6 ms·

> Giving a website access to star repos through the API for my convenience is not anything I should be banned over though. Sorry, hard disagree. You have respo

> Giving a website access to star repos through the API for my convenience is not anything I should be banned over though. Sorry, hard disagree. You have responsibility, here. We all do. Be extremely wary of what privileges you are giving away, and do not hesitate to forgo sign-in when the privileges are unreasonable. Why would anyone click "yes" to a random site that wants control over their Github starring privileges without a clear explanation as to what they will be using it for? We can excuse the naïve, but this is a tech-related site. If you don't know, now you know.

boarush 4y ago
Exactly. We keep asking that users must be asked for explicit permissions and granular scopes are for the good and then users themselves skip reading on these permission grants. Github has always (in my experience) been clear about what permissions are being granted to the site you're signing into, and if you don't agree, you can easily cancel the sign-on flow.
- execveat 4y ago
  It's not clear at all. The scope UI says 'Repositories - Public repositories'. It does not sound dangerous and only reveals that the access is r/w (not r/o) after expanding the dropout. It does not mention stars at all. An example requesting the 'public_repo' scope (the client_id is a random one from the internet): https://github.com/login/oauth/authorize?client_id=33a703d019e0d23730ea&scope=public_repo https://github.com/login/oauth/authorize?client_id=33a703d01...
  - 9wzYQbTYsAIc 4y ago
    Sounds like the basis for an argument for refining the scopes such that it is abundantly clear which scopes write data and which ones do not. No one should be surprised that allowing an untrusted program to write files and permissions through an operating system could lead to a security exploit. Many would likely be cognizant of the risk of becoming a member of a botnet. Allowing untrusted programs to control your digital services is not fundamentally different, in my current perspective.
    - Aeolun 4y ago
      Of course. When you grant someone read/white you expect that they may delete all your repositories for shits and giggles. What I would not expect is Github banning me in some misplaced form of victim blaming.
      - 9wzYQbTYsAIc 4y ago
        Truly though, wouldn’t you expect that your IP might be banned if your computer was compromised by a ddos botnet? Your GitHub user account was compromised by a bad actor, so it shouldn’t be surprising nor considered victim blaming. Of course, GitHub might cross the line to being unreasonable if they become aware of this as a potential security issue and fail to mitigate the phishing risks that they are exposing their customers to. edit: restoring your user account to good standing, if absolutely necessary, is certainly something to strive for, but be aware that it can take years or never, from anecdotes that I’ve heard about Google, Apple, Twitter, etc. Microsoft/GitHub/LinkedIn won’t likely be any different, in that regard
        krisoft 4y ago
        > Your GitHub user account was compromised by a bad actor, so it shouldn’t be surprising nor considered victim blaming. But GitHub sees where did the request to create the stars come from. The requests all came with authentication tokens associated with the given malicious site. They have all the data to see how the account got “compromised”, and they also can see that the account owner is unlikely to have knowingly participated in the “star farming”.[1] The obvious and correct solution is to delete all stars created through tokens associated with the malicious site[2], disable access for the malicious site and write a letter to the compromised users. 1: further absurdity is that by deciding that the stars were farmed Github already made the decision that they are not comming organically from users. Because if they were comming organically from the users then it wouldn’t be star farming, just a popular repo. So why are they punishing the users then? 2: one more absurdity is that stars don’t cost github anything. It is just a number in a DB. It is not like they incurred a cost due to this attack. Github decided that they care about some stupid stars, and make the farming of them a bannable offense.
nurettin 4y ago
Yes, we should be careful, thanks a lot for this hindsight, but giving developers the ability to request for a permission and banning users who click it by accident or doubt is kind of a dick move. Why not remove the permisson and ban the developer instead? To teach people a lesson? Would you like a leash and a whip with that?
- winkeltripel 4y ago
  I believe that the individual responsible for these bans should be transferred as punishment: working on the weird photo editor in PowerPoint, or the msvc++ compiler.
theN00t 4y ago
The issue here is that the OP did not abuse anything, tried to correct the mistake once discovered and was 'still' the one being punished for someone else's shady practice.
- prepend 4y ago
  I think it’s because from GitHub’s standpoint, OP looks just like a bad actor who took $5 to allow someone to use their account to Star 500 repos, and says the same things. GitHub is taking the “ban them all and let God sort ‘em out” approach to figuring out if OP is telling the truth.
  - anon84873628 4y ago
    You realize that the oauth token is tied to the client app, right? Not only can GitHub see that this action was taken by/through a third party service, they can also see all actions taken by that service across all users. So there are much better ways to detect and correct the abuse.
    - prepend 4y ago
      All oauth tokens are authorized by users. So GitHub sees the app and sees the users who authorized the app. Users are responsible for all the bots that act in their names. Otherwise it would be quite simple to write a malbot and then claim innocence because it was the bot doing it, not me. I think the approach to automation is best when the authority and responsibility always ties back to an individual or group.
- 9wzYQbTYsAIc 4y ago
  Presumably the OP would also have been aware that they were giving this third-party app the ability to rewrite the code on any of their public repos. I automatically decline the moment I see any app trying to authorize with that scope. Nonetheless, perhaps this is pointing to Microsoft’s Window’s UAC moment for GitHub. Bright yellow or red UX with warnings that if you click “agree” then you might as well have given away your computer to a malicious actor.
horsawlarway 4y ago
- rendall 4y ago
  Not really necessary to curse at someone, even if you strongly disagree, my guy. You've been around HN long enough to know better.
  - the_only_law 4y ago
    > You've been around HN long enough to know better. I’m sorry which rule covers that?
    - ThrowawayR2 4y ago
      It's the very first guideline regarding comments: "Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Edit out swipes."
      - the_only_law 4y ago
        My bad. I misread the initial interaction.
    - shkkmo 4y ago
      If falls pretty squarely under these guidelines: >Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Edit out swipes. >Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. >When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
      - horsawlarway 4y ago
stonemetal12 4y ago
>without a clear explanation as to what they will be using it for? No one lies on the internet? Those Nigerian princes are very clear what they are going to do with the money you send them, but it doesn't make it true. Providing 3rd party access to an account should come with over sight abilities.
- rendall 4y ago
  Asking "What if this other thing that didn't happen, but could happen, happened?" and then using that to excuse reckless behavior. I'm going by what the guy wrote. He "clicked through a bunch of pages". If you "click through a bunch of pages" and get scammed, you suffer consequences. Play stupid games, win stupid prizes. The whole story is suss, tho.

