Hacker News Reader

Comment by mikexstudios | Hacker News Reader

This is really cool, but is there a reason why the authorization permissions requires r/w access to: Private email addresses, and SSH keys?

View on HN

Hey Mike,

We don't ever write anything to your profile. As explained in the link below, this is a standard GitHub permission.

PS your SSH keys are 100% public: https://api.github.com/users/mikexstudios/keys

Mike

Short answer: https://gitter.zendesk.com/hc/en-us/articles/200178961-Why-d...

Long answer: https://gitter.zendesk.com/hc/en-us/articles/200176672-Authe...

Any idea if GitHub will ever alter the way that works so you can avoid it giving you write access. I was all ready to give Gitter a go until I saw the permissions that would be granted. Sure you're trust worthy but us IT types can be paranoid ;-)

Hi, this is Andrew from Gitter.

And we completely understand. We're waiting on Github to update their OAuth scopes, and we understand that they're working on it.

If you're not comfortable with the OAuth permissions Gitter requires, you could try Gitter's sister product, Troupe https://trou.pe. It's got most of the same features, but with less Github integration and no markdown or syntax highlighting.

They actually recently announced some more granular scopes for working with webhooks.

So we hope for more to come for other areas of the API.

The idea that this gives write access to my SSH keys is still scary. Not that I don't trust your service, but what if somebody attacks it and adds malicious keys?

Or does write access not include SSH keys?

You could always be hacked. It's a danger to provide those permissions. (I understand that there's not much more you can do about it.)

It is apparently a limitation in the GitHub access levels:

https://gitter.zendesk.com/hc/en-us/articles/200176672-Authe...

Which is unfortunate, because I'd like to try gitter but I'm not willing to mess around with my github account like that.

Reply on news.ycombinator.com