Hacker News Reader

Comment by maerF0x0 | Hacker News Reader

>"Upload, download, update, and delete files in your Google Drive. Create, access, update, and delete native Google documents in your Google Drive. Manage files and documents in your Google Drive (e.g., search, organize, and modify permissions and other metadata, such as title)"

Hell. Fucking. No.

View on HN

I'd guess that these permissions actually only pertain to files that the app itself creates.

Is that how permissions work? I was under the impression if you gave the app permissions to read write and delete files in your storage, it could (in theory) read/write/delete anything it wanted?

You are right, that's why the permissions are scary as hell.

We have a built in text editor feature, and you can also save on Google Drive

Make it optional then. Permissions are really scary.

Sure! Will definitely look into it. We don't want to ask permission for something we do not need.

to give you context to that permission: If someone stores business information there, then they're giving your free reign to view/change/delete their taxes, invoices, payroll etc.

Or maybe they store something personal there: Selfies and private cat photos... I basically do not give this permission to anything because there is too much at stake. I wish there was a way to give that permission to a single folder or file.

We are sorry for scaring you all. Really, no bad intention here.

I can't access the site so I'm not sure what scope you use on the API, but it sounds like you're requesting full scope on drive. You might be able to get by with only requesting access for just the app files you create for the user:

https://developers.google.com/drive/web/scopes#google_drive_...

Edit: I see Disconnect was the reason I couldn't access your site. The page doesn't seem to load when "FB" isn't defined.

Reply on news.ycombinator.com