15 ms·

I tried getting myself on the CLI waitlist (https://githubnext.com/projects/copilot-cli/ https://githubnext.com/projects/copilot-cli/). That they use ffmpeg as

by w-m 4y ago

I tried getting myself on the CLI waitlist (https://githubnext.com/projects/copilot-cli/ https://githubnext.com/projects/copilot-cli/). That they use ffmpeg as the example hits a huge pain point for me. But: "Next Waitlist by GitHub Next would like permission to: Act on your behalf Not owned or operated by GitHub" Why does signing up for a waitlist require me to give permissions to an app to act in my account? An app that isn't even officially from GitHub? This sets a bad example for permission requests, getting people to just click through the dialog, which requests too much access, and from the wrong domain.

Bedon292 4y ago
I was wondering the same thing. It seems like it is labeled weirdly since it is part of GitHub, but definitely was triple checking what was going on with that.
envy2 4y ago
I think this is just a standard API access prompt. The GitHub Next page clearly indicates it is (C) GitHub Inc and the blog post makes GitHub's control clear.
- retrocryptid 4y ago
  Well. That's what the AI wants you to believe.
- madeofpalk 4y ago
  > The GitHub Next page clearly indicates it is (C) GitHub Inc and the blog post makes GitHub's control clear. This is not clear at all. Phishing websites always say (C) Bank of America. That doesn't make it legit.
macNchz 4y ago
It's interesting because the Copilot for PRs preview uses an app that does say "Owned and Operated by GitHub". Probably just an oversight, but I'm pretty sensitive about what access GitHub apps have, especially given the list of major attacks that have happened in recent years that were initiated by someone sneaking malicious payloads in somewhere along the development pipeline. Curious why they'd use a totally different domain in the first place–how much access do you think you could get to private repos just by cloning that page onto githubfuture.com (available) and spearphishing interesting targets?
- w-m 4y ago
  Signing up for the technical preview of Copilot Chat also worked as expected, it was just a checkmark and a button on github.com, not even an oauth dialog.
joshmanders 4y ago
> Why does signing up for a waitlist require me to give permissions to an app to act in my account? An app that isn't even officially from GitHub? Because it uses GitHub's oauth flow, all applications who use this flow show the same stuff.
- justin_oaks 4y ago
  OAuth allows the use of different scopes for different levels of access. So just because it uses OAuth doesn't mean it has to require major account access. I assume the problem is that GitHub doesn't have sufficiently granular permissions (OAuth scopes), or that the requesting app doesn't use the correct scopes.
ilaksh 4y ago
There are several CLI programs like this. I built mine before ChatGPT came out so it uses text-davinci-003. It https://github.com/runvnc/askleo https://github.com/runvnc/askleo If you google for ChatGPT CLI I assume some will come up and those are probably better because they are cheaper and faster.
filmgirlcw 4y ago
It’s officially from GitHub. There is some weird language (that I’ll absolutely pass feedback on to the team), I think because GitHub Next is a different organization from GitHub proper, but I can assure you, this is an official GitHub app. But I totally agree that this isn’t a great/clear message about where this is from.
- RulerOf 4y ago
  The domain name on that authorization prompt was more than enough to get me to decline. I wouldn't have hesitated at all if it were at next.github.com.
  - filmgirlcw 4y ago
    Totally get it. I’ve passed feedback on to the team so (hopefully) the CLI app will be be clearly from GitHub soon (we need to transfer it to the regular GitHub org and then there hopefully won’t be any confusion). GitHub Next exists in a different org from GitHub proper for lots of reasons, but we should definitely make it more clear that those experiments are still from GitHub.
    - vlovich123 4y ago
      Doing it under a liberated domain under GitHub.com sounds like it would work (still a separate org but it’s a signal that this is from main GitHub)
    - RulerOf 4y ago
      FYI, after digging down a few links from there and winding up at the GitHub Next org page[1], seeing the verified email next@github.com and the official site link to https://githubnext.com https://githubnext.com was enough validation for me. Can't wait for Voice Copilot :) 1: https://github.com/githubnext https://github.com/githubnext
    - rjzzleep 4y ago
      To me the auth flow looks wrong. The CLI oauth would get act on your behalf, but the website to apply for access should not under any circumstance do that. Maybe it's just copy and pasted from somewhere, but it looks wrong to me regardless.
localhost 4y ago
While I don't remember to use it (too much AI in too many tools!) Warp has this feature as well "Warp AI". This is what it told me for the demo scenario: ffmpeg -i input.mp4 -i watermark.png -filter_complex "overlay=10:10" output.mp4 Bunch of descriptive words too.
darepublic 4y ago
+1 for copilot is good for ffmpeg. Recently did a project involving complicated ffmpeg filters, it could handle them on it's own quite well.
pastor_bob 4y ago
Interesting, how does this know what executables are available on your PATH?
- nicky0 4y ago
  I guess since it runs does a shell executable, it can simply examine the path.
Loeffelmann 4y ago
It's pretty simple to write your own script in the meantime. I wrote this sometime ago: https://gist.github.com/Loeffeldude/41f3a71570f4bad1aff2749be2ea653b https://gist.github.com/Loeffeldude/41f3a71570f4bad1aff2749b...

