3 ms·

I know this doesn’t help your current problem, but there should have been a list of permissions your were granting during the setup flow. Anything more than ask

I know this doesn’t help your current problem, but there should have been a list of permissions your were granting during the setup flow. Anything more than asking for your identity is the indicator that a site could cause you trouble, unfortunately.

2Gkashmiri 4y ago
agreed. 100%. in hindsight, but you know how you sign in to netlify or to some other website, the same thing happens, you are supposed to accept and there is no "continue without giving these permissions" so its an "either you continue or go back and dont use" thing..... i am saying, over 500 people fell for this and this is a good example of "permissions overload" and other such phenomenon. you just go through the flow because you expect everything is in order
- philsnow 4y ago
  > you are supposed to accept and there is no "continue without giving these permissions" so its an "either you continue or go back and dont use" thing I can't remember the site that does/did this, but there was some site that wanted you to log in with OAuth2 through some identity provider and they initially ask for access to your contacts. If you click 'cancel', it sends you back through the OAuth2 flow but without the "read contacts" scope. Sketchy dark pattern BS.
anyfactor 4y ago
Permission overload exist specially when you are allowing users to sign up to third party sites with your platform credentials. Any platform that offer easy to use API, openID or integration service should be concious about what they consider to be a vulnerable and what can be easily exploited. The amount of meaningless authorization buttons we have to press is astounding and it should be considered by all platforms. This argument doesn't advocate for strict integration control and disabling their OpenID features. Any system that chalks up massive amount hassle to people only due to "human error" is poorly designed.
modeless 4y ago
The problem is GitHub's permission system is bad. I'm not sure if the problem is that legitimate apps are required to request way more permissions than they want to get the ones they need, or if the prompts themselves are basically crying wolf all the time ("act on my behalf"? That could mean literally anything, why are you showing me that at the bottom of a list of other permissions? Doesn't it imply all the rest?). So the only way to use them is to either deny most legitimate apps because of scary permissions, or learn to click past the prompts to get your work done. If people do the latter due to a bad system then GitHub is not blameless here. They need to fix their system.
dheera 4y ago
Many of these permission grant UIs are bad. It should always be possible to grant some permissions and not others, and optionally, if a website does not receive a permission it should be able to send fake data in a well-formed API response response to fool it into thinking it actually got the permission.
- Aissen 4y ago
  > if a website does not receive a permission it should be able to send fake data in a well-formed API response That's what you do when you're user centric. But it's also actively hostile to developers. What you should do is preserve a balance: - let developer know permissions have been refused (no need to go chasing fake data) - tell users to report apps that simply stop working without a given permission. It should be a separate "report button" that is on the same page as the "give permission" UI. But this means you'll need people to review those reports properly, otherwise there is no balance. And that is why it's never done like this.
  - modeless 4y ago
    The right thing is to generate fake data, but also provide an API to check whether the data is fake or not. That way apps don't have to test every permutation of granted/not granted permissions to ensure they don't break, but apps that really care can still explicitly check to see if they got the permissions they wanted.
    - dheera 4y ago
      This opens the door to unscrupulous apps that deny you access if you are using fake data, in the name of tracking you. Also, an app is merely a suggestion of what to run on a CPU. What actually runs, and what data is provided, is my decision, since it is my hardware.
  - dheera 4y ago
    > let developer know permissions have been refused I don't think developers ever have a right to know permissions have been refused. People should have a fundamental right to lie about their location to private businesses, to protect their privacy.

2Gkashmiri 4y ago

agreed. 100%. in hindsight, but you know how you sign in to netlify or to some other website, the same thing happens, you are supposed to accept and there is no "continue without giving these permissions" so its an "either you continue or go back and dont use" thing..... i am saying, over 500 people fell for this and this is a good example of "permissions overload" and other such phenomenon. you just go through the flow because you expect everything is in order

philsnow 4y ago
> you are supposed to accept and there is no "continue without giving these permissions" so its an "either you continue or go back and dont use" thing I can't remember the site that does/did this, but there was some site that wanted you to log in with OAuth2 through some identity provider and they initially ask for access to your contacts. If you click 'cancel', it sends you back through the OAuth2 flow but without the "read contacts" scope. Sketchy dark pattern BS.

anyfactor 4y ago

Permission overload exist specially when you are allowing users to sign up to third party sites with your platform credentials. Any platform that offer easy to use API, openID or integration service should be concious about what they consider to be a vulnerable and what can be easily exploited. The amount of meaningless authorization buttons we have to press is astounding and it should be considered by all platforms. This argument doesn't advocate for strict integration control and disabling their OpenID features. Any system that chalks up massive amount hassle to people only due to "human error" is poorly designed.

modeless 4y ago

The problem is GitHub's permission system is bad. I'm not sure if the problem is that legitimate apps are required to request way more permissions than they want to get the ones they need, or if the prompts themselves are basically crying wolf all the time ("act on my behalf"? That could mean literally anything, why are you showing me that at the bottom of a list of other permissions? Doesn't it imply all the rest?). So the only way to use them is to either deny most legitimate apps because of scary permissions, or learn to click past the prompts to get your work done. If people do the latter due to a bad system then GitHub is not blameless here. They need to fix their system.

dheera 4y ago

Many of these permission grant UIs are bad. It should always be possible to grant some permissions and not others, and optionally, if a website does not receive a permission it should be able to send fake data in a well-formed API response response to fool it into thinking it actually got the permission.

Aissen 4y ago
> if a website does not receive a permission it should be able to send fake data in a well-formed API response That's what you do when you're user centric. But it's also actively hostile to developers. What you should do is preserve a balance: - let developer know permissions have been refused (no need to go chasing fake data) - tell users to report apps that simply stop working without a given permission. It should be a separate "report button" that is on the same page as the "give permission" UI. But this means you'll need people to review those reports properly, otherwise there is no balance. And that is why it's never done like this.
- modeless 4y ago
  The right thing is to generate fake data, but also provide an API to check whether the data is fake or not. That way apps don't have to test every permutation of granted/not granted permissions to ensure they don't break, but apps that really care can still explicitly check to see if they got the permissions they wanted.
  - dheera 4y ago
    This opens the door to unscrupulous apps that deny you access if you are using fake data, in the name of tracking you. Also, an app is merely a suggestion of what to run on a CPU. What actually runs, and what data is provided, is my decision, since it is my hardware.
- dheera 4y ago
  > let developer know permissions have been refused I don't think developers ever have a right to know permissions have been refused. People should have a fundamental right to lie about their location to private businesses, to protect their privacy.