6 ms·

That the only method I have to scope tokens is to break the TOS for GitHub - by creating single-use accounts - is super lame.

JamesSwift 6y ago
What TOS does it violate? They explicitly recommend creating machine users in certain areas of their help docs.
- jpalomaki 6y ago
  This one? ”you may not have more than one free Account” https://docs.github.com/en/github/site-policy/github-terms-of-service#b-account-terms https://docs.github.com/en/github/site-policy/github-terms-o... But there’s also later more detailed guidance: ”One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine).”
  - kroltan 6y ago
    Presumably then it would be non-violating to have many paid accounts? Sure is pricey for smaller operations but depending on the value it brings to have this more granular scoping it surely might be worth it? Doesn't remove their need to implement a more reasonable way of scoping tokens, though.
  - ArchOversight 6y ago
    This means that if you create a work account that is separate from your personal account (because you don't use personal credentials on work machines and vice-versa) then you are technically in violation of the TOS... Yet this is something I, and many others, do because we don't want to mix business with pleasure. In fact I absolutely refuse to do so because of security reasons.
    - Arnavion 6y ago
      Many Microsoft employees also have separate personal and work accounts. I would be surprised if that was a violation.
      - masklinn 6y ago
        It is explicitly a technical violation of the TOS. In practice this is mostly so github has a reason to misuses like bots which might not be caught by the anti-spam measure. They do mind a bit but not too much, and you can get help from support having literally stated that you have multiple accounts. For instance if you're testing an extension or integration with github, and there are specific interactions between different users… you kinda need different users to test it. And mocking github may not be sufficient.
        Arnavion 6y ago
        Yes. I'm talking specifically about the "separate personal and work accounts" case. It may very well be a TOS violation as the TOS is written. I'm saying I'd be surprised if they treated it as one.
        chatmasta 6y ago
        I'm actually dealing with something like this right now and am curious what solutions people use for e2e testing of OAuth flows. I'm leaning toward creating a test account at each Identity Provider, but then I have to deal with things like 2FA. I guess it's not so bad if I just use a TOTP generator on the client, but if they want to send an email to verify my account, that's just annoying.
        derefr 6y ago
        Aren’t the work accounts, paid accounts? The TOS only restricts having multiple free accounts.
        ArchOversight 6y ago
        No, the work accounts are not paid accounts. My work requires me to interact with Open Source projects and the like. We have our own hosted Gitlab instance for our internal projects. The work account is strictly to communicate with/provide patches back to upstream projects. I have multiple personal accounts on Github. One for each employer I have worked at in the past couple of years, and my personal account that is tied to my own identity and is used for my personal time projects/open source work that is not tied to $work.
  - TheSoftwareGuy 6y ago
    Well the solution is simple, just make a new LLC for each GitHub account you need! I'm definitely kidding, but unless there is more in there TOS (which I don't intend to read) I don't see why this wouldn't be a workable loophole
  - tptacek 6y ago
    Whatever the letter of this restriction is, that's not its spirit. Our practice at my last company was per-client segregated accounts, and I have a mailbox full of discussions with Github support staff telling us that was OK.
    - marcinzm 6y ago
      This seems like a classic case of rules with high potential for selective enforcement which generally leads to unfair enforcement. It's fine as long as you don't somehow get on Github's bad side and if you do it's an instant reason to close your accounts.
threeseed 6y ago
Don't forget that creating new accounts costs money. If you want to take advantage of Environments for example then you need to pay for the Enterprise license which means every account is another $21/month. That adds up for individual and startup use. I am actually confused why we can't just have tokens assigned to organisations and not users.

JamesSwift 6y ago

What TOS does it violate? They explicitly recommend creating machine users in certain areas of their help docs.

jpalomaki 6y ago
This one? ”you may not have more than one free Account” https://docs.github.com/en/github/site-policy/github-terms-of-service#b-account-terms https://docs.github.com/en/github/site-policy/github-terms-o... But there’s also later more detailed guidance: ”One person or legal entity may maintain no more than one free Account (if you choose to control a machine account as well, that's fine, but it can only be used for running a machine).”
- kroltan 6y ago
  Presumably then it would be non-violating to have many paid accounts? Sure is pricey for smaller operations but depending on the value it brings to have this more granular scoping it surely might be worth it? Doesn't remove their need to implement a more reasonable way of scoping tokens, though.
- ArchOversight 6y ago
  This means that if you create a work account that is separate from your personal account (because you don't use personal credentials on work machines and vice-versa) then you are technically in violation of the TOS... Yet this is something I, and many others, do because we don't want to mix business with pleasure. In fact I absolutely refuse to do so because of security reasons.
  - Arnavion 6y ago
    Many Microsoft employees also have separate personal and work accounts. I would be surprised if that was a violation.
    - masklinn 6y ago
      It is explicitly a technical violation of the TOS. In practice this is mostly so github has a reason to misuses like bots which might not be caught by the anti-spam measure. They do mind a bit but not too much, and you can get help from support having literally stated that you have multiple accounts. For instance if you're testing an extension or integration with github, and there are specific interactions between different users… you kinda need different users to test it. And mocking github may not be sufficient.
      - Arnavion 6y ago
        Yes. I'm talking specifically about the "separate personal and work accounts" case. It may very well be a TOS violation as the TOS is written. I'm saying I'd be surprised if they treated it as one.
      - chatmasta 6y ago
        I'm actually dealing with something like this right now and am curious what solutions people use for e2e testing of OAuth flows. I'm leaning toward creating a test account at each Identity Provider, but then I have to deal with things like 2FA. I guess it's not so bad if I just use a TOTP generator on the client, but if they want to send an email to verify my account, that's just annoying.
      - derefr 6y ago
        Aren’t the work accounts, paid accounts? The TOS only restricts having multiple free accounts.
        ArchOversight 6y ago
        No, the work accounts are not paid accounts. My work requires me to interact with Open Source projects and the like. We have our own hosted Gitlab instance for our internal projects. The work account is strictly to communicate with/provide patches back to upstream projects. I have multiple personal accounts on Github. One for each employer I have worked at in the past couple of years, and my personal account that is tied to my own identity and is used for my personal time projects/open source work that is not tied to $work.
- TheSoftwareGuy 6y ago
  Well the solution is simple, just make a new LLC for each GitHub account you need! I'm definitely kidding, but unless there is more in there TOS (which I don't intend to read) I don't see why this wouldn't be a workable loophole
- tptacek 6y ago
  Whatever the letter of this restriction is, that's not its spirit. Our practice at my last company was per-client segregated accounts, and I have a mailbox full of discussions with Github support staff telling us that was OK.
  - marcinzm 6y ago
    This seems like a classic case of rules with high potential for selective enforcement which generally leads to unfair enforcement. It's fine as long as you don't somehow get on Github's bad side and if you do it's an instant reason to close your accounts.

threeseed 6y ago

Don't forget that creating new accounts costs money. If you want to take advantage of Environments for example then you need to pay for the Enterprise license which means every account is another $21/month. That adds up for individual and startup use. I am actually confused why we can't just have tokens assigned to organisations and not users.