by w-m 4y ago

Bedon292 4y ago

I was wondering the same thing. It seems like it is labeled weirdly since it is part of GitHub, but definitely was triple checking what was going on with that.

envy2 4y ago

I think this is just a standard API access prompt. The GitHub Next page clearly indicates it is (C) GitHub Inc and the blog post makes GitHub's control clear.

retrocryptid 4y ago
Well. That's what the AI wants you to believe.
madeofpalk 4y ago
> The GitHub Next page clearly indicates it is (C) GitHub Inc and the blog post makes GitHub's control clear. This is not clear at all. Phishing websites always say (C) Bank of America. That doesn't make it legit.

macNchz 4y ago

It's interesting because the Copilot for PRs preview uses an app that does say "Owned and Operated by GitHub". Probably just an oversight, but I'm pretty sensitive about what access GitHub apps have, especially given the list of major attacks that have happened in recent years that were initiated by someone sneaking malicious payloads in somewhere along the development pipeline. Curious why they'd use a totally different domain in the first place–how much access do you think you could get to private repos just by cloning that page onto githubfuture.com (available) and spearphishing interesting targets?

w-m 4y ago
Signing up for the technical preview of Copilot Chat also worked as expected, it was just a checkmark and a button on github.com, not even an oauth dialog.

joshmanders 4y ago

> Why does signing up for a waitlist require me to give permissions to an app to act in my account? An app that isn't even officially from GitHub? Because it uses GitHub's oauth flow, all applications who use this flow show the same stuff.

justin_oaks 4y ago
OAuth allows the use of different scopes for different levels of access. So just because it uses OAuth doesn't mean it has to require major account access. I assume the problem is that GitHub doesn't have sufficiently granular permissions (OAuth scopes), or that the requesting app doesn't use the correct scopes.

ilaksh 4y ago

There are several CLI programs like this. I built mine before ChatGPT came out so it uses text-davinci-003. It https://github.com/runvnc/askleo https://github.com/runvnc/askleo If you google for ChatGPT CLI I assume some will come up and those are probably better because they are cheaper and faster.

filmgirlcw 4y ago

It’s officially from GitHub. There is some weird language (that I’ll absolutely pass feedback on to the team), I think because GitHub Next is a different organization from GitHub proper, but I can assure you, this is an official GitHub app. But I totally agree that this isn’t a great/clear message about where this is from.

RulerOf 4y ago
The domain name on that authorization prompt was more than enough to get me to decline. I wouldn't have hesitated at all if it were at next.github.com.
- filmgirlcw 4y ago
  Totally get it. I’ve passed feedback on to the team so (hopefully) the CLI app will be be clearly from GitHub soon (we need to transfer it to the regular GitHub org and then there hopefully won’t be any confusion). GitHub Next exists in a different org from GitHub proper for lots of reasons, but we should definitely make it more clear that those experiments are still from GitHub.
  - vlovich123 4y ago
    Doing it under a liberated domain under GitHub.com sounds like it would work (still a separate org but it’s a signal that this is from main GitHub)
  - RulerOf 4y ago
    FYI, after digging down a few links from there and winding up at the GitHub Next org page[1], seeing the verified email next@github.com and the official site link to https://githubnext.com https://githubnext.com was enough validation for me. Can't wait for Voice Copilot :) 1: https://github.com/githubnext https://github.com/githubnext
  - rjzzleep 4y ago
    To me the auth flow looks wrong. The CLI oauth would get act on your behalf, but the website to apply for access should not under any circumstance do that. Maybe it's just copy and pasted from somewhere, but it looks wrong to me regardless.

localhost 4y ago

While I don't remember to use it (too much AI in too many tools!) Warp has this feature as well "Warp AI". This is what it told me for the demo scenario: ffmpeg -i input.mp4 -i watermark.png -filter_complex "overlay=10:10" output.mp4 Bunch of descriptive words too.

darepublic 4y ago

+1 for copilot is good for ffmpeg. Recently did a project involving complicated ffmpeg filters, it could handle them on it's own quite well.

pastor_bob 4y ago

Interesting, how does this know what executables are available on your PATH?

nicky0 4y ago
I guess since it runs does a shell executable, it can simply examine the path.

Loeffelmann 4y ago

It's pretty simple to write your own script in the meantime. I wrote this sometime ago: https://gist.github.com/Loeffeldude/41f3a71570f4bad1aff2749be2ea653b https://gist.github.com/Loeffeldude/41f3a71570f4bad1aff2749b...