Re:Okta says its GitHub account hacked, source code stolen
by awinter-py on Wednesday December 21, 2022 @09:51AM
(#34081400)
overbroad roles + permissions is such a problem on every platform. github surprisingly bad given their technical sophistication overall
on my long-term wishlist: a standard way to aspirationally reduce your permissions footprint
like if I'm a twitter plugin, and I need one operation for which there is only a broad permission, I request the broad permission ('read and write everything'), but include an optional manifest making it clear that I only need the one action ('add followers')
this 1) enables a linter ecosystem to verify my footprint is narrower than it seems, and 2) over time lets the platform tailor offer narrower perms based on observed use-cases
permissions matter bc users can audit them more easily than code
on my long-term wishlist: a standard way to aspirationally reduce your permissions footprint
like if I'm a twitter plugin, and I need one operation for which there is only a broad permission, I request the broad permission ('read and write everything'), but include an optional manifest making it clear that I only need the one action ('add followers')
this 1) enables a linter ecosystem to verify my footprint is narrower than it seems, and 2) over time lets the platform tailor offer narrower perms based on observed use-cases
permissions matter bc users can audit them more easily than code