Earlier quoted context omitted.
Shouldn't have used OAuth then.
You must not be familiar with OAuth authentication for Github. There is no way to access your repos to analyze except by allowing write-permissions. Github doesn't allow read-only unfortunately.
GitHub Report Card
41–50 of 71 posts
Re: GitHub Report Card
#42I am weary of having managers that might be somewhat incompetent being given a tool like this to help manage developers.
Re: GitHub Report Card
#43I'm a Technical Product Manager at GitHub. I just took a look at this (pretty cool, maybe we should have deeper user metrics...). I saw a couple of comments about the 'write access' so I just figured I'd chime in and point out that it's a required scope to get all of the private contrib info out of the API. I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
> I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
So you gave write access to what presumably are private company repos so that you could view a pretty report card about your commit activity?
That doesn't speak very well (to me) of the security practices espoused by your employer.
Re: GitHub Report Card
#44I'm a Technical Product Manager at GitHub. I just took a look at this (pretty cool, maybe we should have deeper user metrics...). I saw a couple of comments about the 'write access' so I just figured I'd chime in and point out that it's a required scope to get all of the private contrib info out of the API. I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
6 months down the line: GitHub discovers a security breach, tracks it down to an advanced persistent threat that involved the attackers getting their conditionally malicious app front paged on HN which led to GH staff being baited into allowing said app write access on GH proprietary repos. Just kidding :p
Re: GitHub Report Card
#45Not sure if anyone else is getting this, but I can't seem to scroll down past the fold for the site on Chrome on my Windows 7 machine. Tried using Internet Explorer 11 and nothing showed up at all...
I think you're seeing the whole page... it's a cropped screenshot.
Re: GitHub Report Card
#46This application does, for some reason, require write access to all of mine and my organisation's repos. Just no.
We understand your reticence (Reflect employee here). Two things to note: 1. GitHub does not grant read-only access to repos. Any time you authorize a third-party app to access your repos, you are granting write access. We will never write to your repos, and our report card isn't doing anything out of the ordinary (i.e. it's not doing anything that TravisCI, Auth0, and a lot of other GitHub third-party apps don't do)…
Github does provide read only access to your public repos. You could generate a report card for any github user with their username alone, no need to obtain account access (which I won't share, for that reason).
Re: GitHub Report Card
#47Not sure if anyone else is getting this, but I can't seem to scroll down past the fold for the site on Chrome on my Windows 7 machine. Tried using Internet Explorer 11 and nothing showed up at all...
Yeah, it's just poor UX on their part. The "report card" that you see is actually a screenshot cropped from the bottom.
Re: GitHub Report Card
#48I'm a Technical Product Manager at GitHub. I just took a look at this (pretty cool, maybe we should have deeper user metrics...). I saw a couple of comments about the 'write access' so I just figured I'd chime in and point out that it's a required scope to get all of the private contrib info out of the API. I definitely encourage people to be mindful of what access they grant, but for what it's worth I did it :)
Why should I be mindful when someone from Github (the company where I host lot of code) does not?
Re: GitHub Report Card
#49I have over 200 open source repos, and 2-3 private once on GitHub. They are private for a reason and it's irresponsible of GitHub to "force" me to make this choice in order to participate in the echo-system of 3rd party apps that connect to GitHub. In todays developer world, you need a lot of these 3rd party tools in order to be a productive programmer (granted not this one, but hey).
It's even more irresponsible of this dev WHO WORKS AT GITHUB to take this fact to lightly. Read AND write access to both my public AND private repos is an insane amount of trust to put in another person. I'm sure this person is a stand up individual. But does he/she write secure code? How easy is it to gain access to his database of access tokens?
In this world of Yahoo/Sony/You-name-it hacks that we live in, I'm honestly surprised there haven't been a hack yet where someone got a hold on a whole bunch of access tokens to private repos. You could do A LOT of damage with this. I'll never sign up for a service such as this and the author should be ashamed to even suggest it.
Instead he/she should focus their time on fixing this issue at GitHub instead of making apps like this.
Re: GitHub Report Card
#50Earlier quoted context omitted.
You must not be familiar with OAuth authentication for Github. There is no way to access your repos to analyze except by allowing write-permissions. Github doesn't allow read-only unfortunately.
https://developer.github.com/early-access/integrations/
>Early Access