Hacker News Reader

Comment by athenot | Hacker News Reader

This also makes it impossible to use for Github Enterprise because the installation is (usually) not available from the public internet and most enterprises won't be cool with the data being accessed/stored by a third party.

It's too bad, it looks like a cool product.

View on HN

I think a standalone product would probably be a lot more powerful from a security standpoint if possible.

The security aspect of this application is what turned me off. I'd love to use Ship, but being greeted with this[0] OAuth confirmation when logging in really turned me off. I was expecting something that reads the API and alerts of new issues, but the sheer number of highlights of the word 'Admin' made me shudder. If they provided a convincing argument as to why they needed as much access as they do, before I began to log in, maybe I would have been a bit more trusting.

[0] - http://cloud.selectivebyt.es/0I1t0N20372v

edit: I took that screenshot on the 28th of May, and it appears that Ship now does explain a little better why it requests the access it does.

We can support GitHub Enterprise with a self-hosted appliance. If you're interested I'd love to talk.

That self-hosted appliance would have to undergo a year-long security review process. Basically we'd have to know all the internals, how things are implemented, with which libs, which versions, how it gets updated...

For something that really should be a piece of desktop software, that most likely won't fly.

I understand your business decision to go for a SaaS model instead of a fixed price, but the added value of the service (vs. a product) doesn't justify it on the user's side.

I wonder, would you be able to check if the self-hosted appliance is making requests to IPs other to the one that hosts your Github Entreprise instance? If you can check for this, you can be more confident that your data is not being sent out to machines you do not control.

That would help build a case for mitigation, but it would still have to undergo the entire scrutiny process.

That's going to pretty much be a non-starter for most people. I'd like to use this software and I might be able to get a couple more people at my company interested, but that's not going to be enough to convince anyone to set up an on-premise server to manage the app.

Perhaps you would consider a hybrid approach where the actual app connected to the API and set up the required webhooks, which your server could then use to notify the app?

Reply on news.ycombinator.com