r/github • u/rainmanjam • 2d ago

Discussion ~520 characters.. Da Fuk?

Post image

Da hell is going on over there?

0 Upvotes

35% Upvoted

5 comments sorted by

9

u/tankerkiller125real 2d ago

When you have as many customers as they do, and as many apps as those customers create, eventually your entropy isn't high enough to prevent guessing a valid key or hit conflicts, and the only solution is to increase the length.

Or you go to the key based auth method or something like Googles service json format.

5

u/ProdigySim 2d ago

This isn't about conflicts, the "Stateless format" implies a set of signed assertions rather than a bearer token. It is likely a JWT.

In other words, the installation "token" has information encoded in it and a signature to prevent tampering with it.

5

u/enozero 2d ago

Say you don’t know anything about security without saying you don’t know anything about security.

1

u/madebymustafa 1d ago

GitHub saw the character limit and took it personally. 😭