3 ms·

I raised this concern before about how unclear this is and the concern was pretty much dismissed https://news.ycombinator.com/item?id=33539150 https://news.ycom

I raised this concern before about how unclear this is and the concern was pretty much dismissed https://news.ycombinator.com/item?id=33539150 https://news.ycombinator.com/item?id=33539150 "Techies" often lament about how silly users are about falling for phishing tricks, but then they also routinely make it so difficult to determine what's legit from what's fake.

BubbleRings 4y ago
This becoming the top thread here might get their attention. You have a very good point.
basch 4y ago
>routinely make it so difficult to determine what's legit from what's fake. Like the amount of times on my phone where I get prompted for a username and password different from the app im in (to make some kind of connection) but then suppress the url from visibility. An astoundingly poor design choice that has proliferated into every single variant of that interface design flow.
- cyrusatjam 4y ago
  Not to mention, the app you're in can inject JS into the page it renders. Best practice is to open in your default browser and then allow the deeplink in the callback_uri to return you back to the original app
filmgirlcw 4y ago
Totally agree. I did the same double-take with some stuff at Universe and I work here. As Idan said back then, there are lots of reasons that we want Next to be separate from GitHub proper. But you’re absolutely correct that we should make it more clear that anything from Next is not a rogue org and also part of GitHub. Thanks for the feedback.
xp84 4y ago
> make it so difficult to determine what's legit from what's fake. So true. I still think the DNS was one of the only chances to grant, and teach, the ability to confidently make trust decisions in the general population. IDN attacks notwithstanding, it's hard to beat an inspectable string that contains its own trust chain, compared to "app names" that can often be set to the hacker's own choice. Sadly, antipatterns seem more common than useful patterns. (Antipatterns like using a domain like "talktotacobell . com" (don't visit that) as the site to complete a receipt survey. Or every public school district or even school having a random .com or .org.) People decided that end users would find an address like xhs.xsd.ed.ca.gov too complicated, yet people found 10-digit completely meaningless telephone numbers perfectly fine for decades.

BubbleRings 4y ago

This becoming the top thread here might get their attention. You have a very good point.

basch 4y ago

>routinely make it so difficult to determine what's legit from what's fake. Like the amount of times on my phone where I get prompted for a username and password different from the app im in (to make some kind of connection) but then suppress the url from visibility. An astoundingly poor design choice that has proliferated into every single variant of that interface design flow.

cyrusatjam 4y ago
Not to mention, the app you're in can inject JS into the page it renders. Best practice is to open in your default browser and then allow the deeplink in the callback_uri to return you back to the original app

filmgirlcw 4y ago

Totally agree. I did the same double-take with some stuff at Universe and I work here. As Idan said back then, there are lots of reasons that we want Next to be separate from GitHub proper. But you’re absolutely correct that we should make it more clear that anything from Next is not a rogue org and also part of GitHub. Thanks for the feedback.

xp84 4y ago

> make it so difficult to determine what's legit from what's fake. So true. I still think the DNS was one of the only chances to grant, and teach, the ability to confidently make trust decisions in the general population. IDN attacks notwithstanding, it's hard to beat an inspectable string that contains its own trust chain, compared to "app names" that can often be set to the hacker's own choice. Sadly, antipatterns seem more common than useful patterns. (Antipatterns like using a domain like "talktotacobell . com" (don't visit that) as the site to complete a receipt survey. Or every public school district or even school having a random .com or .org.) People decided that end users would find an address like xhs.xsd.ed.ca.gov too complicated, yet people found 10-digit completely meaningless telephone numbers perfectly fine for decades.