Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Has a Permission Problem

games.greggman.com

Post reply on HN
Print view View original

41–50 of 130 posts

Re: GitHub Has a Permission Problem

#41

Post by ryukafalz »

The whole industry has a permission problem. There's this concept called the "principle of least authority," the idea that programs should only have access to the information they need to do their job, and no more. We are so far away from that it's not even funny.

Overbroad OAuth scopes are one example of this, yes. Here's another: consider all the dependencies you use in your applications as a developer. Any single one of those (perhaps hundreds of) dependencies can typically do anything you can do; it can rifle through your ~/.ssh directory looking for private keys, it can add stuff to your .bashrc, it can make arbitrary network connections, it can edit your browser settings. Likely most of them don't need to be able to do any of this. And yet that's what we accept in our computing environments, every single day.

Yes, it's incredibly dangerous.

Re: GitHub Has a Permission Problem

#42

Post by trwy99906 »

jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

It gets much worse. There are payment methods building upon this structure that fully analyze your bank account transaction history for income details to produce risk results and give back these raw results to merchants.

https://developers.paywithmybank.com/api/#get-user-income

Re: GitHub Has a Permission Problem

#44

Post by XorNot »

ryukafalz wrote: post #41

The whole industry has a permission problem. There's this concept called the "principle of least authority," the idea that programs should only have access to the information they need to do their job, and no more. We are so far away from that it's not even funny. Overbroad OAuth scopes are one example of this, yes. Here's another: consider all the dependencies you use in your applications as a developer. Any single…

This is what SELinux gets quite right under some configurations: that my home directory has distinct types of files and programs need to ask for very specific permissions to access some of them.

Though MAC schemes in the Linux world are incredibly fragmented these days and containers have just made that worse.

Re: GitHub Has a Permission Problem

#45

Post by prepend »

GitHub permissions are horrible.

I need to create repo specific tokens. If I integrate with some 3rd party CI tool, why must I grant access to all repos? Or can’t I grant read only instead of write and full control.

I have access to lots of repos and orgs, I don’t want to worry about everything getting hosed if a single token is compromised.

I also don’t like that for an org, I have to approve apps for anyone to use for anything. I’d like more fine grained controls to approve what they want to do, for the fewest repos necessary.

Re: GitHub Has a Permission Problem

#46

Post by XorNot »

jrochkind1 wrote: post #18

This has been bothering me for a while too. Without repo-specicific permissions at least , it sort of requires me to have separate github accounts for personal stuff, work stuff, contract stuff (per client) etc, doesn't it? Even if I'm willing to risk Some Serivce(tm) having write access to all my repos cause I want it for a personal project, I can't ethically give it access to work/client repos too. And yet, I must.…

There's also two sides to this: services can ask for permissions, but I want to be able to only pretend to give them some - i.e. asking for all repos access should let me lie and say "no only things such match this regex or this security tag".

Re: GitHub Has a Permission Problem

#47

Post by re »

GongOfFour wrote: post #9

I was hoping this was about gists being publicly accessible even when they are private...

They're not private, they're "secret". The descriptive text when choosing between "secret" and "public" says, "Secret gists are hidden by search engines but visible to anyone you give the URL to", though to be fair this isn't as prominent as it could be.

Given that private repositories used to be a paid-only feature and that gists as a feature haven't been substantially updated in the last 8 years, I'm not all that surprised that there isn't a "private" gist type.

https://docs.github.com/en/github/writing-on-github/creating...

> Secret gists don't show up in Discover and are not searchable. Secret gists aren't private. If you send the URL of a secret gist to a friend , they'll be able to see it. However, if someone you don't know discovers the URL, they'll also be able to see your gist. If you need to keep your code away from prying eyes, you may want to create a private repository instead.

Re: GitHub Has a Permission Problem

#48

Post by Rapzid »

One of my favorite is creating an API token for something that needs to read PRs and milestones. "Full control of private repositories" is the only option that works :D

SaaS CI/CD permissions are a bit of a mess too; not sure what the ratio of blame on that is though TBH.

Re: GitHub Has a Permission Problem

#49

Post by asidiali »

garaetjjte wrote: post #22
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…

I recently needed to add a personal Chase account to a business Chase account to send a transfer.

I kid you not, their own account linking flow used Plaid to collect my Chase(!) personal credentials and verify my Chase(!!!) personal account, within their own web UI while actively signed into my account.

Granted, there is capability in that UI to link any external account, so you can sign into other banks. But I mean come on...at least implement something secure for your own damn accounts!

Re: GitHub Has a Permission Problem

#50

Post by o-__-o »

u801e wrote: post #16
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

I remember this topic coming up at work and I said something along the lines of why would anyone provide their online bank account credentials to another service in order for them to verify your account and other members of my team (all software developers and operations) didn't see a problem with it. It seems like there's a significant disconnect between what people believe is good security practice.

My wife: “I didn’t know it did that. Oh well”

Bad cyber security is almost but not quite like sleeping around behind your partners back. If you get burned you both suffer.

Post reply on HN