipse Foundation GitHub Organizations
Dear Eclipse Kiso-testing Project Lead,
As part of our ongoing commitment to enhancing the security of your projects and repositories, we are excited to announce a significant advancement in our cybersecurity measures.
Following our previous communications, first on
January 14th, second on
February 2nd shared through the eclipse.org-committers mailing list, and detailed in the associated
support ticket, we will be implementing a requirement for two-factor authentication (2FA) across the entire GitHub organization for your project on April 30th. This initiative is critical for safeguarding your projects.
It has come to our attention that 2 members of your project don't have 2FA enabled. We've just sent them an email to strongly encourage them to activate 2FA on their GitHub account
before April 30th to avoid any disruptions in access. They also received instructions similar to the ones below about why and how they should enable 2FA.
We strongly encourage you to follow up with them to ensure they have received the email and have taken the necessary steps to enable 2FA.
Why is 2FA important?
2FA adds an extra layer of security to ensure that individuals attempting to access an online account are who they claim to be. After entering their username and password, a user must provide another form of verification. This could be a code received via text
message, an app on your smartphone, or a hardware security key. Enabling 2FA is nowadays a standard security practice across many platforms.
What happens if those members don't enable 2FA?
Failing to enable 2FA on their GitHub account by April 30th will result in temporary loss of access to the Eclipse Kiso-testing repositories. Consequently, they will be unable to push new code or merge pull requests. While they can still fork the repositories
and work on their fork, direct contributions to the project repositories will be restricted until 2FA is enabled.
How to enable 2FA on their GitHub account?
GitHub provides
detailed instructions for enabling 2FA. Should you need assistance, feel free to reach out to their
support team. For any further questions or assistance in setting up 2FA, do not hesitate to open a ticket on our
HelpDesk or comment on the
ticket tracking this initiative.
Thank you for your cooperation and dedication to security.
Cheers!
The Eclipse Foundation Security Team
