News for hackers. Stuff that matters.
Re:Why even let users set their own passwords? by crote on Saturday July 22, 2023 @11:22AM (#36826989)
Personal Access Tokens are intended for fully automated access, such as a deployment pipeline. They are not intended for daily use, and step 4 even explicitly says "Need an API token for scripts or testing?".

For regular pushing you are expected to use a SSH key, and those are far easier to add.

Re:Why even let users set their own passwords? by seabass-labrax on Saturday July 22, 2023 @11:29AM (#36827048)
Indeed, but you still need a Personal Access Token to integrate pull requests and issues with your Git client. GitHub doesn't support SSH authentication in those cases.
Re:Why even let users set their own passwords? by ghusto on Saturday July 22, 2023 @02:50PM (#36828723)
By git client, do you mean something other than git? Something like a CI system? Even there you can use an SSH key?
Re:Why even let users set their own passwords? by tagamma on Saturday July 22, 2023 @04:06PM (#36829359)
I think they mean a desktop GUI application on top of git like GitKraken or SourceTree. These sometimes allow you to perform actions like creating a PR (which is not done via git itself, of course).
Re:Why even let users set their own passwords? by brasic on Saturday July 22, 2023 @06:58PM (#36830772)

  > but you still need a Personal Access Token to integrate pull requests and issues with your Git client
(Nitpick from a former GH employee) PATs really are almost exclusively intended for personal testing with curl and such. The strongly preferred way for apps like you describe to work is a pseudo-OAuth flow (“GitHub Apps”) which yields a token that is not a Personal Access Token. Better in just about every way: more ergonomic, more secure (revocable, shorter duration, predictable fine grain scope with a mechanism for requesting additional permissions as apps change, etc), and requests are attributable to the application which generated them instead of just the user. If you use an app that actually requires generating and pasting a PAT, it’s either extremely old or made by someone who is not prioritizing security and user experience. It even works well in CLI apps, cf. the `gh` command line utility.
Re:Why even let users set their own passwords? by seabass-labrax on Saturday July 22, 2023 @07:32PM (#36831011)
I should have clarified; sorry. I was referring to how some editors and IDEs can interact with git repositories. For instance, if I was editing a file that had uncommitted changes, it might display that text in a different colour. Interaction with GitHub might be in the form of browsing pull requests within the IDE.

This is what I do with Emacs using a package called Magit[1]; VS Code comes with something similar.

[1]: https://magit.vc/