6 ms·

ok, great, when will I be able to scope tokens to acting on only one repo, or only one org, or in any meaningful way?

nathanaldensr 6y ago
I completely agree. This change is interesting and all, but GitHub (Enterprise, in my case) tokens aren't granular enough. There's a lot more benefit to be had in fixing that issue.
chatmasta 6y ago
I definitely agree this is needed, but I have to imagine it's quite a complex change on GitHub's side. It probably entails changing a lot of their authentication architecture, in terms of what's stateless and stateful and what requires a trip to the DB to check (i.e., it's hard to encode a list of which resources you should have access to in a single token). I'm sure they're aware this is a problem though. Maybe this recent change sets the groundwork for fixing it.
- threeseed 6y ago
  GitHub for me is running out of excuses for why the fundamentals of their platform is so poor. And why compared to Gitlab they deliver improvements at such an anaemic pace. They act like a company with 15 employees let alone 1,500+. Everything from Security, Actions, Containers, Packages, Terraform, JIRA Integration etc is either completely broken or has major outstanding issues that haven't been fixed for years.
  - chatmasta 6y ago
    Personally, we use GitLab for all the internal repos at our company. We originally migrated because GitLab CI was free and GitHub didn't even have a CI solution at the time. We still use GitHub for our public repos since that's "where the community is." GitHub actions is great, although IMO a bit too prescriptive (I'd rather write a script that can run anywhere rather than spend time building up the mental model of the abstractions that are unique to GHA). But nothing beats GitLab CI + container registry; we put a lot of work into our CI pipeline and now we've got incremental builds with a Docker image for every service tagged per commit. And since GitLab Container Registry supports manifest v2, we can take advantage of BuildKit layer caching (I think GitHub registry supports this now too, but haven't played with it). That said, GitLab has its fair share of problems too. GitHub UI is way better, community/discussion features are better, and forking/public collaboration workflow is better. I'm glad there are two big players in the space, though; GitLab really lit a fire under GitHub to finally get them to start pushing new features.
- RyJones 6y ago
  That the only method I have to scope tokens is to break the TOS for GitHub - by creating single-use accounts - is super lame.
  - JamesSwift 6y ago
    What TOS does it violate? They explicitly recommend creating machine users in certain areas of their help docs.
    - jpalomaki 6y ago
      This one? ”you may not have more than one free Account” https://docs.github.com/en/github/site-policy/github-terms-of-service#b-account-terms https://docs.github.com/en/github/site-policy/github-terms-o... But there’s also later more detailed guidance: ”One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine).”
      - kroltan 6y ago
        Presumably then it would be non-violating to have many paid accounts? Sure is pricey for smaller operations but depending on the value it brings to have this more granular scoping it surely might be worth it? Doesn't remove their need to implement a more reasonable way of scoping tokens, though.
      - ArchOversight 6y ago
        This means that if you create a work account that is separate from your personal account (because you don't use personal credentials on work machines and vice-versa) then you are technically in violation of the TOS... Yet this is something I, and many others, do because we don't want to mix business with pleasure. In fact I absolutely refuse to do so because of security reasons.
        Arnavion 6y ago
        Many Microsoft employees also have separate personal and work accounts. I would be surprised if that was a violation.
tptacek 6y ago
I'm sure this is a valid complaint about Github, but it has nothing to do with the article, which is a bit annoying since there's some cleverness in that article (checksumming tokens, for instance) that we could be talking about stealing, rather than turning this thread into a generic referendum on whether Github is good.
- chatmasta 6y ago
  The article is about GitHub's authentication tokens. It seems relevant to bring up a complaint about their scopes.
  - tptacek 6y ago
    And yet it's not, because this is an article about token formats, and not about entire authorization schemes.
- threeseed 6y ago
  a) I don't see what is particularly clever about their token algorithm. b) Talking about fundamental flaws in their token implementation seems relevant in a discussion about their token implementation. c) Public discussions about flaws are often the best way to educate others and make the company aware of them.
- prepend 6y ago
  It’s valid because GitHub is using cycles on format when the functionality is more important. I think these new formats are nice, but don’t care give how hard to use their token scheme is. Just some mention of other stuff coming would be nice. The problem I have is I’m not even sure if GitHub recognizes this as a problem (I have to grant access to every repo I can access to every script) and it’s been broken for years. Would be nice to know what they’re working on.
  - threeseed 6y ago
    This is what they are working on: https://github.blog/changelog/ https://github.blog/changelog/ It seems to me that its a PM centric process i.e. lots of end-user features rather than fixing the behind the scenes parts that are poorly designed and/or broken. We tried to workaround the inadequate token support by using their Terraform module for automation. Only for it to delete our repos losing years of issues because of a bug where renaming = deleting (3 year old issue that has never been prioritised).
paxys 6y ago
You can already do that today. Create a Github App and add it only to a single repo.
Serow225 6y ago
I'd be happy to have a repo read-only scope to start with, it seems a little nutty that in the year 2021 the only repo scope available is read-write https://docs.github.com/en/developers/apps/scopes-for-oauth-apps#available-scopes https://docs.github.com/en/developers/apps/scopes-for-oauth-...

