|
|
|
|
|
|
by seanhunter
982 days ago
|
|
|
I always felt these kind of integrations ask for so much access in return for so little additional functionality. Do I A- give you access to all my documents so you can make a thumbnail when I attach a document or B- not do that and not get a thumbnail, so I just look at the document outside of slack before attaching it? That's never been a complicated decision for me. |
|
|
- The app just requests may more permissions than required. Often times you'll see an app that just requires read access that is requested read, write, personal email, and blood of your first born.
I worked on a service that integrated with a lot of services that store data that one would deep business sensitive. When I'd always minimize permissions while setting up development, I had PMs/decision makers require that we ask for maximum permissions so future changes are easier. Felt wrong to me.
- The service (OAuth2 provider) not have fine-grained enough permissions. Sometimes there would only be the option for "read" or "write". Sometimes you'd get access to "read documents", but you couldn't restrict the type of documents. The more options there are, the more confusing it can be, but the more control and security the user has and I think that's much more important than development confusion.
I will say that I really appreciated what Notion does where they'll give you the ability to approve access to individual pages and while querying for pages you'll only ever see ones you've been granted access. The other side is that now a user has to approve each next page. The is also the option to allow everything existing and going forward. I think that's a great middle ground that gives control to the user. Whether the average user takes advantage of that is another question all together.