#[snarfed]tldr, i may be able to offer either read only on public *and* private repos, or read/write on public only, but not read only on public only :(
#jeremych_I see it in some examples, not in others, and can't seem to figure out whether I need it or not.
#ZegnatAny cookies will be read and written from and to that file. So you can have the same session going over multiple curl calls.
#ZegnatE.g. if your first call logs in to a site, you can store the cookies the site gives back, and then send those cookies on your next request to stay in the logged in session.
#ZegnatMight be important if crawling a website or automating tasks. For most APIs you wouldn't need it as those do not tend to set cookies.
#jeremych_So then, I guess I do not need it if simply looping through my feed and sending a few curls to my site?
#LoqiIt looks like we don't have a page for "ImageOptim" yet. Would you like to create it? (Or just say "ImageOptim is ____", a sentence describing the term)
#snarfedno real surprises in the post except for this vague nugget: "Support for Non-Business Profiles [FUTURE]: Basic permissioning for non-business profiles will be supported in early 2019."
#grantcodesActually speaking of this, I have a security question: My token endpoint actually just encrypts the scopes inside the access token and then decrypts the token to get the scopes again. Can anyone think of any issues with that?
#snarfediirc aaronpk has written about stateless tokens like this? (couldn't find it with a few searches)
#aaronpkthe main drawback with that kind of token is that you can't expire them without adding back state tracking
#grantcodesCool thanks :) I think that's fine for me. I don't use many at one time so if I ever have a security issue I can block a client_id or just expire all tokens
#snarfedok, confirmed re github permission granularity:
#snarfed* "oauth apps" can request read/write access to just public repos.
#snarfed* "github apps" can request read only vs read/write, to all repos or ones the user selects, but no way to default to public only.
#snarfedand the dealbreaker for github apps is, they can't access repos that a user (or org) doesn't own, or notifications, so they're not really usable for backfeed.
#snarfedso my tentative plan is for bridgy backfeed to request notifications and public_repo (read/write) permissions
#snarfedmy one reservation is that notifications includes issue and PR titles (only) from private repos, which the auth prompt doesn't mention :/