Re:Ask HN: Developer abused “sign in with GitHub”?
by 9wzYQbTYsAIc on Friday December 09, 2022 @06:06AM
(#33920045)
Sounds like a good use case for Rich Authorization Requests <https://www.ietf.org/archive/id/draft-ietf-oauth-rar-18.html>
Re:Ask HN: Developer abused “sign in with GitHub”?
by danuker on Friday December 09, 2022 @05:36AM
(#33919832)
Finetuned permissions cost to implement. GitHub doesn't have them (maybe we wouldn't have seen this post if it had).
Therefore if you want them, pay up or do it yourself.
Re:Ask HN: Developer abused “sign in with GitHub”?
by masklinn on Friday December 09, 2022 @08:55AM
(#33921232)
> Finetuned permissions cost to implement. GitHub doesn't have them (maybe we wouldn't have seen this post if it had).
They exist for github apps, and they're being rolled out for PATs alongside forced expiration: https://github.blog/2022-10-18-introducing-fine-grained-pers...
Not sure there's any way for them to happen for oauth apps though. And even if they do, they're opt-in for the app and the old broad scope will remain. At best the broad scopes would only be accessible to old apps grandfathered in but that ain't much (there's probably a billion abandoned oauth applications you could purchase for that grandfathering).
Re:Ask HN: Developer abused “sign in with GitHub”?
by Already__Taken on Sunday December 11, 2022 @01:54PM
(#33946167)
Fine, put that behind my $x/mo account + service accounts.
$x/mo * Service accounts is dumb.
Re:Ask HN: Developer abused “sign in with GitHub”?
by josephcsible on Friday December 09, 2022 @01:08PM
(#33924483)
That's not a practical suggestion, since GitHub isn't self-hosted or open-source.
Similarly we shouldn't bill for service accounts, especially when they're documented as the way to limit API token access. It's self-defeatist like taxing longer passwords.