6 ms·
API scopes could totally use some mandatory standards. You can't make a digital ocean token to simply edit DNS without full delete-all-your-VM's & charge thousa
by Already__Taken 4y ago
API scopes could totally use some mandatory standards. You can't make a digital ocean token to simply edit DNS without full delete-all-your-VM's & charge thousands access.
Similarly we shouldn't bill for service accounts, especially when they're documented as the way to limit API token access. It's self-defeatist like taxing longer passwords.
- danuker 4y agoFinetuned permissions cost to implement. GitHub doesn't have them (maybe we wouldn't have seen this post if it had). Therefore if you want them, pay up or do it yourself.
- Already__Taken 4y agoFine, put that behind my $x/mo account + service accounts. $x/mo * Service accounts is dumb.
- masklinn 4y ago> Finetuned permissions cost to implement. GitHub doesn't have them (maybe we wouldn't have seen this post if it had). They exist for github apps, and they're being rolled out for PATs alongside forced expiration: https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/ https://github.blog/2022-10-18-introducing-fine-grained-pers... Not sure there's any way for them to happen for oauth apps though. And even if they do, they're opt-in for the app and the old broad scope will remain. At best the broad scopes would only be accessible to old apps grandfathered in but that ain't much (there's probably a billion abandoned oauth applications you could purchase for that grandfathering).
- josephcsible 4y agoThat's not a practical suggestion, since GitHub isn't self-hosted or open-source.
- ilyt 4y agoWell, it is PITA to implement so I'm not surprised really...
- 9wzYQbTYsAIc 4y agoSounds like a good use case for Rich Authorization Requests <https://www.ietf.org/archive/id/draft-ietf-oauth-rar-18.html https://www.ietf.org/archive/id/draft-ietf-oauth-rar-18.html>