Prose, a content editor for GitHub | Hacker News Reader

Prose, a content editor for GitHub

prose.io

101 pointsavinashv51 comments

Prose.io is a completely client side editor that authenticates against github to allow you to directly edit your markdown files in the repo.

It has a tiny tiny server-side component that exists only to complete the oauth handshake (for the remote server to have something to call back to), called gate keeper.

It's completely open source and self-hostable. They also make a webhook so you can trigger rebuilding on your own server.

They built it to be able to replace their need on a traditional CMS when they switched from Drupal to Node.JS many years ago.

http://developmentseed.org/blog/2012/07/27/build-cms-free-we...

DevelopmentSeed was the company that eventually spun off into MapBox.com, the open source open data map tile hosted service.

They have a long history with the open source community, and are spearheading a lot of the open source mapping stack by employing the lead developers of mapnik, leaflet and much more.

Other than Mapbox.com and Prose.io they also built :

TileMill - https://www.mapbox.com/tilemill/ - An node-webkit based map designer

Id - http://ideditor.com/ - The OpenStreetMap editing interface

(disclaimer: I used to work for them, and left around the time they spun off into mapbox)

Could anyone provide screenshots? I hate to be a hater but authorizing an app to access all my private repos is little too much (not sure how GH allows OAuth scoping)

"This application will be able to read and write all public and private repo data. This includes the following:

Code

Issues

Pull requests

Wikis

Settings

Webhooks and services

Deploy keys "

Indeed, no way am I authorizing this. Why does it need deploy keys and settings access. That's insane. I can't even do that because that would give it access to my job's code too, although I should probably create a new, separate GitHub account for my job. One time I said yes to one of these, tenexer I think it was, and the thing added webhooks to all hundred some private repos for my job. I ended up having to create a script to remove all those hooks. I could have been fired for that I bet.

This has more to do with the GitHub API and the way that they manage scopes than anything else:

https://developer.github.com/v3/oauth/#scopes

There just isn't much granularity there - GitHub OAuth enabled integrations that need repository access can jump from having no specified scope - which grants access to your profile data only - to scope 'public_repo', which grants read-write access to all the data you've listed above, in any public repository, and then to scope 'repo', which grants the same for public and private repos.

It's a shame, because most GitHub integrations I've seen seem to need enough access to just list your repositories (public and private) and ask your permission to enable a webhook on a given repo at your request.

There's no way to do that with GitHub OAuth at the moment without asking for the 'repo' scope, and along with it a whole load of privileges that most people just can't / won't feel comfortable granting.

... And people wonder why we don't want to put our corporate code on a public cloud host.

Hi! I'm the developer behind the original version of Prose:

http://developmentseed.org/blog/2012/june/25/prose-a-content...

I'm no longer involved in the development. However, I do understand your security concerns. But I think this is not just a discussion about the limitations of OAuth Scopes. When using a hosted service, you always pay the price of loosing full control of your data. In return it's very convenient.

I wrote an article about decentralized publishing the other day.

https://medium.com/p/626055376c81

I would also like to mention the project I'm working on right now, Substance. It is an easy-to use self-publishing system, which runs locally and thus gives you full control about your content. (at least until you publish it, because then there's no way back ;))

See: http://substance.io

Cheers, Michael

Here are some screenshots: explore: https://dl.dropboxusercontent.com/u/52991/prose.io/explore.p...

switch branch: https://dl.dropboxusercontent.com/u/52991/prose.io/switch_br...

edit file (pretty useful for READMEs): https://dl.dropboxusercontent.com/u/52991/prose.io/edit.png

Couldn't agree more... Do we really need to grant read and write access to all repos? Sucks if GH's scoping is that coarse.

It definitely isn't that coarse: https://developer.github.com/v3/oauth/#scopes

GitHub are also working on enabling users to accept just a subset of the requested scopes, like just access to public repos, which will make using all of the more fine-grained scopes easier: https://developer.github.com/changes/2013-10-04-oauth-change...

