Hound keep asking write permission to all data of public repositories (security/dangerous)

[fpietrosanti]

This ticket is to improve the security of Hound, so that it can work without asking write permission to all data of public repositories, that's a dangerous practice.

I was trying to add it to GlobaLeaks, but it keep asking privileges to write to the GlobaLeaks repository, that's a security risks that we cannot afford, because only authorized developer can have write accesso the code.

Example of the inquiry of write permission reported below:

[arol]

It's not possible at the moment to ask for repo read-only permissions. If an app wants to access to a repo data it has to ask for repo scope, which has write permissions too. I contacted github asking for more granulated scopes, but they're working on that. 😞

[fpietrosanti]

@arol does any of the following strategy may works?
http://stackoverflow.com/questions/26372417/github-oauth2-token-how-to-restrict-access-to-read-a-single-private-repo
https://groups.google.com/forum/#!topic/travis-ci/ihZZXAw9K6M

[arol]

I think it could. Giving hound a deploy key and setting up a webhook manually may work, but I don't if hound will be able to comment. Inviting a hound's official user on github giving him read-only permissions on specific repo is an interesting approach as well, but a lot of people may be inviting fake users. I prefer the automatic way.

I think that doing it that way you're killing the simplicity of Hound. Being an open-source project, I think is better for you to host your own hosted fork, but I don't know if it's possible in terms of license.

[gylaz]

As mentioned, we are restricted on this by GitHub. Until they support finer grained scopes, we continue asking for "read and write" permissions.

[aspiers]

See also isaacs/github#731 (OAuth scopes by repository (or organization)).

[gylaz]

GitHub suggests moving to GitHub Apps, which do allow per repo specific permissions. However, it's quite a large migration, so we'll be introducing this soon for new users, with an option to upgrade for existing users.

[aspiers]

@gylaz Thanks - do you have a link to more details on that suggestion?

[gylaz]

This describes the difference between the two types of apps, and talks about what the new GitHub apps are good at.
Also, lots of conversations about the new GitHub apps have happened on their forum.