Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Has a Permission Problem

games.greggman.com

Post reply on HN
Print view View original

51–60 of 130 posts

Re: GitHub Has a Permission Problem

#51

Post by cortesoft »

closeparen wrote: post #36
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…

> the money just flies right out.

And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back.

This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.

Re: GitHub Has a Permission Problem

#53

Post by TheAceOfHearts »

Permission problems extend to other popular developer platforms as well and I wish more granular permissions were the norm. One example I encountered was with GCP, where I wanted to create a key that could only update a single existing DNS record but I discovered it wasn't possible to apply such strict restrictions. My reasoning for desiring such a restricted key was that if it was somehow leaked or stolen the amount of damage that someone would be able to accomplish would be far more limited than if the key had greater capabilities. Despite the Principle of least privilege [0] being a well-known concept, putting it into practice in real world systems often ends up being an uphill battle. With modern complex systems it can be very difficult to feel confident about the security of each component, and if your attack surface is sufficiently large then it's merely a matter of time before some part fails. We need to make it easier and simpler for regular developers to do the right thing without requiring that they setup even more complex systems which require extensive administrative knowledge in order to successfully accomplish anything with a modicum of security.

[0] https://en.wikipedia.org/wiki/Principle_of_least_privilege

Re: GitHub Has a Permission Problem

#54

Post by jart »

> But if you allow them blanket access to your github (or gitlab), YOU SHOULD ARGUABLY BE DISQUALIFIED FROM BEING A SOFTWARE DEVELOPER!!!

The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. Which is why I think we should be more forgiving of mistakes than what his tone proposes. GitHub obviously has room to improve, but ultimately the system runs on trust, and sometimes the best we can do when it's violated is react to solve the problem and then write a postmortem.

Re: GitHub Has a Permission Problem

#55

Post by vosper »

cortesoft wrote: post #51
closeparen wrote: post #36

Earlier quoted context omitted.

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…

> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.

> The system works not by making it hard to steal money, but by making it easy to get back.

In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.

Re: GitHub Has a Permission Problem

#56

Post by guessmyname »

On the other hand, I love that GitHub forces app developers to ask for so many permissions. Here is why…

When my teammates asked me to provide internationalization support for all our projects via Crowdin, I gave them a detailed list of all the permissions Crowdin’s app requires to sync data back and forth via the GitHub integration. The answer from the product manager, —No way! Build that yourself. We are not giving full access to all our public and private repositories to a third-party company to have translation capabilities.— As a result, I spend a couple of weeks writing a custom Gettext parser to allow my teammates to provide translations via PO files.

Similarly, when my teammates wanted to use a popular CI/CD service called Travis CI, I also gave them a list of all the permissions required to offer most, if not all, their features. Again, a product manager told me to stop and use something that we could self-host, so I went with GitLab CI.

I could continue telling stories, but the point is, thanks to GitHub’s extreme and ambiguous API permissions, I can continue working at a bit company and earn a lot of money. Other people probably spend five minutes integrating third-party services they blindly trust and then move on to more exciting work. But as my father used to say, work to live, not the contrary, so if I can get FAANG money by writing simple programs to replicate what a SaaS has to offer, I feel accomplished and can move on with my life.

Thank you, GitHub, for creating an app integration experience so bad that I can keep my job.

Re: GitHub Has a Permission Problem

#57

Post by jonperl »

colinchartier wrote: post #23

My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2] Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wo…

For QA Wolf we created a separate GitHub OAuth app just to avoid this UX bug

Re: GitHub Has a Permission Problem

#58

Post by brazzledazzle »

asidiali wrote: post #49
garaetjjte wrote: post #22

Earlier quoted context omitted.

I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…

I recently needed to add a personal Chase account to a business Chase account to send a transfer. I kid you not, their own account linking flow used Plaid to collect my Chase(!) personal credentials and verify my Chase(!!!) personal account, within their own web UI while actively signed into my account. Granted, there is capability in that UI to link any external account, so you can sign into other banks. But I mean…

You can almost smell the internal bureaucracy and dysfunction.

Re: GitHub Has a Permission Problem

#59

Post by [deleted] »

vosper wrote: post #55
cortesoft wrote: post #51

Earlier quoted context omitted.

> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.

> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the p…

[deleted]

Re: GitHub Has a Permission Problem

#60

Post by ihuman »

colinchartier wrote: post #23

My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2] Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wo…

I can confirm this. I just created an app with 0 permissions (everything set to "no access"), and the page looks exactly like the screenshot in the article.
Post reply on HN