3 ms·

This has been bothering me for a while too. Without repo-specicific permissions at least, it sort of requires me to have separate github accounts for personal

This has been bothering me for a while too. Without repo-specicific permissions at least, it sort of requires me to have separate github accounts for personal stuff, work stuff, contract stuff (per client) etc, doesn't it? Even if I'm willing to risk Some Serivce(tm) having write access to all my repos cause I want it for a personal project, I can't ethically give it access to work/client repos too. And yet, I must. Or have a bunch of different accounts. Who can keep track of that? I think most people just end up, dangerously and arguably unethically, giving a service access to all their client/work projects, when they wanted it on only one of them. In some cases github via Oauth or whatever is going on seems to give more granular access. I've seen it look entirely different (like entirely different screens) in different contexts I"m auth'ing some third party service. Maybe it's different historical APIs all still in use? I can't keep track of what's going on, it just all confuses me -- which makes it even harder to know if a service is asking for appropriate permissions or not, I'm not really sure what the possiblities are, they seem very inconsistent.

XorNot 6y ago
There's also two sides to this: services can ask for permissions, but I want to be able to only pretend to give them some - i.e. asking for all repos access should let me lie and say "no only things such match this regex or this security tag".
judge2020 6y ago
The correct way is either you join their GH org (which is the best method in terms of IP ownership as well) or you create a GH org for each contract and set up apps with access to only relevant repos in that org.
- jrochkind1 6y ago
  It's not clear to me how that helps, but you're probably right it does. But I feel like some things have gotten access to a token via a web-auth procedure such that they have access to anything my account does, across organizations. I swear I have seen flows that ask me to give them that, and don't let me even limit to certain organizations. But I may be misunderstanding, for sure. The real problem is that i just don't understand github's auth model for third-party api access. So I have trouble understanding what the possiblities are, what permissions I"m granting, and if they were the minimum permissions the app could have asked for or not. Every time I go through it, it seems to be different than the time before.

XorNot 6y ago

There's also two sides to this: services can ask for permissions, but I want to be able to only pretend to give them some - i.e. asking for all repos access should let me lie and say "no only things such match this regex or this security tag".

judge2020 6y ago

The correct way is either you join their GH org (which is the best method in terms of IP ownership as well) or you create a GH org for each contract and set up apps with access to only relevant repos in that org.

jrochkind1 6y ago
It's not clear to me how that helps, but you're probably right it does. But I feel like some things have gotten access to a token via a web-auth procedure such that they have access to anything my account does, across organizations. I swear I have seen flows that ask me to give them that, and don't let me even limit to certain organizations. But I may be misunderstanding, for sure. The real problem is that i just don't understand github's auth model for third-party api access. So I have trouble understanding what the possiblities are, what permissions I"m granting, and if they were the minimum permissions the app could have asked for or not. Every time I go through it, it seems to be different than the time before.