5 ms·
How would stars and watchers work on a private repo, though?
by maleldil 5y ago
How would stars and watchers work on a private repo, though?
- jakelazaroff 5y agoJust don't show them. Filter out private repos before showing a user's stars, notifying them of issues, etc.
- lalopalota 5y agoRight, just more work. More tests. More edge cases. More time.
- jakelazaroff 5y agoSure. But that’s the cost of good UX.
- 14u2c 5y agoWell, they put in the time to test a massive cascading delete operation. Surly a flag would have offered far less possibility of catastrophic outcomes and therefore would been significantly easier to confidently develop and test.
- mypalmike 5y agoIf they are using a database's built in support for cascading deletes, and if the star tables are simple m2m tables (basically just 2 fk's per row), the work to implement and test cascading deletes is trivial.
- hnlmorg 5y agoCascade delete is a less risky operation from a security stand point. There are so many edge cases where potentially sensitive information could get leaked with regards to subscribed private repos if not handled correctly. In fact I have personally filed a bug bounty with GitHub after discovering just such a bug. I’m not saying there isn’t a better way Github could handle this situation. Just that I do sympathise with the decision to cascade delete.
- Jowsey 5y agoCould just make them inactive for a while, but still registered. Stop sending notifications to watchers, and replace the repo in the stargazer's starred list with a "The following starred repos are currently private and cannot be viewed:" and make the stars be remove-only for a while.