Hacker News Reader

Comment by hhw3h | Hacker News Reader

Looks like an interesting tool from the landing page. When I tried to create an account with Google it asked for fairly expansive permissions:

- See and download any calendar you can access using your Google Calendar

- See, edit, share, and permanently delete all the calendars you can access using Google Calendar

Are all these needed? Why would you need to delete a calendar from my account?

View on HN

When permissions are grouped together like that by bullet, it's usually because Google's API only has 1 scope that covers all those actions (per bullet). My guess is they want to create new events on your calendar?

Looking at the Google Calendar API, it seems like if you want to grant an app the ability to add new events, you need to give permission to view all events and delete events as well.

https://developers.google.com/calendar/api/v3/reference/acl/...

https://developers.google.com/identity/protocols/oauth2/scop...

So it's kind Google's fault for that. Still that's a lot of permissions to request, I'd be uncomfortable even letting them have the ability to add or view events. Does it have a way to work if you don't allow it access to Google Calendar?

I think all apps seeing all events is a usability thing. When you try to double schedule something every app can tell you about the conflict.

I would much rather companies just provide a Webcal link rather than mess with my calendar through an API...

While I agree that the permissions seem over and above what's necessary, there's a trivial solution available that I've been using for many years: create a Google account (or several!) that's exclusively used for _untrusted_ services. Would you really care if this - or any - app has access to an empty calendar, can access its empty Drive, or ends up adding an irrelevant email address to a spam list?

(By the way, it's not lost on me that you probably already do have such a setup, it's just, I know far too many folks who don't!)

I simply declined the permission and it still made the account. Seems like only calendar integration is not set up because of it.

Reply on news.ycombinator.com