Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ...
by 0xbadcafebee on Wednesday February 10, 2021 @10:21AM
(#26090307)
> It seems dumb that they don’t have per repo tokens.
Technically you can create one new GitHub account per repo and generate a token for that... But that is highly annoying :)
They need to support IAM / RBAC style policies and tie every authn+z method to those policies, but my guess is they have different auth methods strung all throughout their codebase so implementing it will take a few years. Then of course they have to make it "user friendly" as we all know how painful IAM can be...
Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ...
by prepend on Wednesday February 10, 2021 @05:13PM
(#26095516)
Comically, that’s why my GitHub recommended. Of course that’s a nightmare for a user to manage, violates our sso requirement, and GitHub charges per user.
Technically you can create one new GitHub account per repo and generate a token for that... But that is highly annoying :)
They need to support IAM / RBAC style policies and tie every authn+z method to those policies, but my guess is they have different auth methods strung all throughout their codebase so implementing it will take a few years. Then of course they have to make it "user friendly" as we all know how painful IAM can be...