Packaging with hidden strings

[Jiří Konečný]

Hi all,

I have a theoretical question. Is it possible to a create package to
Fedora which is using oauth2 authentication and that means there are
app_id and secret_code strings generated by api provider? These strings
are used in the program but can't be shipped in the code because
everyone could then use these codes to look as this application.

Thank you for reply,
Jiri Konecny

[Florian Weimer]

On 07/28/2015 07:33 AM, Jiří Konečný wrote:

>  I have a theoretical question. Is it possible to a create package to
>  Fedora which is using oauth2 authentication and that means there are
>  app_id and secret_code strings generated by api provider? These strings
>  are used in the program but can't be shipped in the code because
>  everyone could then use these codes to look as this application. 
No, this is not possible.  May be you could create a tool which
simplifies obtaining suitable API keys and ship that instead?

-- 
Florian Weimer / Red Hat Product Security

[Jiří Konečný]

On Tue, 2015-07-28 at 10:50 +0200, Florian Weimer wrote:
>  On 07/28/2015 07:33 AM, Jiří Konečný wrote:
>  No, this is not possible.  May be you could create a tool which
>  simplifies obtaining suitable API keys and ship that instead?
>  
>  -- 
>  Florian Weimer / Red Hat Product Security 
Ok thank you for your answer Florian.


Jiri Konecny

[Kevin Kofler]

Jiří Konečný wrote:
>  I have a theoretical question. Is it possible to a create package to
>  Fedora which is using oauth2 authentication and that means there are
>  app_id and secret_code strings generated by api provider? These strings
>  are used in the program but can't be shipped in the code because
>  everyone could then use these codes to look as this application. 
Unfortunately, the concept of an application key is fundamentally 
incompatible with Free Software. Several Free Software projects just ship 
the app key(s) they use in their source code, and usually get away with it. 
I guess that for some popular APIs, there are even projects just using some 
other Free Software project's app key, but that's of course bad form.

        Kevin Kofler

[Christopher]

On Thu, Jul 30, 2015 at 8:49 PM, Kevin Kofler <kevin.kofler(a)chello.at&gt; wrote:
>  Jiří Konečný wrote:
> > I have a theoretical question. Is it possible to a create package to
> > Fedora which is using oauth2 authentication and that means there are
> > app_id and secret_code strings generated by api provider? These strings
> > are used in the program but can't be shipped in the code because
> > everyone could then use these codes to look as this application.
>
>  Unfortunately, the concept of an application key is fundamentally
>  incompatible with Free Software. Several Free Software projects just ship
>  the app key(s) they use in their source code, and usually get away with it.
>  I guess that for some popular APIs, there are even projects just using some
>  other Free Software project's app key, but that's of course bad form.
>
>          Kevin Kofler
>  
I didn't read the question as being about app keys. It sounds to me
more like the question was about how to package an app which could be
easily configured with a user's private authentication credentials.
For instance, a client-app for an internet service that requires
authentication. Did I misread the original question?

--
Christopher L Tubbs II
http://gravatar.com/ctubbsii