4 ms·
> If you want to analyze non-public repositories, sign in with your GitHub account Do people really expose their or their employer's source code to random thir
by oliwarner 8y ago
> If you want to analyze non-public repositories, sign in with your GitHub account
Do people really expose their or their employer's source code to random third party convenience services?
I do understand the convenience factor here, I just think it's dodgy to encourage developers to be so flippant with privileged access.
- dschep 8y agoIt also has the option to upload a package.json which is far less exposure, and can easily be tweaked to omit anything sensitive.
- oliwarner 8y agoIt's still not no-exposure, and it's still getting a developer in the mindset that just sending out files on a whim is okay. I'm not wholly against this sort of stuff, I'm sure we've used similar links in the past for CI and coverage, but it seems to be the end of the slope, where we're handing out access to our stuff for something so frivolous. This is the same sort of mechanism that got everybody and their dog's copies of Windows XP infected with trojans in the early 2000s. "Sure, I'll install that toolbar, just let me see Britney naked". This could be a local, auditable script that fetched a static list of projects seeking funding.
- thatjsguy 8y agoTo be fair, I don’t think this is intentionally bad privacy-wise. I think that, uh, a lot of the JavaScript set doesn’t actually know how to write code that doesn’t involve uploading shit to websites. When all you have is a hammer...
- is_true 8y agoThat's a bit too much. Shouldn't even be an option.