boarush 4y ago

Exactly. We keep asking that users must be asked for explicit permissions and granular scopes are for the good and then users themselves skip reading on these permission grants. Github has always (in my experience) been clear about what permissions are being granted to the site you're signing into, and if you don't agree, you can easily cancel the sign-on flow.

execveat 4y ago
It's not clear at all. The scope UI says 'Repositories - Public repositories'. It does not sound dangerous and only reveals that the access is r/w (not r/o) after expanding the dropout. It does not mention stars at all. An example requesting the 'public_repo' scope (the client_id is a random one from the internet): https://github.com/login/oauth/authorize?client_id=33a703d019e0d23730ea&scope=public_repo https://github.com/login/oauth/authorize?client_id=33a703d01...
- 9wzYQbTYsAIc 4y ago
  Sounds like the basis for an argument for refining the scopes such that it is abundantly clear which scopes write data and which ones do not. No one should be surprised that allowing an untrusted program to write files and permissions through an operating system could lead to a security exploit. Many would likely be cognizant of the risk of becoming a member of a botnet. Allowing untrusted programs to control your digital services is not fundamentally different, in my current perspective.
  - Aeolun 4y ago
    Of course. When you grant someone read/white you expect that they may delete all your repositories for shits and giggles. What I would not expect is Github banning me in some misplaced form of victim blaming.
    - 9wzYQbTYsAIc 4y ago
      Truly though, wouldn’t you expect that your IP might be banned if your computer was compromised by a ddos botnet? Your GitHub user account was compromised by a bad actor, so it shouldn’t be surprising nor considered victim blaming. Of course, GitHub might cross the line to being unreasonable if they become aware of this as a potential security issue and fail to mitigate the phishing risks that they are exposing their customers to. edit: restoring your user account to good standing, if absolutely necessary, is certainly something to strive for, but be aware that it can take years or never, from anecdotes that I’ve heard about Google, Apple, Twitter, etc. Microsoft/GitHub/LinkedIn won’t likely be any different, in that regard
      - krisoft 4y ago
        > Your GitHub user account was compromised by a bad actor, so it shouldn’t be surprising nor considered victim blaming. But GitHub sees where did the request to create the stars come from. The requests all came with authentication tokens associated with the given malicious site. They have all the data to see how the account got “compromised”, and they also can see that the account owner is unlikely to have knowingly participated in the “star farming”.[1] The obvious and correct solution is to delete all stars created through tokens associated with the malicious site[2], disable access for the malicious site and write a letter to the compromised users. 1: further absurdity is that by deciding that the stars were farmed Github already made the decision that they are not comming organically from users. Because if they were comming organically from the users then it wouldn’t be star farming, just a popular repo. So why are they punishing the users then? 2: one more absurdity is that stars don’t cost github anything. It is just a number in a DB. It is not like they incurred a cost due to this attack. Github decided that they care about some stupid stars, and make the farming of them a bannable offense.

