3 ms·
Signed commits would be useful, right? I don’t know much about GitHub permissions, but I’ve skimmed GitLab’s. Why would Docker hub have write access to the re
by donmcronald 8y ago
Signed commits would be useful, right? I don’t know much about GitHub permissions, but I’ve skimmed GitLab’s. Why would Docker hub have write access to the repo? Is there really no read only access for repos?
- rlt 8y agoI think it's possible, but I'm not sure what DockerHub does. GitHubs OAuth tokens can't be restricted to be read-only or to specific repos (https://stackoverflow.com/questions/26372417/github-oauth2-token-how-to-restrict-access-to-read-a-single-private-repo https://stackoverflow.com/questions/26372417/github-oauth2-t...) but I think Deploy Keys can.
- donmcronald 8y agoThey have a lot of scopes compared to GitLab (https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/ https://developer.github.com/apps/building-oauth-apps/unders...). I find it crazy that anyone would click authorize on a 3rd party app with the repo scope without having a way to (easily) identify unauthorized commits.
- Kalium 8y agoA lot of developers are in a hurry and interested mainly in getting their builds to work so they can move on to the thing they actually care about. They don't think about the potential consequences of the easiest thing they did to make it work. This is how a sizable number of security incidents happen. The easiest thing to do is reckless, so people do it.