Comment by mrinterweb | Hacker News Reader

Comment by mrinterweb | Hacker News Reader

Parent Full thread

The thing I'd like to see Github focus on with their API is granular permissions. There are many SASS integrations that I am just not comfortable with granting access to because I don't want to have any more than necessary 3rd parties having access to repositories. Please correct me if I'm wrong, but every time I grant an application access to my Github account, it automatically has access to all repositories I have access to. I know there are ways that organizations can set permissions such that they can approve app integrations. Still, there are private repositories I have that I would prefer to not have 3rd party integrations be able to access. With 3rd party SASS providers having access to private repositories, it would be trivial for code to be stolen or sold to competitors. If they wanted to be real nasty they could rebase and force push, delete branches, tags, inject malicious code. There are so many potential ways that providing full access to everything you have access to in Github could be exploited.

I would love to see Github add permissions to apps requesting OAuth permissions be able to restrict access to the repositories the 3rd party app has access to. It would also be nice to be able to revoke individual permissions.

[Edit] fixed some grammatical errors.

Hey! Just in case you missed it, the new GitHub Apps might be a suitable alternative for you - they can have granular permissions (https://developer.github.com/v3/apps/permissions/), so the app can select just enough permissions that it needs. For example, a GitHub App could request permissions to write issues, but not read your code - which isn't possible with OAuth Apps and scopes, as you mention. You also install them on a per repository basis, so you can pick and choose that access. Mostly these are for the app to carry out actions as itself (e.g. create a status, write an issue comment, run a build), but some actions as an authorized user are allowed just now. There's more info on them here: https://developer.github.com/apps/building-integrations/sett...

Thanks for pointing this out. I guess it will take a while before most services start taking advantage of the more granular permission APIs. I've lost count of how many SASS products offer Github integration and then ask for all the permissions. I never feel comfortable with that level of access so I always decline or create a new github account so I can contain access I am granting.

GitHub Apps (was called Integrations until today) allows for 'per repository' configuration. We use it at Percy.io and it works pretty well. It has some other parts that need smoothing (like a non-admin going through the flow), but GitHub's been improving it. :) I like it a lot.

+1 this a thousand times. The only way i have found to effectively lock things down is using an org and creating a new Github user just for third-party integrations.

Bitbucket is fast, and I believe focuses on repository permissions. Have you tried them?

Yes, though it has been a year or two. However it's more of a personal preference / fits within my normal work routine to use GH. I have a number of OS repos that, for community reasons, need to stay on GH, then most of my normal work is on GH which is generally where the concerns come in from a security standpoint.

I've done the same with creating multiple github user accounts . I think that is the only work around for some OAuth app integrations.

Reply on news.ycombinator.com