GitHub announcements: Marketplace, Apps and GraphQL API • Hacker News Board

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#151

Post by cryptonector » Mon, May 22, 2017, 8:46 PM UTC

shurcooL wrote: post #117

REST v3 API supports conditional requests, that return 304 when content hasn't changed since last time you asked and don't count against rate limit. It means one can use a caching HTTP transport and benefit from that. Is there any support for caching in the GraphQL v4 API? I'm not seeing anything about it in the docs.

If your query is complex and/or depends on sharded data, it can be difficult or impossible to cheaply (i.e., without re-executing the query) check whether the results have changed. That doesn't mean that the server couldn't execute the query, hash the results, and compare to an ETag from a client's If-None-Match: header, or some GraphQL equivalent of that (if it has it), thus saving network bandwidth. You just might not be able to save cycles and I/O on the server-side.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#152

Post by creichert » Mon, May 22, 2017, 8:48 PM UTC

mrclark411 wrote: post #150

The Listing requirements: https://developer.github.com/apps/adding-integrations/listin... mention: - OAuth Apps should have a minimum of 1000 users. - GitHub Apps should have a minimum of 250 installations. Does this mean you aren't listed on the Marketplace until you have 1000 users + 250 installations?

GitHub apps are slightly different than OAuth Apps.

GitHub Apps are per-repository "integrations" that don't perform actions on behalf of a specific user and are installed directly to a repo (with fine-grained permissions).

OAuth Apps are the classic "integrations" installed by a specific user and perform actions on behalf of that user.

I imagine they have lower requirements because they are new, more specialized, and likely to be installed a little less.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#153

Post by mrclark411 » Mon, May 22, 2017, 9:20 PM UTC

creichert wrote: post #152

mrclark411 wrote: post #150

The Listing requirements: https://developer.github.com/apps/adding-integrations/listin... mention: - OAuth Apps should have a minimum of 1000 users. - GitHub Apps should have a minimum of 250 installations. Does this mean you aren't listed on the Marketplace until you have 1000 users + 250 installations?

GitHub apps are slightly different than OAuth Apps. GitHub Apps are per-repository "integrations" that don't perform actions on behalf of a specific user and are installed directly to a repo (with fine-grained permissions). OAuth Apps are the classic "integrations" installed by a specific user and perform actions on behalf of that user. I imagine they have lower requirements because they are new, more specialized, an…

Thanks.

I also see that the security requirements are quite high. While its difficult to argue with source code security - here are some of the security requirements:

The standard annual risk assessment shall include, to the best of Developer's ability, the following:

(i) SOC 1 and/or SOC 2 audit report; (ii) 3rd party proof of PCI compliance (a certificate showing Developer's handling of credit card payments is compliant); (iii) Privacy Shield Attestation; (iv) ISO Certification or Cloud Security Alliance Self-Assessment; (v) Cloud Security Self Assessment; (vi) any information on subcontractor or vendor production datacenter(s), IaaS, PaaS, or private hosting providers, as required by GitHub based on data and services rendered; and (vii) Written responses and evidence of specific security requirements as outlined in this agreement

https://help.github.com/articles/github-marketplace-develope...

The GitHub Marketplace will be an exclusive place for a while with those requirements.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#154

Post by abustamam » Mon, May 22, 2017, 9:29 PM UTC

TAForObvReasons wrote: post #122

devhead wrote: post #106

Earlier quoted context omitted.

any indication why the prices are different? it's not like they think we won't sniff that out, right?

That's an oversight on Github's part and will end in a TOS change in one of two directions: price parity or complete prohibition of paid services that use GH integrations outside of the marketplace

Ironic that the "hub for open-source projects" could become a walled garden if the latter happens.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#155

Post by [deleted] » Mon, May 22, 2017, 9:31 PM UTC

abustamam wrote: post #154

TAForObvReasons wrote: post #122

Earlier quoted context omitted.