No it’s not, you can make an app that have access only to your public info, and/or public repos, etc.

Unfortunately Amazon is the only cloud provider out there with a robust ACL system.

Is there an open industry standard for implementing ACL policies flexibly like the one Amazon has?

http://en.wikipedia.org/wiki/XACML would be one - it can be a little complicated, but if you can get over that it's quite nice and also adds the idea of an Obligation (something that must be performed on a grant/deny - for example, logging/e-mailing)

I agree that breakdown should be more anonymized. Readme permission/gitignore/license/code should have different end permissions

Yep, I'd love to try it but no way I'm authorizing access to every repo :(

How exactly is an editor for stuff on your repos supposed to do its job otherwise?

He said he wouldn't do it for 'every' repo. It would be different if the permissions were on a per-repo basis.

Sounds like a UX nightmare and a huge pain. I'm glad that privacy maximalists don't design user interfaces...

Wow, this comment sounds a lot more dickish than it was intended to. What I mean is, secure design would be that the app can't even see repos that it isn't authorized for, which means the user has to go through some back channel privacy settings page to authorize it every time they set up a new repo.

I don't want to have to specifically authorize x y and z repos every time I touch the app, and I seriously doubt anyone else does either.

Actually we do design UI, every day. And there are plenty of ways to do this in a comfortable fashion without authorizing read access to the contents of every repository. You could for example, show a list of all repos and when you click to edit one for the first time ask for permissions once for that repository - hardly a UX nightmare?

You probably don't want some random, just-released / potentially buggy application touching all your repos. Wouldn't you want to test it on a throwaway repository first to see if you actually want to use the app / does the app work properly, and then authorize it only for the repos you want.

every is the key word here.

I don't know how a screenshot will prevent it from doing anything malicious, but the source code might:

https://github.com/prose/prose

Similarly, most of the CI tools require huge number of permissions, including Travis.

GH has OAuth scoping, but it needs to be more fine-grained. Say, configurable to per-repository level.

Prose is made by Development Seed (the company behind the healtcare.gov frontend, IIRC).

There are screenshots here: http://developmentseed.org/blog/2012/june/25/prose-a-content...

Prose is an open source node.js app, and can be self-hosted: https://github.com/prose/prose

Actually, it's a Backbone.js application. It uses the browserify library to load other modules, which is what the "require('blah')" bits are. this confused me too when I first read it. so essentially you can run this on a static file server like GH pages.

As far as I remember in order to get the GitHub authentication piece working you need to use an external app simply for the authentication with GitHub. DevelopmentSeed also wrote an app for this called gatekeeper (I think) which I believe is a node.js application.

impressive stuff.

Yes: https://github.com/prose/gatekeeper

I believe all the gatekeeper does is forward the oauth confirmation callback to prose so the client side app can use it.

So, anyone worried about security can run their own gatekeeper and their own prose without having to worry about the NSA (oh, wait…)

A trick one can use is to delegate github oauth to Firebase ,since it supports github authorization.

If you’re looking for an open source, self-hosted, webbased plain-text editor, that supports Markdown, reST, and LaTeX, and has Git integration too: just stumbled upon https://notex.ch/ — quite impressive work. Doesn’t look as nice as Prose.io e.a., but even the GUI is well-done.

Two Things: 1. The link to view the Github projects sites are wrong, they attach the prose.io domain to the actual domain.

2. It's cool that there is a publish button that shows if it has been published, but then when I clicked on it, it said it would be unpublished. I know I have to save first, but that was kind of bad UX. Also when I click it again to set it back to publish, the record still appears to be dirty, with changes to save. Kind of unsettling since I was just browsing to see the functionality.

One more thing: Is there a service (hosted or otherwise) that has this kind of web based editing with a preview of MY website, not just the plain Markdown? I like that non devs could edit it, but we also have our own CSS that could change the way it looks (video embedding, etc.).

