Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Detail, a Bug Finder

detail.dev

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Show HN: Detail, a Bug Finder

#21

Post by munchler »

drob wrote: post #20
munchler wrote: post #12

I wanted to give this a try, but it immediately asks for authority to "Act on your behalf" on GitHub. That's not something that I'm going to grant to an unfamiliar agent. It would make a lot more sense to me if you provided a lighter "intro" version, even if that means it can only run on public repos.

As far as we can tell this is a github-ism, and any OAuth permission is a form of "acting on your behalf": https://dappling.medium.com/a-github-app-would-like-to-act-o...

That's good to know, but I would still suggest an on-ramp that only uses GitHub for authentication (i.e. no permissions needed). To that end, it would be nice if I could also authenticate with other OAuth providers instead, like Google, etc.

Again, I understand that this would limit me to scanning public repos, but that would be fine.

Re: Show HN: Detail, a Bug Finder

#23

Post by chrsw »

drob wrote: post #7
chrsw wrote: post #6

How does this work if your repos aren't on GitHub? And what if your code has nothing to do with backend web apps?

Github only for now. Out of curiosity, is yours on gitlab? Something else? We should be able to find something interesting in most codebases, as long as there's some plausible way to build and test the code and the codebase is big enough. (Below ~250 files the results get iffy.) We've just tested it a lot more thoroughly on app backends, because that's what we know best.

> Out of curiosity, is yours on gitlab? Something else?

Something else, it's a self-hosted Git server similar to GitHub, GitLab, etc. We have multiple repos well clear of 1k files. Almost none of it is JavaScript or TypeScript or anything like that. None of our own code is public.

Re: Show HN: Detail, a Bug Finder

#24

Post by drob »

munchler wrote: post #21
drob wrote: post #20

Earlier quoted context omitted.

As far as we can tell this is a github-ism, and any OAuth permission is a form of "acting on your behalf": https://dappling.medium.com/a-github-app-would-like-to-act-o...

That's good to know, but I would still suggest an on-ramp that only uses GitHub for authentication (i.e. no permissions needed). To that end, it would be nice if I could also authenticate with other OAuth providers instead, like Google, etc. Again, I understand that this would limit me to scanning public repos, but that would be fine.

Other auth providers for sure. We'll be adding shortly.

Using an alternate auth provider won't even prevent you from scanning non-public GitHub code. There's a GitHub OAuth App just for auth (which is what you're seeing here), and a separate GitHub App that you need to install either way to give Detail access to the right repos. We can swap out the former for Google/Okta/pw if you want to avoid this warning. GitHub Apps (the half that manages repo access) have a much finer grained permissions model.

Re: Show HN: Detail, a Bug Finder

#25

Post by drob »

solatic wrote: post #18

$30/committer/month, while only running scans biweekly, not even including "Enterprise" pricing, is really, really steep and will be a big barrier to adoption in larger enterprises with many engineers. You're basically asking enterprises to take the $30/committer/month pricing that they're spending on something like GitLab Premium, and double it, for bug reports? They may be great bug reports, but if it's difficult e…

We've been thinking about this too. We have some ideas. Thanks for the comment, in any case – gave us a lot to chew on.

Re: Show HN: Detail, a Bug Finder

#26

Post by bjtitus »

drob wrote: post #20
munchler wrote: post #12

I wanted to give this a try, but it immediately asks for authority to "Act on your behalf" on GitHub. That's not something that I'm going to grant to an unfamiliar agent. It would make a lot more sense to me if you provided a lighter "intro" version, even if that means it can only run on public repos.

As far as we can tell this is a github-ism, and any OAuth permission is a form of "acting on your behalf": https://dappling.medium.com/a-github-app-would-like-to-act-o...

I looked for an explanation of what the tool does on my behalf on your site but didn't see anything.

I guess I expected on the homepage or maybe "About" but I was looking for something related to whether you open PRs on my behalf given that OAuth prompt.

I think adding that or some explanation during onboarding about the permissions might help.

Post reply on HN