Comment by fencepost | Hacker News Reader

Comment by fencepost | Hacker News Reader

Entirely possible that this is a stupid question, but I hope I'm not the only one who has it.

One thing that's made me twitchy with everything in this class of services that's kept me from considering using them - are they working only with shared free/busy or am I correct in believing that you basically have to give them "keys to the kingdom" for them to work with most of the vendors?

Maybe I just haven't paid attention (OK, definitely true), but I don't recall seeing a lot of discussion about most providers having good permissions granularity that would let me say "grant access to my M365 free/busy data but not appointment contents, email, Sharepoint, Onedrive, etc" or "grant access to my Google Workspace calendars X Y and Z but not to email or storage."

Am I missing something and limited access has always been there, or am I correct in believing that granting the calendar access that these need also includes a ton of other access that people may not recognize?

Hey - one of the cofounders here.

That’s a great question. When you connect your calendar with most scheduling apps, there’s really nothing stopping most of them from doing malicious things behind the scenes with your data. You don’t really know if they’re just querying your availability, or actually pulling specific event data.

With Cal.com, that’s different. Since day one, I built it to only check free/busy times and that hasn’t changed. Also, as it’s open source, you can literally go on GitHub and verify what I’m saying, as well as comb through every line of code that touches your calendar.

It’s the same principle that keeps something like the Linux kernel free of malicious software. There’s enough contributors from around the world that audit and review the code, that you can ultimately trust that there’s nothing malicious going on behind the scenes.

Also just to clarify, with how most major providers’ permission systems work, it’s scoped that we can only access your calendar data, and not contents of your email and such.

I'm not even so much concerned with services like yours doing something malicious behind the scenes - I'm much more concerned about them being hacked/compromised in such a way that saved tokens could be used by an attacker. Maybe I'm wrong, but I suspect that there are services that get granted calendar, email, file access that could be considered much 'squishier' targets than the underlying services they connect to.

So, if you're getting the minimum viable amount of access to someone's calendar, what's the worst that could be done by an attacker with persistent access to your backend systems, and how does it vary between different services you connect to (e.g. Google, M365, Outlook.com, Zoom, etc.)? This isn't even really about your software, more about "how restricted do the underlying services allow my access to be?"

On Google Calendar as well as Fastmail Calendar there are options to create a share link for your calendar which only exposes availability but not any details of the events other than date/time/duration. It’s not granular other than that though. I use it to share my personal calendar with my work so I can e.g. schedule a doctor appointment with details and have that appear and affect availability in my work calendar - it just shows up as “Unavailable” with no other details.

M365 has something similar (ability to share a calendar with another entity (by providing an email address, which presumably triggers an email with a relevant link) with some granularity as to what's visible), but I think when I looked at one of these "shared calendar scheduling" options quite some time ago it wasn't looking for a sharing URL but for an OAuth connection (probably to be able to add appointments directly to a calendar). That made me twitchy enough that I bailed on the idea.

Both O365 and Google have features that let you send your availability to someone to facilitate booking a meeting.

Both platforms move glacially and poorly communicate, but solutions like this are ultimately tick boxes for the platform products. So they live in that niche market of products that are actually complicated Excel formulae.

That’s not a terrible thing!

Calendly doesn't ask for Google drive or email access, and limits itself to calendar reading and writing, if that's what you're asking. Other, shittier apps may ask for more, but don't draw conclusions where they aren't warranted.

As I said, it may be a stupid question - it's been a long time since I looked at any of this, it's possible it predates Google having granular permissions on sharing.

Reply on news.ycombinator.com