It seems nice, but I'd like to know more about where the UI is hosted and whether I can easily host it myself. Is there an architecture diagram somewhere?

(Ideally I'd run it on App Engine.)

The UI is hosted on Github pages: there's no server-side code. The only required server-side component is https://github.com/prose/gatekeeper - an app that makes OAuth possible with CORS.

This is another of those websites that asks you to sign up without explaining what it does

... except for the "learn more" button which takes you to a page which explains very very little.

nice font.

Why does this show up once a month on Hacker News? Seriously. We've discussed this tool to death. And every time, the same discussions follow:

"Hi! I'm a purist. I use VIM to edit my Github textfiles. If you configure VIM correctly, it'll work better than anything in the world!"

"Hi! I'm a non-purist and have tried 50 different tools, let me list them out!"

I don't ever see any other tool or article reposted as much as Prose.io

I think you're sort of missing the point.

It's not about 'editing your github files', and anybody who brings up VIM is definitely missing the point (it's not for you!). As I understand it Prose is about the potential to host totally CMS-free sites (e.g. Jekyll sites) on Github and give your customers a decent editor to alter their content.

It's potentially combining the best of the 'push to git to deploy static site' ethos with 'CMS-like editing capabilities so your customers can reasonably edit content'. I think that's why a lot of people are watching this project closely.

I personally would be happy to see this reposted once a month so we can see its progress and maybe encourage more competition in this space.

I'm not here to discuss the tool. It's a good tool. Nothing wrong with it. It's a great tool, worth discussing. It has its uses etc.

However, there's nothing visibly new with each repost. If someone posted like a release, or maybe a changelog, or a blog post with some feature updates, sure. But as of right now, I see Prose get reposted monthly, with no visible changes. And THAT'S annoying.

Is the same person reposting it? If so, its spam and should be reported. If it's a new person each time, and each time it continues to get up-voted, then you're going to have to just live with it just like we all have to live with articles we don't care for making it to the front page. Obviously HN has consciously made a decision to allow reposts after some cool-off period.

This seems like a great product, but the fact that they include no product details or information doesn't meet the high bar that should be met for someone to provide OAuth access to GitHub.

"This application will be able to read and write all public and private repo data. This includes the following:

Code, Issues, Pull requests, Wikis, Settings, Webhooks and services, Deploy keys"

...nope!

Use this all the time to update READMEs and documentation

Great, clean interface

Could you tell me how this differs from githubs own markdown editor. I played with this for a bit but I failed to notice anything.

Too bad the site doesn't work on my phone at all. Xperia T using Dolphin Browser. Gives me all kinds of floating boxes and a useless progress spinner.

I used Prose before. However, after Heartbleed incident, I removed many OAuth tokens in GitHub, including Prose, and now the site won't load for me at all.

I don't understand how anything like this could just assume that I'm going to give it access to my private repos. Do people seriously do this?

this is really good stuff, its very fast to navigate through different files and edit content. it will work really well with my up coming gem.

How is it better than github editor?

Nice,definetly a nice idea.

While the design looks nice, what does this offer that GitHub's editing functionality[1] does not?

[1]: https://help.github.com/articles/editing-files

It can be configured to work almost like how you would expect a typical CMS to work – with different content types, additional fields in the forms etc: https://github.com/prose/prose/wiki/Prose-Configuration Which means users don't have to know much about Jekyll to add content to such a site.

Prose is tweaked specifically to offer additional features to sites built with Jekyll.

They have a markdown editor, similar to the one github offers, but have a few extra features to deal with Jekyll specific stuff like drafts, image uploading and a distraction free writing mode.

I don't know much about Jekyll, but vanilla Github offers a distraction-free editor called "zen mode".

The editor is content? Absolutely anything you are editing could be described as content. I edit the contents of my editing buffer.

Reply on news.ycombinator.com