Last week William Woodruff wrote an excellent blog post about the implementation of PEP 740 on PyPI: digital attestations for Python package releases.
Apparently the release of this feature was controversial because of decisions like using GitHub as the identity provider and using OIDC rather than PGP signatures.
The specifics are interesting in the context of security engineering, but I wanted to highlight a major similarity between efforts to improve software security and efforts to improve environmental sustainability.
The key part is in the tl;dr:
TL;DR: If you don’t bother to read the rest of the post, here is the gloss: being serious about security at scale means meeting users where they are.
We can adjust this:
TL;DR: If you don’t bother to read the rest of the post, here is the gloss: being serious about sustainability at scale means meeting people where they are.
The summary is that most people will not change their behavior. We need to change the system so the underlying infrastructure achieves the goals without anyone else having to do anything.
In security this means things like software auto-patching with Apple’s Rapid Security Responses. It means things like introducing regulations to require device manufacturers to provide security updates. It means things like scanning URLs and developing unphishable authentication mechanisms like Passkeys.
Basing security goals on encouraging people to update their software and remembering not click links in emails won’t work. Most people won’t do it.
In sustainability this means things like cloud providers managing their data center energy portfolio to achieve 100% clean energy 24/7 so everything running on top of it gains zero carbon energy by default. It means things like smart charging of devices based on grid carbon intensity signals. It means things like using recycled materials so the new device you buy has less materials impact.
Basing sustainability goals on encouraging behavior change like watching less streaming video or deleting unneeded files has zero impact. Most people won’t do it.
Security purists are as bad as the sustainability ideologues, and they don’t help anyone.