Hacker News new | ask | show | jobs
by aleem 4049 days ago
Beware, granting access to this app (or others like it) will mean it will have access to everything including your private repos' source code. This is pretty bad. If you are going to use this to access your company/startup repo, you should probably get approval from your lead or manager before installing it.

Unfortunately, Github, for all it's security efforts, still does not offer token permissions to be limited to "Issues" only. It's all or nothing when it comes to repos. Github's own native client/app doesn't have issue tracking either. This means there are lots of people installing these kind of apps for issue tracking and inevitably the security is as good as the weakest link in this chain. I wish someone at Github could remedy this.

IssuePost http://issuepostapp.com/ is a similar app. However, the developer has revoked the app for similar reasons.

> Issuepost is unavailable at the moment. Unfortunately, GitHub's OAuth API authorizes access to the entirety of users' private repos, and does not allow you to only request access to read/write issues. As a result, I have decided to pull the app from the App Store until I can find a better way to make the app more secure.
3 comments
mik3y 4049 days ago
I tried hailing a random security Githubber or two on Twitter about the lack of an issues-only oauth scope; no response.

I can only conclude they're holding it back deliberately, since it seems both a glaring omission and simple fix. GitHub, prove me wrong..

link
z1mm32m4n 4046 days ago
Ahh, that's disappointing. I guess for now I'll just stick with https://github.com/stephencelis/ghi.

One thing that I discovered after seeing that Shrink lists "Subscribed" issues is that ghi has an option '-f' which lets you filter by 'all', 'assigned', 'created', 'mentioned', or 'subscribed', which is all I need for my purposes.

link
thisishugo 4049 days ago
Well, you can at least limit it to only seeing your public repos and not the private ones[0]. Of course, that doesn't negate the fact that should the developer have coded the app to modify your code, you can't do anything to stop them.

[0] http://c.thisishugo.com/1bPz7+

link