Okta says its GitHub account hacked, source code stolen

Re:Okta says its GitHub account hacked, source code stolen by e1g on Wednesday December 21, 2022 @05:31AM (#34078907)

They work, but the organization needs to approve the token (and its scope). As the org manager, I prefer it this way because I can audit what access developers give out to what repositories.

The new tokens are still in Beta, so there are some other limitations: for example, GitHub Packages do not support them yet, so you cannot use them in Yarn/NPM to get private packages hosted on GitHub.

[ Parent | on HN ]

Re:Okta says its GitHub account hacked, source code stolen by Aeolun on Wednesday December 21, 2022 @06:30AM (#34079284)

Doesn't this rather defeat the point? If using a PAT is simpler than using the org token then I'll just use a PAT that has access to every single repository in the org.

[ Parent | on HN ]

Re:Okta says its GitHub account hacked, source code stolen by e1g on Wednesday December 21, 2022 @06:59AM (#34079513)

GitHub Org admins have the option to block all regular PATs, and only allow fine-grained tokens that they pre-approve. This block is “off” by default, but I expect the best practice soon will be to enforce this rule.

[ Parent | on HN ]

Re:Okta says its GitHub account hacked, source code stolen by Aeolun on Wednesday December 21, 2022 @08:02AM (#34080155)

Oh, aside from the pre-approval, that would be really nice. I need stuff scoped to the org that is not necessarily connected to my personal account (and all it’s repositories).

[ Parent | on HN ]