4 ms·

> Access my inbox and send private messages to other users. Yeah that's a quick no from me.

by remram 3y ago

mdaniel 3y ago
well, as you can see <https://news.ycombinator.com/item?id=38015078 https://news.ycombinator.com/item?id=38015078>, we're just "valid-but-minor objections that people might have." so ... that's, just, like, your opinion, man :-P I would guess the short version would be "run your own copy with sane scopes" but that would require that I visit reddit again, sign up for their new developer-hating experience, and I just don't care about their content that much
- rglullis 3y ago
  Question though: if you are already interested in getting out of reddit and do not care about the content from there and/or interacting with it still, then why can't you simply sign up to the other dozen of well-managed Lemmy instances? Also, think a bit from my perspective: every user that signs up to my instance but is not willing to have two-way communication is reducing its viral aspect and is costing me resources. I'm not saying that what you want is unreasonable, I'm just saying that there are others that could be more helpful.
- remram 3y ago
  If any and all security is a "minor concern" then I'm happy to pass.
  - rglullis 3y ago
    If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.
    - remram 3y ago
      The app claims to "check the subreddits you are currently subscribed" (sic) but instead asks Reddit for permission to post. This is a security bug! What are you talking about? What has trust got to do with anything once I have observed the wrong thing happening?
      - rglullis 3y ago
        > instead asks Reddit for permission to post Not "instead" but "in addition to". And the reason it is requesting permission to post is separate from "checking the subreddits", it is (like I said) because there are already people who asked for the ability to respond to a comment on reddit from a lemmy thread, and I (admittedly) didn't bother (yet) to write two oauth flows for these two separate actions when one is faster to implement and easier for people to understand. > I have observed the wrong thing happening? Have you seen or heard anyone complaining about the application sending posts when it shouldn't? If not, there is nothing objectively wrong with it. You might be concerned about potential issues with this approach and I completely agree that it is not ideal, but between spending time to (a) write a whole new OAuth adapter class to handle the different requests or (b) creating 15 new different lemmy instances and mapping 175 subreddits to Lemmy communities - which one do you think is more helpful to the goals of the project?
        remram 3y ago
        Security is not about bad things not happening, it's about preventing bad things from happening. Look, you've already agreed that "it would be better if [you] asked for the proper permissions on demand", and that it was "a matter of prioritizing". Now you are trying to object and call it "deriding" if I don't pretend that you are following security best practices. You are not, you have explained why, what is this thread about?
        rglullis 3y ago
        By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinion as fact, especially when it is an open source project that is meant to help people. Instead of shitting on other people's work by writing things like "I am happy to pass", perhaps go take a look to see how you could make the improvement that is so important to you?

> Access my inbox and send private messages to other users. Yeah that's a quick no from me.

by remram 3y ago

> Access my inbox and send private messages to other users. Yeah that's a quick no from me.

well, as you can see <https://news.ycombinator.com/item?id=38015078 https://news.ycombinator.com/item?id=38015078>, we're just "valid-but-minor objections that people might have." so ... that's, just, like, your opinion, man :-P I would guess the short version would be "run your own copy with sane scopes" but that would require that I visit reddit again, sign up for their new developer-hating experience, and I just don't care about their content that much

rglullis 3y ago
Question though: if you are already interested in getting out of reddit and do not care about the content from there and/or interacting with it still, then why can't you simply sign up to the other dozen of well-managed Lemmy instances? Also, think a bit from my perspective: every user that signs up to my instance but is not willing to have two-way communication is reducing its viral aspect and is costing me resources. I'm not saying that what you want is unreasonable, I'm just saying that there are others that could be more helpful.
remram 3y ago
If any and all security is a "minor concern" then I'm happy to pass.
- rglullis 3y ago
  If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.
  - remram 3y ago
    The app claims to "check the subreddits you are currently subscribed" (sic) but instead asks Reddit for permission to post. This is a security bug! What are you talking about? What has trust got to do with anything once I have observed the wrong thing happening?
    - rglullis 3y ago
      > instead asks Reddit for permission to post Not "instead" but "in addition to". And the reason it is requesting permission to post is separate from "checking the subreddits", it is (like I said) because there are already people who asked for the ability to respond to a comment on reddit from a lemmy thread, and I (admittedly) didn't bother (yet) to write two oauth flows for these two separate actions when one is faster to implement and easier for people to understand. > I have observed the wrong thing happening? Have you seen or heard anyone complaining about the application sending posts when it shouldn't? If not, there is nothing objectively wrong with it. You might be concerned about potential issues with this approach and I completely agree that it is not ideal, but between spending time to (a) write a whole new OAuth adapter class to handle the different requests or (b) creating 15 new different lemmy instances and mapping 175 subreddits to Lemmy communities - which one do you think is more helpful to the goals of the project?
      - remram 3y ago
        Security is not about bad things not happening, it's about preventing bad things from happening. Look, you've already agreed that "it would be better if [you] asked for the proper permissions on demand", and that it was "a matter of prioritizing". Now you are trying to object and call it "deriding" if I don't pretend that you are following security best practices. You are not, you have explained why, what is this thread about?
        rglullis 3y ago
        By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinion as fact, especially when it is an open source project that is meant to help people. Instead of shitting on other people's work by writing things like "I am happy to pass", perhaps go take a look to see how you could make the improvement that is so important to you?