Show HN: Deploy to K8s without YAML using ShuttleOps

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by xgbi on Tuesday October 06, 2020 @12:19PM (#24699399)

Be careful: with Github auth, the redirection directs you to a non-HTTPS version of their app. The Github token might leak at that point...

EDIT: I don't even know how it is possible, this is an Oauth2 Flow and should never redirect to a non HTTP URL from Github.

Also: the fact that shuttleio doesn't have hsts or at least a 301 to HTTPS from HTTP is not brilliant either.

[ Parent | on HN ]

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by echelon on Tuesday October 06, 2020 @12:24PM (#24699493)

This should be the top comment until remedied. This is super dangerous.

[ Parent | on HN ]

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by xgbi on Tuesday October 06, 2020 @12:55PM (#24699926)

I created a report for Github, this is a leak on their side.

And contacted ShuttleIO by mail.

This could be ugly, Shuttle asks for broad permissions on Github.

[ Parent | on HN ]

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by gscho on Tuesday October 06, 2020 @01:07PM (#24700057)

Thank you for catching this. We are resolving this now

[ Parent | on HN ]

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by gscho on Tuesday October 06, 2020 @02:14PM (#24700700)

Just a quick update. We have disabled oAuth2 logins (Github, GitLab and BitBucket) temporarily while we update our configuration settings.

[ Parent | on HN ]

Re:Show HN: Deploy to K8s without YAML using ShuttleOps by gscho on Tuesday October 06, 2020 @06:51PM (#24703322)

We've resolved the issue with all 3 providers, thank you!

[ Parent | on HN ]