nurettin 4y ago

Yes, we should be careful, thanks a lot for this hindsight, but giving developers the ability to request for a permission and banning users who click it by accident or doubt is kind of a dick move. Why not remove the permisson and ban the developer instead? To teach people a lesson? Would you like a leash and a whip with that?

winkeltripel 4y ago
I believe that the individual responsible for these bans should be transferred as punishment: working on the weird photo editor in PowerPoint, or the msvc++ compiler.

theN00t 4y ago

The issue here is that the OP did not abuse anything, tried to correct the mistake once discovered and was 'still' the one being punished for someone else's shady practice.

prepend 4y ago
I think it’s because from GitHub’s standpoint, OP looks just like a bad actor who took $5 to allow someone to use their account to Star 500 repos, and says the same things. GitHub is taking the “ban them all and let God sort ‘em out” approach to figuring out if OP is telling the truth.
- anon84873628 4y ago
  You realize that the oauth token is tied to the client app, right? Not only can GitHub see that this action was taken by/through a third party service, they can also see all actions taken by that service across all users. So there are much better ways to detect and correct the abuse.
  - prepend 4y ago
    All oauth tokens are authorized by users. So GitHub sees the app and sees the users who authorized the app. Users are responsible for all the bots that act in their names. Otherwise it would be quite simple to write a malbot and then claim innocence because it was the bot doing it, not me. I think the approach to automation is best when the authority and responsibility always ties back to an individual or group.
9wzYQbTYsAIc 4y ago
Presumably the OP would also have been aware that they were giving this third-party app the ability to rewrite the code on any of their public repos. I automatically decline the moment I see any app trying to authorize with that scope. Nonetheless, perhaps this is pointing to Microsoft’s Window’s UAC moment for GitHub. Bright yellow or red UX with warnings that if you click “agree” then you might as well have given away your computer to a malicious actor.

horsawlarway 4y ago

rendall 4y ago
Not really necessary to curse at someone, even if you strongly disagree, my guy. You've been around HN long enough to know better.
- the_only_law 4y ago
  > You've been around HN long enough to know better. I’m sorry which rule covers that?
  - ThrowawayR2 4y ago
    It's the very first guideline regarding comments: "Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Edit out swipes."
    - the_only_law 4y ago
      My bad. I misread the initial interaction.
  - shkkmo 4y ago
    If falls pretty squarely under these guidelines: >Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Edit out swipes. >Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. >When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - horsawlarway 4y ago

stonemetal12 4y ago

>without a clear explanation as to what they will be using it for? No one lies on the internet? Those Nigerian princes are very clear what they are going to do with the money you send them, but it doesn't make it true. Providing 3rd party access to an account should come with over sight abilities.

rendall 4y ago
Asking "What if this other thing that didn't happen, but could happen, happened?" and then using that to excuse reckless behavior. I'm going by what the guy wrote. He "clicked through a bunch of pages". If you "click through a bunch of pages" and get scammed, you suffer consequences. Play stupid games, win stupid prizes. The whole story is suss, tho.