4 ms·

If any and all security is a "minor concern" then I'm happy to pass.

by remram 3y ago

rglullis 3y ago
If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.
- remram 3y ago
  The app claims to "check the subreddits you are currently subscribed" (sic) but instead asks Reddit for permission to post. This is a security bug! What are you talking about? What has trust got to do with anything once I have observed the wrong thing happening?
  - rglullis 3y ago
    > instead asks Reddit for permission to post Not "instead" but "in addition to". And the reason it is requesting permission to post is separate from "checking the subreddits", it is (like I said) because there are already people who asked for the ability to respond to a comment on reddit from a lemmy thread, and I (admittedly) didn't bother (yet) to write two oauth flows for these two separate actions when one is faster to implement and easier for people to understand. > I have observed the wrong thing happening? Have you seen or heard anyone complaining about the application sending posts when it shouldn't? If not, there is nothing objectively wrong with it. You might be concerned about potential issues with this approach and I completely agree that it is not ideal, but between spending time to (a) write a whole new OAuth adapter class to handle the different requests or (b) creating 15 new different lemmy instances and mapping 175 subreddits to Lemmy communities - which one do you think is more helpful to the goals of the project?
    - remram 3y ago
      Security is not about bad things not happening, it's about preventing bad things from happening. Look, you've already agreed that "it would be better if [you] asked for the proper permissions on demand", and that it was "a matter of prioritizing". Now you are trying to object and call it "deriding" if I don't pretend that you are following security best practices. You are not, you have explained why, what is this thread about?
      - rglullis 3y ago
        By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinion as fact, especially when it is an open source project that is meant to help people. Instead of shitting on other people's work by writing things like "I am happy to pass", perhaps go take a look to see how you could make the improvement that is so important to you?
        remram 3y ago
        > By your definition, the most secure thing then is to not do anything. Yes... > perhaps go take a look to see how you could make the improvement that is so important to you? No amount of contribution on my part can change your attitude towards security. If it is not a priority of the maintainer, the only move is to stay away. I'm not saying you are creating a collection of spam accounts, I don't even think it's likely that you are. But if someone wanted to do it, this is exactly the way they should go about it. The only move you could take to prove otherwise (not that you owe it to anyone) is to not request posting permission until you need it, with written explanation.
        rglullis 3y ago
        > If it is not a priority of the maintainer, the only move is to stay away. There is another move: submit a PRs with the change. I would gladly accept it. Now that this is online for 3 days, I can give you some numbers: 11 people rejected the request and 135 accepted it. If I went by your preferred route, I would have zero rejections and zero conversions, because I would still be struggling with a self-imposed technical requirement. My time and resources that can be dedicated to this are finite. It doesn't mean that I deny things could be improved, it doesn't mean I won't get to keep working to improve the existing product and it doesn't mean I won't address those concerns later. It just means that this is not meant to be some research project where I need to be satisfying some panel of theoretical experts who never care about the real practice. Right now, the majority of people are telling me "make it easier to find more communities on Lemmy and make it easier to convert more people even if that requires me trusting you", not "I don't trust you enough to let you send messages on my behalf."

If any and all security is a "minor concern" then I'm happy to pass.

by remram 3y ago

If any and all security is a "minor concern" then I'm happy to pass.

If the application actually wants to send messages on your behalf (like it will for some users), you can not claim it's a security issue if it ends up doing so. If you don't trust me or the application, it's another story. But please don't deride my work as malicious or ignorant of actual security practices.

remram 3y ago
The app claims to "check the subreddits you are currently subscribed" (sic) but instead asks Reddit for permission to post. This is a security bug! What are you talking about? What has trust got to do with anything once I have observed the wrong thing happening?
- rglullis 3y ago
  > instead asks Reddit for permission to post Not "instead" but "in addition to". And the reason it is requesting permission to post is separate from "checking the subreddits", it is (like I said) because there are already people who asked for the ability to respond to a comment on reddit from a lemmy thread, and I (admittedly) didn't bother (yet) to write two oauth flows for these two separate actions when one is faster to implement and easier for people to understand. > I have observed the wrong thing happening? Have you seen or heard anyone complaining about the application sending posts when it shouldn't? If not, there is nothing objectively wrong with it. You might be concerned about potential issues with this approach and I completely agree that it is not ideal, but between spending time to (a) write a whole new OAuth adapter class to handle the different requests or (b) creating 15 new different lemmy instances and mapping 175 subreddits to Lemmy communities - which one do you think is more helpful to the goals of the project?
  - remram 3y ago
    Security is not about bad things not happening, it's about preventing bad things from happening. Look, you've already agreed that "it would be better if [you] asked for the proper permissions on demand", and that it was "a matter of prioritizing". Now you are trying to object and call it "deriding" if I don't pretend that you are following security best practices. You are not, you have explained why, what is this thread about?
    - rglullis 3y ago
      By your definition, the most secure thing then is to not do anything. > what is this thread about? It really rubs me the wrong way that you are passing opinion as fact, especially when it is an open source project that is meant to help people. Instead of shitting on other people's work by writing things like "I am happy to pass", perhaps go take a look to see how you could make the improvement that is so important to you?
      - remram 3y ago
        > By your definition, the most secure thing then is to not do anything. Yes... > perhaps go take a look to see how you could make the improvement that is so important to you? No amount of contribution on my part can change your attitude towards security. If it is not a priority of the maintainer, the only move is to stay away. I'm not saying you are creating a collection of spam accounts, I don't even think it's likely that you are. But if someone wanted to do it, this is exactly the way they should go about it. The only move you could take to prove otherwise (not that you owe it to anyone) is to not request posting permission until you need it, with written explanation.
        rglullis 3y ago
        > If it is not a priority of the maintainer, the only move is to stay away. There is another move: submit a PRs with the change. I would gladly accept it. Now that this is online for 3 days, I can give you some numbers: 11 people rejected the request and 135 accepted it. If I went by your preferred route, I would have zero rejections and zero conversions, because I would still be struggling with a self-imposed technical requirement. My time and resources that can be dedicated to this are finite. It doesn't mean that I deny things could be improved, it doesn't mean I won't get to keep working to improve the existing product and it doesn't mean I won't address those concerns later. It just means that this is not meant to be some research project where I need to be satisfying some panel of theoretical experts who never care about the real practice. Right now, the majority of people are telling me "make it easier to find more communities on Lemmy and make it easier to convert more people even if that requires me trusting you", not "I don't trust you enough to let you send messages on my behalf."