Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plans to Re-enable the GitHub Integration

blog.heroku.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: Plans to Re-enable the GitHub Integration

#11

Post by josegonzalez »

jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case either.

    - [1] https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps

Re: Plans to Re-enable the GitHub Integration

#12

Post by abathur »

wlll wrote: post #6

I'd still love to get a response to the comment I made on my submission ( https://news.ycombinator.com/item?id=31450100 ) > I'd love to hear from someone at GitHub (anonymously or not) what they've done to be satisfied with action Heroku have taken that would allow the integration to be turned back on. My confidence in Heroku to give me accurate information on this is low. As far as I can tell from Heroku's communica…

It's nitpick, but I'll note that it follows that you wouldn't know if the attacker has access if you don't know how they gained it.

Re: Plans to Re-enable the GitHub Integration

#13

Post by glenngillen »

josegonzalez wrote: post #11
jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

The whole GitHub permission/scope areas has been a big issue for a lot of 3rd party developers for a very long time now: https://github.com/dear-github/dear-github/issues/113

Re: Plans to Re-enable the GitHub Integration

#14

Post by jrochkind1 »

glenngillen wrote: post #13
josegonzalez wrote: post #11

Earlier quoted context omitted.

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

The whole GitHub permission/scope areas has been a big issue for a lot of 3rd party developers for a very long time now: https://github.com/dear-github/dear-github/issues/113

I wonder if these security incidents will encourage them to improve it?

Re: Plans to Re-enable the GitHub Integration

#16

Post by Serow225 »

josegonzalez wrote: post #11
jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

yes, the OAuth scopes are way way too coarse. Even to the point of not being able to separate readonly vs R/W.

GitHub apps are indeed noticeably better. But that doesn’t always help

Re: Plans to Re-enable the GitHub Integration

#17

Post by taejavu »

josegonzalez wrote: post #11
jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

Any idea how Netlify does it? There I can only select from the repos I have granted access to, and if I want to add a new one I click "Configure the Netlify app on GitHub", which opens a window where I can choose which repos to allow access to. Always wondered how that works.

Re: Plans to Re-enable the GitHub Integration

#19

Post by memset »

josegonzalez wrote: post #11
jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

Apps let a user specify the specific repos that one can have access to. That’s what we use for our company, tasker.sh.

Furthermore, we basically only ask for the one “mandatory” permission - there are scores of perms you could request when authorizing an app - and that’s just read only access to the code.

Re: Plans to Re-enable the GitHub Integration

#20

Post by vorador »

josegonzalez wrote: post #11
jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Having integrated with Github before - for providing OAuth and pulling private repositories - I will say that they've never really had fine-grained permissions. The scopes are here[1] and from what I can tell, I can't ask for private repo access to a _specific_ repository for a given OAuth token. Maybe this is different for a Github App, but just quickly browsing through their docs, I don't think this is the case eit…

They actually give you fine-grained permissions, down to the single repo access level – but only if you build a Github app. OAuth app don't offer that unfortunately and I assume are considered a bit "legacy".
Post reply on HN