4 ms·

For my curiosity, why "access_type=offline" as well as "scope=submit" for connecting accounts? I got the impression from your description that it just allowed "

For my curiosity, why "access_type=offline" as well as "scope=submit" for connecting accounts? I got the impression from your description that it just allowed "claiming" the user-id on portal.alien.top but your scopes seem to imply you're going to submit any content from portal.alien.top back into reddit as me

rglullis 3y ago
Two-way communication has been requested by some people and is the next item on my to-do list [0] [0]: https://github.com/orgs/mushroomlabs/projects/1 https://github.com/orgs/mushroomlabs/projects/1
- mdaniel 3y ago
  I see https://github.com/mushroomlabs/fediverser/issues/9 https://github.com/mushroomlabs/fediverser/issues/9 but I would be much more likely to use it if the oauth2 dance didn't ask for aggressive perms versus a "ask for all the perms then revoke them later"
  - rglullis 3y ago
    The issue you are referring to is on the reddit -> lemmy side, but I see what you mean. I think I could make a separate application with less permissions and then just this one when two-way communication is ready and opt-in?
    - mdaniel 3y ago
      I would not claim to be a oauth2 expert, but to the best of my knowledge the scopes that one declares during the app registration on the reddit side are the upper bound of what said app is allowed to request, and thus if there was a checkbox on alien.top's side asking whether the user wanted bidirectional behavior, if unchecked the oauth2 handshake would omit the write scopes from the handshake and the token that comes back would be read only. I have mixed feelings about the "offline" part but if it was read only, I would be perfectly fine with alien.top using my access token to help spread the rate limiting load during any sync activities for the subreddits I was in Furthermore, again, to the best of my knowledge, if an alien.top user changed their mind and wanted to opt-in to the bidirectional behavior later, you could have that user just re authorize with the same client-id and this time ask for all the scopes. Much less complexity than managing two separate app registrations
      - rglullis 3y ago
        You are correct on almost everything, except on the ability on using your access token to spread rate limiting : requests still depend on the application id, so every request will use the app id quota. This is why the Apollo developer basically said that the pricing changes would kill any chance of having the app financially viable. Regarding why I'm asking everything upfront, I will (partially) blame the library I'm using to authenticate with reddit, django-allauth. It can be made to make user configurable scope requests, but the default adapter just takes a fixed list of scopes from the overall application setting. I do understand that it would be better if I asked for the proper permissions on demand, but to be honest it was now just a matter of prioritizing new features over addressing valid-but-minor objections that people might have.
nacs 3y ago
Yep, the amount of access being requested seems excessive: Access posts and comments through my account. Access the list of subreddits I moderate, contribute to, and subscribe to. Access my inbox and send private messages to other users. Access my reddit username and signup date. Submit links and comments from my account. Maintain this access indefinitely (or until manually revoked). I would expect this app to only need 2nd and 4th items in this list.
remram 3y ago
> Access my inbox and send private messages to other users. Yeah that's a quick no from me.
- mdaniel 3y ago
  well, as you can see <https://news.ycombinator.com/item?id=38015078 https://news.ycombinator.com/item?id=38015078>, we're just "valid-but-minor objections that people might have." so ... that's, just, like, your opinion, man :-P I would guess the short version would be "run your own copy with sane scopes" but that would require that I visit reddit again, sign up for their new developer-hating experience, and I just don't care about their content that much
  - rglullis 3y ago
    Question though: if you are already interested in getting out of reddit and do not care about the content from there and/or interacting with it still, then why can't you simply sign up to the other dozen of well-managed Lemmy instances? Also, think a bit from my perspective: every user that signs up to my instance but is not willing to have two-way communication is reducing its viral aspect and is costing me resources. I'm not saying that what you want is unreasonable, I'm just saying that there are others that could be more helpful.
  - remram 3y ago
    If any and all security is a "minor concern" then I'm happy to pass.
    - rglullis 3y ago
      If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.
      - 3y ago

rglullis 3y ago

Two-way communication has been requested by some people and is the next item on my to-do list [0] [0]: https://github.com/orgs/mushroomlabs/projects/1 https://github.com/orgs/mushroomlabs/projects/1

mdaniel 3y ago
I see https://github.com/mushroomlabs/fediverser/issues/9 https://github.com/mushroomlabs/fediverser/issues/9 but I would be much more likely to use it if the oauth2 dance didn't ask for aggressive perms versus a "ask for all the perms then revoke them later"
- rglullis 3y ago
  The issue you are referring to is on the reddit -> lemmy side, but I see what you mean. I think I could make a separate application with less permissions and then just this one when two-way communication is ready and opt-in?
  - mdaniel 3y ago
    I would not claim to be a oauth2 expert, but to the best of my knowledge the scopes that one declares during the app registration on the reddit side are the upper bound of what said app is allowed to request, and thus if there was a checkbox on alien.top's side asking whether the user wanted bidirectional behavior, if unchecked the oauth2 handshake would omit the write scopes from the handshake and the token that comes back would be read only. I have mixed feelings about the "offline" part but if it was read only, I would be perfectly fine with alien.top using my access token to help spread the rate limiting load during any sync activities for the subreddits I was in Furthermore, again, to the best of my knowledge, if an alien.top user changed their mind and wanted to opt-in to the bidirectional behavior later, you could have that user just re authorize with the same client-id and this time ask for all the scopes. Much less complexity than managing two separate app registrations
    - rglullis 3y ago
      You are correct on almost everything, except on the ability on using your access token to spread rate limiting : requests still depend on the application id, so every request will use the app id quota. This is why the Apollo developer basically said that the pricing changes would kill any chance of having the app financially viable. Regarding why I'm asking everything upfront, I will (partially) blame the library I'm using to authenticate with reddit, django-allauth. It can be made to make user configurable scope requests, but the default adapter just takes a fixed list of scopes from the overall application setting. I do understand that it would be better if I asked for the proper permissions on demand, but to be honest it was now just a matter of prioritizing new features over addressing valid-but-minor objections that people might have.

nacs 3y ago

Yep, the amount of access being requested seems excessive: Access posts and comments through my account. Access the list of subreddits I moderate, contribute to, and subscribe to. Access my inbox and send private messages to other users. Access my reddit username and signup date. Submit links and comments from my account. Maintain this access indefinitely (or until manually revoked). I would expect this app to only need 2nd and 4th items in this list.

remram 3y ago

> Access my inbox and send private messages to other users. Yeah that's a quick no from me.

mdaniel 3y ago
well, as you can see <https://news.ycombinator.com/item?id=38015078 https://news.ycombinator.com/item?id=38015078>, we're just "valid-but-minor objections that people might have." so ... that's, just, like, your opinion, man :-P I would guess the short version would be "run your own copy with sane scopes" but that would require that I visit reddit again, sign up for their new developer-hating experience, and I just don't care about their content that much
- rglullis 3y ago
  Question though: if you are already interested in getting out of reddit and do not care about the content from there and/or interacting with it still, then why can't you simply sign up to the other dozen of well-managed Lemmy instances? Also, think a bit from my perspective: every user that signs up to my instance but is not willing to have two-way communication is reducing its viral aspect and is costing me resources. I'm not saying that what you want is unreasonable, I'm just saying that there are others that could be more helpful.
- remram 3y ago
  If any and all security is a "minor concern" then I'm happy to pass.
  - rglullis 3y ago
    If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.
    - 3y ago