5 ms·
> There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. Auditing is only one proble
by paranoidrobot 4y ago
> There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions.
Auditing is only one problem.
Why is granting permissions an all-or-nothing approach?
Way too many apps are requesting all the permissions. If I want to use it, I've got zero choice. I want an 'Advanced' option with a way to deselect certain permissions.
- JCharante 4y agoIf they're requesting all the permissions then you shouldn't use them. If a random note taking app asks to read my contacts the first time I launch it then I'm going to assume it's malicious.
- paranoidrobot 4y agoI meant more in general terms - apps are requesting more permissions than I want to grant them. I would like to see services allow users to limit the permissions actually granted. JIRA wants all the source code for your entire organisation. Tailscale wants to read all the organisations you're a member of. The problem is not just limited to Github. Grafana's Slack apps want to be able to read the entire Slack organisation, post messages as me, and a whole bunch of other things I'm just not comfortable giving it.