I completely agree. This change is interesting and all, but GitHub (Enterprise, in my case) tokens aren't granular enough. There's a lot more benefit to be had in fixing that issue.

chatmasta 6y ago

I definitely agree this is needed, but I have to imagine it's quite a complex change on GitHub's side. It probably entails changing a lot of their authentication architecture, in terms of what's stateless and stateful and what requires a trip to the DB to check (i.e., it's hard to encode a list of which resources you should have access to in a single token). I'm sure they're aware this is a problem though. Maybe this recent change sets the groundwork for fixing it.

threeseed 6y ago
GitHub for me is running out of excuses for why the fundamentals of their platform is so poor. And why compared to Gitlab they deliver improvements at such an anaemic pace. They act like a company with 15 employees let alone 1,500+. Everything from Security, Actions, Containers, Packages, Terraform, JIRA Integration etc is either completely broken or has major outstanding issues that haven't been fixed for years.
- chatmasta 6y ago
  Personally, we use GitLab for all the internal repos at our company. We originally migrated because GitLab CI was free and GitHub didn't even have a CI solution at the time. We still use GitHub for our public repos since that's "where the community is." GitHub actions is great, although IMO a bit too prescriptive (I'd rather write a script that can run anywhere rather than spend time building up the mental model of the abstractions that are unique to GHA). But nothing beats GitLab CI + container registry; we put a lot of work into our CI pipeline and now we've got incremental builds with a Docker image for every service tagged per commit. And since GitLab Container Registry supports manifest v2, we can take advantage of BuildKit layer caching (I think GitHub registry supports this now too, but haven't played with it). That said, GitLab has its fair share of problems too. GitHub UI is way better, community/discussion features are better, and forking/public collaboration workflow is better. I'm glad there are two big players in the space, though; GitLab really lit a fire under GitHub to finally get them to start pushing new features.
RyJones 6y ago
That the only method I have to scope tokens is to break the TOS for GitHub - by creating single-use accounts - is super lame.
- JamesSwift 6y ago
  What TOS does it violate? They explicitly recommend creating machine users in certain areas of their help docs.
  - jpalomaki 6y ago
    This one? ”you may not have more than one free Account” https://docs.github.com/en/github/site-policy/github-terms-of-service#b-account-terms https://docs.github.com/en/github/site-policy/github-terms-o... But there’s also later more detailed guidance: ”One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine).”
    - kroltan 6y ago
      Presumably then it would be non-violating to have many paid accounts? Sure is pricey for smaller operations but depending on the value it brings to have this more granular scoping it surely might be worth it? Doesn't remove their need to implement a more reasonable way of scoping tokens, though.
    - ArchOversight 6y ago
      This means that if you create a work account that is separate from your personal account (because you don't use personal credentials on work machines and vice-versa) then you are technically in violation of the TOS... Yet this is something I, and many others, do because we don't want to mix business with pleasure. In fact I absolutely refuse to do so because of security reasons.
      - Arnavion 6y ago
        Many Microsoft employees also have separate personal and work accounts. I would be surprised if that was a violation.

tptacek 6y ago

I'm sure this is a valid complaint about Github, but it has nothing to do with the article, which is a bit annoying since there's some cleverness in that article (checksumming tokens, for instance) that we could be talking about stealing, rather than turning this thread into a generic referendum on whether Github is good.

chatmasta 6y ago
The article is about GitHub's authentication tokens. It seems relevant to bring up a complaint about their scopes.
- tptacek 6y ago
  And yet it's not, because this is an article about token formats, and not about entire authorization schemes.
threeseed 6y ago
a) I don't see what is particularly clever about their token algorithm. b) Talking about fundamental flaws in their token implementation seems relevant in a discussion about their token implementation. c) Public discussions about flaws are often the best way to educate others and make the company aware of them.
prepend 6y ago
It’s valid because GitHub is using cycles on format when the functionality is more important. I think these new formats are nice, but don’t care give how hard to use their token scheme is. Just some mention of other stuff coming would be nice. The problem I have is I’m not even sure if GitHub recognizes this as a problem (I have to grant access to every repo I can access to every script) and it’s been broken for years. Would be nice to know what they’re working on.
- threeseed 6y ago
  This is what they are working on: https://github.blog/changelog/ https://github.blog/changelog/ It seems to me that its a PM centric process i.e. lots of end-user features rather than fixing the behind the scenes parts that are poorly designed and/or broken. We tried to workaround the inadequate token support by using their Terraform module for automation. Only for it to delete our repos losing years of issues because of a bug where renaming = deleting (3 year old issue that has never been prioritised).

paxys 6y ago

You can already do that today. Create a Github App and add it only to a single repo.

Serow225 6y ago

I'd be happy to have a repo read-only scope to start with, it seems a little nutty that in the year 2021 the only repo scope available is read-write https://docs.github.com/en/developers/apps/scopes-for-oauth-apps#available-scopes https://docs.github.com/en/developers/apps/scopes-for-oauth-...