I request that the maintainers remove my permissions to the TFA module at their earliest opportunity.

The past 3 years have been insightful, I've learned aspects of Drupal Core I would never had a reason to otherwise explore. I've gained deeper subject matter expertise that will be useful for decades to come.

Alas over the past 3 years I've had to fight:

  • Maintainers who fail to respond in security issues
  • Maintainers who try and prevent vulnerabilities from receiving an SA
  • Maintainers who continue to mint releases on branches that have known public security flaws
  • Maintainers who refuse to ensure only necessary access is granted (leaving inactive maintainers with commit access)
  • Maintainers who wish to see continued development on known insecure branches
  • The Drupal Security Team
  • The Drupal Association

At this point it is my opinion that my views on the projects direction are significant different than the other maintainers. I can stick around and be the one always objecting, being the roadblock or I can bow out and let this module go where it goes under the guidance of the majority.

To those who come after me:

I promise that I tried to give TFA a strong base, to look beyond the 3 month window and focus on the 5 year future, to slowly migrate away from the fail open architecture.

I hope I left you with sufficient documentation and readable code that they can continue on with ease. I'm sure there will however be areas of the code that I could have done significantly better and I offer you my apologies in advance for any work you may have to perform to understand my intent.

I encourage you to keep the NIST and PCI guidelines on your desk, reference them, use them as your guide for design and planning, reject the features users may want if they lead to weakness, focus on a secure platform so that Drupal sites need not depend upon third party providers. Suggest whatever your local country equivalent to these guides may be, choose the strictest for each scenario.

Good luck TFA!

Comments

cmlara created an issue. See original summary.

jcnventura’s picture

jcnventura
Primary language English
commented
Status: Active » Fixed

I visited d.o today and saw this issue.. I see myself in some of the points above. You could probably add:

  • Maintainers who still have commit access but no longer maintain anything
  • Maintainers who are completely silent in the last two years since they have now relinquished the full maintenance of the project to you.

I would have happily removed myself instead of you from the maintainer list but - "by your command" - I have now removed you from the maintainers of the project. I'm sad to see you go, as you had some of the passion that none of the other maintainers have anymore.

PS: Yes, I know that "completely silent" does not cover the release of 2.0.0-alpha5 in November 2025. The fact is that 2.0.0-alpha4 was broken in the then current releases of Drupal core, and without that release, installing that branch was a lot harder.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.