Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Has a Permission Problem

games.greggman.com

Post reply on HN
Print view View original

91–100 of 130 posts

Re: GitHub Has a Permission Problem

#91

Post by kube-system »

runarberg wrote: post #83
cortesoft wrote: post #67

Earlier quoted context omitted.

Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.

In my experience it is really hard to deposit money into another persons account in America. In my home country in Europe, all I need is their account number and their personal id number and I can deposit straight from my online banking system. They don’t have to be in the same bank or nothing. In America this is so much more complicated. I have a hard time depositing money to my partner outside of my credit union’s…

AFAIK, this is because criminals used to move money anonymously that way, and banks now have more of a legal responsibility to know where money is coming from.

Get yourself formally added as an authorized user of the account and you won’t have this problem anymore.

Re: GitHub Has a Permission Problem

#92

Post by kalleboo »

thayne wrote: post #75
ncallaway wrote: post #62

Earlier quoted context omitted.

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plai…

It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.

These things exist in other countries.

E.g. with e-Invoicing in Sweden, your electricity company, credit card company etc send the bill to your bank, it shows up as a PDF in your online banking, and you confirm or deny it there. If you want it to be auto-confirmed (e.g. utility bills), that's a setting on the bank end of things, not the utility end of things.

Re: GitHub Has a Permission Problem

#93

Post by tpetry »

Another problem is you grant access to all repositories. Say you want to use a ci service to build your software, you need to grant them access to _all_ repositories but you only wanted to use them for one project. Github permissions should have an optional opt-in feature to only let the provider see the repositories you want them to show.

Re: GitHub Has a Permission Problem

#94

Post by katbyte »

cortesoft wrote: post #67
vosper wrote: post #55

Earlier quoted context omitted.

> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the p…

Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.

Or you setup something outside bank account numbers that accomplishes that? Here in Canada we have interact e-transfers via email or text. Have yet to meet someone who doesn’t have it setup and works great and doesn’t require a bank account - only time that comes up is for direct deposit from employers Goverment ect

Re: GitHub Has a Permission Problem

#95

Post by vosper »

indemnity wrote: post #71
vosper wrote: post #55

Earlier quoted context omitted.

> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the p…

We still have junk like PoLi [1] which asks you for your internet banking credentials, and government departments use this. I'm looking at you, NZTA. Can't wait for the PaymentsNZ [2] effort to be fully implemented and widely adopted, so I can finally use real APIs to access this data, with low privilege throwaway tokens. [1] https://www.polipay.co.nz [2] https://www.apicentre.paymentsnz.co.nz

Oh yeah, PoLi is indeed junk, and I've also been surprised to see NZ Govt departments using it. I refuse to use PoLi, and I'll do a bank transfer or pay the debit card processing fee (if it's not exorbitant) instead.

Re: GitHub Has a Permission Problem

#96

Post by [deleted] »

ryukafalz wrote: post #41

The whole industry has a permission problem. There's this concept called the "principle of least authority," the idea that programs should only have access to the information they need to do their job, and no more. We are so far away from that it's not even funny. Overbroad OAuth scopes are one example of this, yes. Here's another: consider all the dependencies you use in your applications as a developer. Any single…

[deleted]

Re: GitHub Has a Permission Problem

#97

Post by mikewarot »

XorNot wrote: post #44
ryukafalz wrote: post #41

The whole industry has a permission problem. There's this concept called the "principle of least authority," the idea that programs should only have access to the information they need to do their job, and no more. We are so far away from that it's not even funny. Overbroad OAuth scopes are one example of this, yes. Here's another: consider all the dependencies you use in your applications as a developer. Any single…

This is what SELinux gets quite right under some configurations: that my home directory has distinct types of files and programs need to ask for very specific permissions to access some of them. Though MAC schemes in the Linux world are incredibly fragmented these days and containers have just made that worse.

SELinux is a stopgap... it would be better for the system to provide a PowerBox to select files, instead of hoping your programs access the right files. It gives you far more expressive power and safety, and protects you from confused deputies or malicious software.

Some day we'll move to capability based systems, and I hope this means we can finally ditch the false idea that you can enumerate all the bad programs, and write ones that never go wrong, nor get confused.

Re: GitHub Has a Permission Problem

#98

Post by LysPJ »

colinchartier wrote: post #23

My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2] Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wo…

The wording of the "act on your behalf" message is very frustrating indeed. I don't like to think about how many app installs I've lost due to the wording of this message. I've had worried users query me about it directly, but presumably many more have just abandoned the installation without contacting me.

Here's another GitHub forum thread asking about it:

https://github.community/t/enable-you-to-trigger-actions-in-...

A trivial wording change would go a long way toward fixing this problem. Unfortunately according to GitHub Support (post 15 in that thread) "The current wording is not considered a bug."

:-(

Re: GitHub Has a Permission Problem

#99

Post by mikewarot »

forrestthewoods wrote: post #30

What is the best example of fine grain permission UX? Everything I’ve seen skews towards this style of overly broad permission. What are good examples that GitHub should learn from?

Not quite the right answer, but if you want fine grained permissions in an OS, look to Genode, or other capability based systems.

If you want to see another way to do it, check out the "guest pass" that Flickr lets you hand out... you can grant permission to read an otherwise private folder, and you can revoke it at any time, just like a read capability in a multilevel secure OS.

Re: GitHub Has a Permission Problem

#100

Post by boring_twenties »

ncallaway wrote: post #62
closeparen wrote: post #36

Earlier quoted context omitted.

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plai…

> You would report the fraud, and you would get your money back.

There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?

Post reply on HN