That's an oversight on Github's part and will end in a TOS change in one of two directions: price parity or complete prohibition of paid services that use GH integrations outside of the marketplace

Ironic that the "hub for open-source projects" could become a walled garden if the latter happens.

[deleted]

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#156

Post by j_m_b » Mon, May 22, 2017, 9:35 PM UTC

shurcooL wrote: post #115

j_m_b wrote: post #83

I've recently been exploring GraphQL. It's an excellent way to design and maintain Web APIs imo. GitHub is a great resource for learning how GraphQL works. I've been using the GraphiQL tool to experiment with it. However, there is a big issue with the GraphQL implementation in that requests using the POST method work, but the mirror GET requests do not return the same results. For example, see the response for the si…

Perhaps https://developer.github.com/v4/guides/forming-calls/#commun... is relevant: > In REST, HTTP verbs determine the operation performed. In GraphQL, you'll provide a JSON-encoded body whether you're performing a query or a mutation, so the HTTP verb is POST. The exception is an introspection query, which is a simple GET to the endpoint.

Thanks. I'm not sure that this conforms to GraphQL best practices. http://graphql.org/learn/serving-over-http/ It seems GET methods should be supported for more than just introspection queries.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#157

Post by cyphar » Mon, May 22, 2017, 9:38 PM UTC

jtmcmc wrote: post #133

cyphar wrote: post #88

I just got an advertising email about this from GitHub, even though I've never subscribed to GitHub advertising mail. I just checked my email settings and it looks like GitHub has added a new option (defaulting to being "on" of course) that auto-subscribes you to spam. Surely the unsubscription laws don't allow you to retroactively add more options that are defaulted to being on that subscribe you to things you were…

it's going to depend where you live. In the united states no opt-in is required for sending marketing email - https://www.ftc.gov/tips-advice/business-center/guidance/can...

In Australia we have similar legislation, but there are some circumstances where a sender can "infer" that you "probably would consent" to spam. Though I think lots of companies are far too liberal with their interpretation of such provisions.

http://www.acma.gov.au/Industry/Marketers/Anti-Spam/Ensuring...

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#158

Post by cyphar » Mon, May 22, 2017, 9:39 PM UTC

Drdrdrq wrote: post #120

cyphar wrote: post #88

I just got an advertising email about this from GitHub, even though I've never subscribed to GitHub advertising mail. I just checked my email settings and it looks like GitHub has added a new option (defaulting to being "on" of course) that auto-subscribes you to spam. Surely the unsubscription laws don't allow you to retroactively add more options that are defaulted to being on that subscribe you to things you were…

I usually give aliases for such accounts because of this (and because of data breaches). Send me spam and I don't have to put up with your UI to unsubscribe, I just delete mail alias. Of course, that doesn't work if I want to receive any mail from you...

What email service do you use? I've been trying to figure out where to switch to from "the big G" and it's not clear to me what host is good.

Personally a host that has a mail client which is free software would be the best deal. :P

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#159

Post by stephenr » Tue, May 23, 2017, 7:46 AM UTC

abustamam wrote: post #154

TAForObvReasons wrote: post #122

Earlier quoted context omitted.

That's an oversight on Github's part and will end in a TOS change in one of two directions: price parity or complete prohibition of paid services that use GH integrations outside of the marketplace

Ironic that the "hub for open-source projects" could become a walled garden if the latter happens.

Irony is about intentions. Free-for-open is a marketing tactic, pure and simple.

Re: GitHub announcements: Marketplace, Apps and GraphQL API

#160

Post by stephenr » Tue, May 23, 2017, 7:48 AM UTC

devhead wrote: post #107

crb002 wrote: post #59

Earlier quoted context omitted.

Bitbucket has more traction than you think. Especially in megacorps who use JIRA. As long as the services have a docker container you can run locally I see no lock-in.

bitbucket was a consideration for my team, until we went through the end of life with their other git saas stash. won't consider it again because of the pain we went through due to that. went over to gitlab after that.

When was stash SaaS? Isn't Stash the on-premise version that was renamed to Bitbucket Server?