Yes, I have opinions on your open source contributions
I feel like some of the disconnect comes from being a mandate rather than a persuasive recommendation.  Imagine that they included some sort of case study to make it less abstract:<p>Company C uses database driver P.  On 2020-01-02 they upgraded their app to the latest version.  On 2020-01-04 they noticed that someone stole all their user data.  Upon investigation, Package P had a version uploaded on 2019-12-24 that sends all user data to evil.example.com.  The tooling to upgrade the package doesn&#x27;t show diffs, so company C had no way to detect this malicious change.  How did such a compromised version get uploaded?  Looking at the audit logs, it appeared that there were 2398438 unsuccessful login attempts to package P author&#x27;s account, before finally uploading the new patch release from the same IP.  Company C lost 8 billion dollars as a result of this.  If author A had used multi-factor authentication, then this wouldn&#x27;t have happened, because it would have taken more login attempts than there are atoms in the Universe.<p>Then the author can see &quot;hey I can save the shareholders of some random corporation 8 billion dollars if I make it harder for myself to release software&quot;.  That&#x27;s a better incentive than &quot;because I told you to&quot;.<p>I know it sounds a bit disingenuous to say this is just for the shareholders of random corporations.  I&#x27;m being a little snarky.  It&#x27;s also good for your reputation to not get hacked, and using 2FA to log in every time is probably less time overall than reacting to a single compromise.  Imagine how many emails you&#x27;re going to get.  Big pain.  I just think it&#x27;s important to show authors the cost&#x2F;benefit.  2FA is easy.  Next time it might not be something that&#x27;s as easy, though.