Hacker News Reader

Comment by thedjinn | Hacker News Reader

This app installed webhooks on all of my repos with no automated way to remove them. Very annoying.

We fucked up here, and I apologize. Many thanks to robbiet480 for writing a script to help clean it up.

We've just pushed new client and server versions to cleanup hooks when the last admin user logs out.

New downloads will be the latest version, and current users can update now using the Ship -> Check for Updates menu option. After that, you can logout using Ship -> Account -> Logout. If you used the app earlier and want to be sure all hooks are cleared out, you can log back in once more and then logout again to trigger the removal.

There is also updated documentation here: https://www.realartists.com/docs/2.0/uninstall.html

So about hooks - Hooks are added so that Ship is alerted when new repos are created, issues/labels/milestones/comments are added/modified/deleted, issue templates change, etc. The user experience without hooks is acceptable, but not great. Presumably if you're using Ship, you want it to show the most up to date information.

We disclose when you authorize Ship that you're granting repository and organization webhook permissions. This appears to be insufficient notice. We'll think about that next.

If anyone is still having trouble or needs personalized help, we're reachable at support@realartists.com.

So..., why did you have to install the webhooks in the first place?

> Hooks are added so that Ship is alerted when new repos are created, issues/labels/milestones/comments are added/modified/deleted, issue templates change, etc.

Have you considered only adding webhooks per-repo, and not globally? I have access to numerous repos that I don't want or need real-time updates from, as well as repos from organisations that have added me which I would really rather not touch. They would probably not be happy that their repos are suddenly sending data to a third party that they didn't consent to.

I would love something like Ship for my main public repo, and in fact would prefer to just use Ship for that repo.

People are used to granting access to an app without assuming that it's going to take full advantage of that access. I have access to a lot of repos. Like, a LOT of repos with a lot of collaborators. And I just had some app add webhooks to every single one. I'm glad I could remove them with 'logout', but I would have really appreciated a more obvious message.

I wish we'd see this more often. You fucked up, but came clean about it, apologized, and gave a working solution. Congrats!

I didn't want to wait for a solution that may never come for the webhooks added to 200+ repos of mine/that I have access to, so I hacked this script together.

https://gist.github.com/robbiet480/2f095c910e56255c412d85040...

Thanks, and sorry. You shouldn't have had to write this.

You're right, and we're working on a solution for this now.

In the meantime I suggest you warn trial users about this. I had to manually remove it from 40 repositories.

Please work faster, I wasn't alerted that a webhook would be added and now I have 200+ repos that need to have a webhook removed...

I dearly hope the solution involves not installing webhooks on all one's repositories.

Not sure I understand what the webhook is for. (I've not yet installed the app — because of this issue.) Is this done in order to automatically track Github issue changes? If so, what happens if you want to use this app on a project that you don't have admin rights to?

I was about to download but I saw this comment. Thank you sir.

Yeah… I downloaded but immediately uninstalled after wanting to connect and access data for my private repos. No thanks — I have multiple revenue-generating side projects that are developed on GitHub. I just couldn't get myself to push that authorize button. (I know this is partly on GitHub, but still.)

Can the OP respond to this? I have _tons_ of repos and don't want to end up in the same situation.

Reply on news.ycombinator.com