6 ms·

I wonder how many devs out there are going to basically hand over access to their companies property (private code repos) to this random guy by "signing in with

I wonder how many devs out there are going to basically hand over access to their companies property (private code repos) to this random guy by "signing in with github", without even thinking about what they're doing.

hobofan 8y ago
By default access to private organization repositories is not given, and has to be specifically requested from the organization.
- mike-cardwell 8y ago
  That's a good default.
deleted 8y ago
[deleted]
blairanderson 8y ago
its only for public files.
- mike-cardwell 8y ago
  Nope
alanbernstein 8y ago
Where is the "sign in with github" prompt?
- TheArcane 8y ago
  Comes up if you request githistory for a file in a private repository
typpo 8y ago
I'm a bit sad to see this cynicism at the top of a Show HN thread. This project is a fun way to browse code history and it's done with an interesting visual style. It's also open source. I would think someone trying to view a private file is aware that they are signing in via Github to share it. Github Oauth also explicitly states that code access is shared. So, I don't think it detracts from pomber's project.
- kevintb 8y ago
  Agreed, but this is the default attitudes of most HN comments - to criticize or nitpick something small.
  - olafure 8y ago
    Giving someone else access to your organisation's private repo is not a small thing in my opinion.
  - nohnce 8y ago
    I think we can do our part to vote up the comments that are more supportive and change the norm.
- mike-cardwell 8y ago
  There was nothing cynical about my comment. So you are sad for no reason. The privacy implication of handing over access to private code repos to a complete stranger is real, and this project should warn users that this is what they are doing, front and center. This project could (and arguably should) have been built in such a way that it didn't require you to hand over read access to your private code repos. It could have been built as a browser addon or greasemonkey plugin. "I would think someone trying to view a private file is aware that they are signing in via Github to share it." - I don't agree. That is why I wrote my comment. I think lots of people would not even consider the implications of what they are doing. This project doesn't even appear to have a privacy policy or terms and conditions, of any description, so who knows what they're doing with your source code. They could legitimately clone all the private repos that you give them access to, and keep them for statistical analysis or for personal commercial exploitation. Maybe you created a private repo for a NodeJS project but didn't switch the default license specified by NPM from ISC because nobody else should ever have seen the code. Now you've just given your code to a third party with a license that is functionally equivalent to MIT. They can chuck it up in a public github repo and let whoever wants to, use it.

hobofan 8y ago

By default access to private organization repositories is not given, and has to be specifically requested from the organization.

mike-cardwell 8y ago
That's a good default.

deleted 8y ago

[deleted]

blairanderson 8y ago

its only for public files.

mike-cardwell 8y ago
Nope

alanbernstein 8y ago

Where is the "sign in with github" prompt?

TheArcane 8y ago
Comes up if you request githistory for a file in a private repository

typpo 8y ago

I'm a bit sad to see this cynicism at the top of a Show HN thread. This project is a fun way to browse code history and it's done with an interesting visual style. It's also open source. I would think someone trying to view a private file is aware that they are signing in via Github to share it. Github Oauth also explicitly states that code access is shared. So, I don't think it detracts from pomber's project.

kevintb 8y ago
Agreed, but this is the default attitudes of most HN comments - to criticize or nitpick something small.
- olafure 8y ago
  Giving someone else access to your organisation's private repo is not a small thing in my opinion.
- nohnce 8y ago
  I think we can do our part to vote up the comments that are more supportive and change the norm.
mike-cardwell 8y ago
There was nothing cynical about my comment. So you are sad for no reason. The privacy implication of handing over access to private code repos to a complete stranger is real, and this project should warn users that this is what they are doing, front and center. This project could (and arguably should) have been built in such a way that it didn't require you to hand over read access to your private code repos. It could have been built as a browser addon or greasemonkey plugin. "I would think someone trying to view a private file is aware that they are signing in via Github to share it." - I don't agree. That is why I wrote my comment. I think lots of people would not even consider the implications of what they are doing. This project doesn't even appear to have a privacy policy or terms and conditions, of any description, so who knows what they're doing with your source code. They could legitimately clone all the private repos that you give them access to, and keep them for statistical analysis or for personal commercial exploitation. Maybe you created a private repo for a NodeJS project but didn't switch the default license specified by NPM from ISC because nobody else should ever have seen the code. Now you've just given your code to a third party with a license that is functionally equivalent to MIT. They can chuck it up in a public github repo and let whoever wants to, use it.