What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

I'm very interested in having all my Bit Bucket projects in my Careers profile. But when I try to do so I end up with a message from BitBucket saying:

StackOverflow is requesting read and write access to your public and private repositories.

If you don't want to give StackOverflow access to your data, exit this page.

In both public/private repositories, this is unacceptable. I'll not grant write privileges on my repositories to a third party or read privilege to my private repos (you know... they are PRIVATE). And you know, that's a pity because I really want to complete my Careers profile adding my projects.

I propose an alternative solution for validating that I really own a repo, and is to ask me to create a repository (maybe an empty one) with a certain name. Let's say "careers-confirmation-process-{id_of_my_user}" as a name of the repo and I make this repository publicly available.

Then Careers App could check that I have creation/write permissions to that BitBucket account (because I've followed your instructions, the new repo is public and you can check that) and trust me.

This is not a funny idea I've had. This is (more or less) the same approach that Google takes for validating that you really own a domain: they make you edit your DNS entries, or ask you to make a document available via HTTP/FTP, etc... In the case of the repos could work exactly the same.

And of course this temporary repository would be deleted after the validation.

What do you think about that?

share|improve this question

1 Answer 1

Bitbucket’s OAuth implementation doesn’t make a distinction between read and write – it’s all or nothing. We don’t write to any repository.

If you like, you can OAuth with Bitbucket, update your repositories, and then remove Stack’s access by going to your account page on Bitbucket and looking for “Integrated Applications”.

share|improve this answer
    
Yep. I know OAuth does no make a distinction, and that's exactly the problem, and that is why I proupose this workaround. –  krenel00 Jul 11 '12 at 14:54
    
(continuation of the previous comment) Understand that is not possible for me to "remove" all my repos, link my Careers profile with OAuth, remove Stack's access to my repos and upload my repos again. This is a mess! And I know that you don't write on any repository but I have to give you the right for do so, and I don't want to. And exactly the same thing with the private repos. With my proposition we avoid all this problems and is a pretty clean solution. –  krenel00 Jul 11 '12 at 15:01
1  
It’s a clever suggestion. If we get find that the issue is preventing a lot of people from using our profiles, we’ll reconsider. –  Matt Sherman Jul 11 '12 at 17:07
4  
Not that it concerns me, but if it did, it would prevent me from using the Careers profile, just like @krenel00. –  Daniel Fischer Jul 11 '12 at 20:08
    
I am also having this problem. I was hoping that I could add it as a generic open source project but when I try to do so it tells me "use our Bitbucket page page instead." –  row1 Jul 24 '12 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .