5 ms·

Congrats on launching guys, but I'm going to be really honest here. The requirement that I provide access to my Github repos like this is a deal breaker. For a

Congrats on launching guys, but I'm going to be really honest here. The requirement that I provide access to my Github repos like this is a deal breaker. For a security related product, this creates a huge attack surface and audit requirement. From a security standpoint, what you want to do is less important than what you can do, and the access controls you use currently -- public or public + private -- just aren't fine grained enough.

ryanbrunner 14y ago
I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private repositories in general. You could probably hack around it by creating an integration account that only has access to the repositories that you want to integrate. If you're asking for only access to the Gemfile and not the repository, that's far outside the security model of GitHub, and even Git. Maybe a good alternative for people security conscious would be a manual Gemfile upload?
phillmv 14y ago
>For a security related product, this creates a huge attack surface and audit requirement. We agree. We spent a lot of time debating this. We originally set out to build a gem, but realized it was so much easier to use through GitHub. Unfortunately, we can't provide more granular access due to what the API gives us. We plan on eventually releasing said gem, as noted in the "I don't use github" link on the front page :).
- mrgreenfur 14y ago
  What about a functionality where I can upload my gemfile when I deploy? I deploy, cap sends you my gemfile and you notify me.
  - phillmv 14y ago
    Exactly what we had in mind. Soon!
    - stephenhuey 14y ago
      Looking forward to it!
  - kalv 14y ago
    Yep +1 on this. I started to look into implementing this on a project but we too are not ok with giving Github access. On deploy posting the Gemfile is something that came to my mind too and would work.

ryanbrunner 14y ago

I think that's how GitHub OAuth works though. As far as I know, you can't ask for access to a specific repository for an account, just access to private repositories in general. You could probably hack around it by creating an integration account that only has access to the repositories that you want to integrate. If you're asking for only access to the Gemfile and not the repository, that's far outside the security model of GitHub, and even Git. Maybe a good alternative for people security conscious would be a manual Gemfile upload?

phillmv 14y ago

>For a security related product, this creates a huge attack surface and audit requirement. We agree. We spent a lot of time debating this. We originally set out to build a gem, but realized it was so much easier to use through GitHub. Unfortunately, we can't provide more granular access due to what the API gives us. We plan on eventually releasing said gem, as noted in the "I don't use github" link on the front page :).

mrgreenfur 14y ago
What about a functionality where I can upload my gemfile when I deploy? I deploy, cap sends you my gemfile and you notify me.
- phillmv 14y ago
  Exactly what we had in mind. Soon!
  - stephenhuey 14y ago
    Looking forward to it!
- kalv 14y ago
  Yep +1 on this. I started to look into implementing this on a project but we too are not ok with giving Github access. On deploy posting the Gemfile is something that came to my mind too and would work.