Hacker News Reader

Comment by __MatrixMan__ | Hacker News Reader

The "nothing to see here" approach to access control has a lot of weird culture-consequences. I wish software would just address me like the peasant that I am, rather than trying to gaslight me into believing that my artificially limited world is the whole one.

View on HN

If there's nothing wrong with me, maybe there's something wrong with the universe...The universe is a spheroid region, 705 meters in diameter.

I think you don't want to reveal the presence of projects by name or not -- just the name of repo could be sensitive info, potentially.

Except they know you've accessed it previously. Its a different threat model that leaves room for a little more agency to be given to the user.

I think if they can't access the server for authentication, it's likely they can't retrieve history either.

Or know which user to pull history for

Cookies? When you are not authenticated, it's still a 1st party.

It shouldn't be on github then. At all.

Why the downvotes? If you want real security, self-host your Git repo.

Which is neither difficult nor against the design of git.

I'll bite. So you want to host a git repo. You need to manage SSH keys then, and then you'll want bug tracking and PRs for code reviews. This means that you need to host something like Gitlab, which is not free if you want features like SSO.

Gitea has SSO and is free.

In the old days this was done over email. "PRs" are a GitHub thing, not a Git thing.

I'll defend.

> just the name of repo could be sensitive info

The phrase "sensitive info" tells me disclosing it to a mass code hoster bare any liability deems irresponsible. Remember Eric Schmidt about privacy on the internet?

Choose your priorities.

No true Scotsman! Throw your computer into a lake! Write your new darknet market ecommerce platform on sticky notes!

Why is “security” always a pissing constant with some people. I’d swear that I’d be condemned for locking my house at night instead of simply encasing myself in concrete for all eternity like Chernobyl. After all, it’s more secure!

I understand the reason for it. I just don't think it's worth the price we continually pay in debugging time.

I think if you are in a corporate account and have correct access permissions to the account (i.e. URL namespace) it should not show 404. It's just super confusing.

Reply on news.ycombinator.com