4 ms·

If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. I am always uneasy when an application even th

by Sytten 5y ago

If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. I am always uneasy when an application even thrust worthy like sentry asks access to ALL my private repositories even when they dont need it. I feel that in 2022 GitHub is way too critical to many organizations and they should really work on stricter rules. Even google requires special and costly audits from oauth applications to access users critical data like drive and emails.

bswinnerton 5y ago
https://docs.github.com/en/developers/apps/getting-started-with-apps/differences-between-github-apps-and-oauth-apps#requesting-permission-levels-for-resources https://docs.github.com/en/developers/apps/getting-started-w...
judge2020 5y ago
All the oauth prompts I’ve gotten in the past 3 years or so seem to have the granular per-repo control you’re looking for.
- media-trivial 5y ago
  Only "app installations" from the GitHub marketplace can be limited to specific repositories. For OAuth apps this is not possible sadly (everything that uses GitHub to login or connect accounts, e.g. Travis CI, Terraform Registry, Heroku).
greggman3 5y ago
I wrote about this a couple of years ago https://games.greggman.com/game/github-permission-problem/ https://games.greggman.com/game/github-permission-problem/ Github has (had) some of the worst wording in the permission prompts as well as too many 3rd party apps asking for blanket permission to do anything and everything in all your repos. It might as well be "hey, give us root on your servers and our new service will do cool things for you!" And even worse is the 1000s and 1000s of repos that have signed up for those services including all kinds of popular libraries. They've given the keys to hack the libraries at will to 10s or 100s of random companies that integrate with github. It's insane.
- deleted 5y ago
  [deleted]
media-trivial 5y ago
> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security. Maybe GitHub will implement this feature now. My hopes are high.
- kall 5y ago
  Aren't OAuth tokens scoped to org? Wouldn't it be easier to create an org per repo? I guess it might get expensive depending on your usage/collaborators. Edit: nevermind OAuth tokens are not org-scoped, only apps are
chucke 5y ago
> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. Just noting that gitlab has supported per repo tokens for ages. Yes, it's really useful, as this incident can attest.
yuvadam 5y ago
Github already has per-repo scope, and has supported that for at least several years AFAIR.
- daenney 5y ago
  Unfortunately no. GitHub Apps can be scoped to a repo, GitHub OAuth tokens cannot. A lot of things fall in the second category. You’ll also discover this if you try to create a personal access token, it’s all repos, you can’t limit them to a particular repo.
  - lmeyerov 5y ago
    Disturbingly, their own products like azure dev portal largely push you into such a grant-universal-access-for-every-contributor path Their sec org is impressive, so these occasional massive things have been surprising

by Sytten 5y ago

bswinnerton 5y ago

https://docs.github.com/en/developers/apps/getting-started-with-apps/differences-between-github-apps-and-oauth-apps#requesting-permission-levels-for-resources https://docs.github.com/en/developers/apps/getting-started-w...

judge2020 5y ago

All the oauth prompts I’ve gotten in the past 3 years or so seem to have the granular per-repo control you’re looking for.

media-trivial 5y ago
Only "app installations" from the GitHub marketplace can be limited to specific repositories. For OAuth apps this is not possible sadly (everything that uses GitHub to login or connect accounts, e.g. Travis CI, Terraform Registry, Heroku).

greggman3 5y ago

I wrote about this a couple of years ago https://games.greggman.com/game/github-permission-problem/ https://games.greggman.com/game/github-permission-problem/ Github has (had) some of the worst wording in the permission prompts as well as too many 3rd party apps asking for blanket permission to do anything and everything in all your repos. It might as well be "hey, give us root on your servers and our new service will do cool things for you!" And even worse is the 1000s and 1000s of repos that have signed up for those services including all kinds of popular libraries. They've given the keys to hack the libraries at will to 10s or 100s of random companies that integrate with github. It's insane.

deleted 5y ago
[deleted]

media-trivial 5y ago

> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security. Maybe GitHub will implement this feature now. My hopes are high.

kall 5y ago
Aren't OAuth tokens scoped to org? Wouldn't it be easier to create an org per repo? I guess it might get expensive depending on your usage/collaborators. Edit: nevermind OAuth tokens are not org-scoped, only apps are

chucke 5y ago

> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository. Just noting that gitlab has supported per repo tokens for ages. Yes, it's really useful, as this incident can attest.

yuvadam 5y ago

Github already has per-repo scope, and has supported that for at least several years AFAIR.

daenney 5y ago
Unfortunately no. GitHub Apps can be scoped to a repo, GitHub OAuth tokens cannot. A lot of things fall in the second category. You’ll also discover this if you try to create a personal access token, it’s all repos, you can’t limit them to a particular repo.
- lmeyerov 5y ago
  Disturbingly, their own products like azure dev portal largely push you into such a grant-universal-access-for-every-contributor path Their sec org is impressive, so these occasional massive things have been surprising