Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Has a Permission Problem

games.greggman.com

Post reply on HN
Print view View original

121–130 of 130 posts

Re: GitHub Has a Permission Problem

#121

Post by bzbarsky »

closeparen wrote: post #36
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…

Interesting note: you can probably call your bank up and request that the disallow ACH withdrawals from your account if triggered by some third party.

You can still get ACH deposits. You can still use the bank's bill pay and they will send the payments over ACH (so you can push funds over ACH from the account). But someone else can't _pull_ funds over ACH from that account.

Certainly the banks I use have this as an option, and it's useful sometimes. As long as you remember and don't try to pull yourself from one of your other accounts, of course.

Re: GitHub Has a Permission Problem

#122

Post by jart »

pdimitar wrote: post #119
jart wrote: post #54

> But if you allow them blanket access to your github (or gitlab), YOU SHOULD ARGUABLY BE DISQUALIFIED FROM BEING A SOFTWARE DEVELOPER!!! The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. Which is why I think we should be more forgiving of mistakes than what his tone proposes. GitHub obviously has room to improve, but ultimately the system runs on trust, a…

Anyone who would abuse this overly wide access given to their org (by the dev) wouldn't make a single bleep about it and just keep scraping data and code quietly until the door is shut in front of their face. So I don't think your idea about how this should work is good. If somebody wants to just shovel other organization's code into their silo then they are not incentivized to attack the current state of affairs; on…

I think what we need is more along the lines of this blog post: https://opensource.googleblog.com/2017/03/operation-rosehub.... Modern tools grant each individual the ability to fix the world's code at scale. All we have to do is get our hands dirty creating the change we want to see in the world. Doing that effectively it helps to not assign blame since we all make mistakes and ultimately the goal is to improve.

Re: GitHub Has a Permission Problem

#123

Post by pdimitar »

jart wrote: post #122
pdimitar wrote: post #119

Earlier quoted context omitted.

Anyone who would abuse this overly wide access given to their org (by the dev) wouldn't make a single bleep about it and just keep scraping data and code quietly until the door is shut in front of their face. So I don't think your idea about how this should work is good. If somebody wants to just shovel other organization's code into their silo then they are not incentivized to attack the current state of affairs; on…

I think what we need is more along the lines of this blog post: https://opensource.googleblog.com/2017/03/operation-rosehub.... Modern tools grant each individual the ability to fix the world's code at scale. All we have to do is get our hands dirty creating the change we want to see in the world. Doing that effectively it helps to not assign blame since we all make mistakes and ultimately the goal is to improve.

This is a commendable initiative. From the article:

> With the help of GitHub’s GUI, any individual can make such changes to anyone’s codebase in under a minute.

Sigh, so yet again the load falls on the normal working programmers' free time. And yet again the effort is vastly underestimated. Sure it took 5-10 minutes (I doubt it took one, as article claims) this time but what about the next 50 times? The article even supports this:

> As more work was completed, it was apparent that the problem was bigger than we had initially realized.

I am glad several Googlers decided to help. I wish it happened more often with them and other corporations. The normal working programmers are overworked enough already.

Re: GitHub Has a Permission Problem

#124

Post by closeparen »

mschuster91 wrote: post #106
__float wrote: post #80

Earlier quoted context omitted.

Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.

> Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file . I have a business account at my bank, I can theoretic…

What if you produce the mandate signed by someone impersonating the customer? I imagine that is the typical case for ACH fraud. Not everyone has their own ACH connection; you would plug in a stolen account number at some merchant.

Re: GitHub Has a Permission Problem

#125

Post by Doxin »

thayne wrote: post #75
ncallaway wrote: post #62

Earlier quoted context omitted.

It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plai…

It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.

The dutch iDeal system works like that. The merchant redirects you to your banking website where you can authorize the transaction, which tends to involve some 2-factor rigamarole, after which point the bank redirects you back to the merchant.

A more recent innovation is banks exposing this more directly to consumers. I can create a "payment request" in my banking app which generates an iDeal url which I can send by email/text/facebook/whatsapp/qr code/carrier pidgeon to someone who can then pay me. No exchange of account numbers required and the amount paid is deposited in your account within seconds.

So yes, an oauth-like flow definitely is the way to go. It's more secure and more convenient, which is a pretty unusual combination.

Re: GitHub Has a Permission Problem

#126

Post by mschuster91 »

closeparen wrote: post #124
mschuster91 wrote: post #106

Earlier quoted context omitted.

> Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file . I have a business account at my bank, I can theoretic…

What if you produce the mandate signed by someone impersonating the customer? I imagine that is the typical case for ACH fraud. Not everyone has their own ACH connection; you would plug in a stolen account number at some merchant.

To be honest I don't know who is held liable if you can prove you have had a valid mandate, never had to dive that deep into the rabbit hole that is SEPA - and I guess the specific rules depend on the country you're in. I assume though that similar to CC fraud, one or both banks involved eat the loss.

Re: GitHub Has a Permission Problem

#127

Post by jart »

pdimitar wrote: post #123
jart wrote: post #122

Earlier quoted context omitted.

I think what we need is more along the lines of this blog post: https://opensource.googleblog.com/2017/03/operation-rosehub.... Modern tools grant each individual the ability to fix the world's code at scale. All we have to do is get our hands dirty creating the change we want to see in the world. Doing that effectively it helps to not assign blame since we all make mistakes and ultimately the goal is to improve.

This is a commendable initiative. From the article: > With the help of GitHub’s GUI, any individual can make such changes to anyone’s codebase in under a minute. Sigh, so yet again the load falls on the normal working programmers' free time. And yet again the effort is vastly underestimated. Sure it took 5-10 minutes (I doubt it took one, as article claims) this time but what about the next 50 times? The article even…

You have a very negative way of looking at things. Spartacus was born a few miles from you and he was just an ordinary guy. Would he have needed to be a rebel had he been born today, in a time when the system gives each individual the tools they need to make the world a better place? I say why not use them.

Re: GitHub Has a Permission Problem

#128

Post by nikolay »

GitHub Personal Access Tokens have no granular permissions. Coworkers always opt-in to use PATs instead of deploy keys, because it's easier, but to be able to clone a repo with PAT you need to extend the permissions way beyond just cloning a repo. The OAuth scopes are also not very granular. They don't have to reinvent the wheel - there are already a bunch of working systems they just need to replicate.

Re: GitHub Has a Permission Problem

#129

Post by pdimitar »

jart wrote: post #127
pdimitar wrote: post #123

Earlier quoted context omitted.

This is a commendable initiative. From the article: > With the help of GitHub’s GUI, any individual can make such changes to anyone’s codebase in under a minute. Sigh, so yet again the load falls on the normal working programmers' free time. And yet again the effort is vastly underestimated. Sure it took 5-10 minutes (I doubt it took one, as article claims) this time but what about the next 50 times? The article even…

You have a very negative way of looking at things. Spartacus was born a few miles from you and he was just an ordinary guy. Would he have needed to be a rebel had he been born today, in a time when the system gives each individual the tools they need to make the world a better place? I say why not use them.

Because there's a limited amount of hours per day, and even more limited joules of energy.

So I'll always disagree that such initiatives must be in one's free time.

Guess I am only looking at this as a job now. I do want to work on certain things but nobody is willing to pay for them, AFAIK at least.

Re: GitHub Has a Permission Problem

#130

Post by philsnow »

pdimitar wrote: post #120
philsnow wrote: post #70

Yes GitHub has this problem, but it's not a GitHub problem, it's an oauth problem. Oauth is better than the previous state of the art (either app-specific passwords that can do anything you can do or else literally just your own username and password), but it has a huge UX problem around least privilege. In general it's very opaque what the requested permissions can be used to do. Some companies get this pretty right…

Is there a problem using Sandstorm today? I followed it some years ago but never actually tried it, always too busy. :(

Only the same problem as using any other open source thing that didn't catch on: you have a smaller community to get support from, newer things won't be ported to your platform quickly or ever, and your chosen platform gets less adoption and becomes less compatible over time.

I stopped using Slackware when I got married / got a job / had kids, because debian made all my day to day management tasks easier and I no longer cared about knowing deep details about every single package that lived on my system.

I'll still install it and toy with it, but I'm not going to push my kids towards using a sandstorm word processor over google docs etc.

Post reply on HN