6 ms·

KeepassC – Curses based keepass written in Rust

96 points by Immortalin 11y ago

DanBC 11y ago
I love this. I'm a bit surprised that there isn't currently a Linux distro that focuses on curses/ncurses apps. And if anyone is looking for the gap in the curses market there's no word processors. (Plenty of text editors though.)
- creshal 11y ago
  > I'm a bit surprised that there isn't currently a Linux distro that focuses on curses/ncurses apps. Is there a need for one? You can use all distributions without a graphical UI. > And if anyone is looking for the gap in the curses market there's no word processors Yeah, I've been wondering about that. People (including not-so-casual writers like GRRM) still swoon about programs like Wordstar, but it seems all Linux terminal users are content with using vim/emacs/nano/… with TeX (or lately Markdown).
  - endgame 11y ago
    I think that the reason nobody's built a curses word processor is that if you're not getting a WYSIWYG editing experience, you may as well go all the way to a full markup language.
    - dagw 11y ago
      I don't know. I used to think WordPerfect 5.1 was pretty great back in the day.
      - dspillett 11y ago
        Such programs being successful was initially due to more graphical options not being available, and later due to the graphical ones being impractical if you had older hardware (and of course because you were used to the text based app and hadn't found time to learn an alternative). I doubt the niche for rich-UI text based apps like that and it's ilk (Lotus 123 anyone?) exists for enough people to make writing/maintaining one worth while - you'd either be happy with less (markdown and a post processor) or end up wanting more than such a UI could practically provide, I expect. Though I'm sure you'll find a WordPerfect mode for emacs somewhere, if you are feeling nostagic!
- dagw 11y ago
  http://cowlark.com/wordgrinder/ http://cowlark.com/wordgrinder/ looks like a pretty cool word processor
- ge0rg 11y ago
  Maybe this is due to a lack of proper widget toolkits. Curses is a real pain to program, and creating sophisticated UIs with it is borderline impossible. Things like dialog are not very flexible, and TurboVision (the best looking CUI ever) never took off, probably because of the lame C port.
  - creshal 11y ago
    Termbox is an "alternative", but it's, while easier to use, even more low-level. It's a shame there's no decent, modern high-level UI toolkit for terminals.
  - ape4 11y ago
    The screenshot here https://en.wikipedia.org/wiki/Ncurses https://en.wikipedia.org/wiki/Ncurses looks pretty nifty. But reading I see it has forms but no mention of widgets.
  - zokier 11y ago
    And here I was thinking that the ease of programming was the main reason for ncurses to be as popular as it is. Oh well...
- vezzy-fnord 11y ago
  Slackware's base configuration tools are largely (n)curses-based, plus its highly vanilla unpatched nature with manual, guided package management means you can assemble something like that easily.
ubernostrum 11y ago
Why does the headline say "written in Rust" when the linked page says it's written in Python 3 (and the repository is full of Python and no Rust)?
- Jweb_Guru 11y ago
  > My main focus has switched to reimplement this project in Rust as it allows me to realize my vision of a secure password manager which is not possible with Python. The "reimplement" links to the Rust repository in question.
- kirushik 11y ago
  There is a different repo for Rust implementation: https://github.com/raymontag/rust-keepass https://github.com/raymontag/rust-keepass I guess, OP posted the link to the blog post to highlight some reasoning behind the switch, not the code itself.
schmrz 11y ago
> [Rust] allows me to realize my vision of a secure password manager which is not possible with Python. Not trying to debunk this or anything, but could anyone expand on this (eg. what does secure mean in this context)? Has the author written somewhere about his decision (I couldn't find anything)?
- StavrosK 11y ago
  I am also curious, because this makes very little sense to me. Is the author worried that he'll get pwned when opening random Keepass files he found on the internet?
  - drdaeman 11y ago
    More likely a page getting swapped out and password remaining somewhere. Indeed, Python doesn't have builtin[1] means to do, say, mlock(2) on str objects, or assure their contents will be zeroed after variable's not used anymore. [1] upd: besides ctypes, but not sure if we can consider this builtin or not...
- gnuvince 11y ago
  I am not the author, so I don't speak for him, but I feel that I could write much more secure code in Rust than in Python mainly because in Python the onus of making sure everything is okay falls 100% on me. In Rust, the compiler with the type checker and the borrow checker can take a lot of load off my mind.
- pornel 11y ago
  My guesses: - ability to reliably erase memory that held passwords/keys with assurance it wasn't copied accidentally. AFAIK Python doesn't guarantee zeroing of freed memory. - type safety, error handling enforced by the type system, and race-condition-free concurrency might be an extra assurance.
  - Gankro 11y ago
    What makes you think there's a reliable way to zero memory in Rust?
aktau 11y ago
Last I tried keepassc (about a month ago, definitely the python3 version), I couldn't find a way to make it load my .kdbx file which I routinely open/edit with keepassx. I tried renaming it to <something>.kdb and that didn't do it either. I didn't look that much into it but here goes: is my use case actually unsupported?
- dnlrn 11y ago
  .kdb and .kdbx are two totally different formats. .kdb is used by KeePass and KeePassX, .kdbx is used by KeePass 2 and KeePassX 2.0 (currently Beta).
- deleted 11y ago
  [deleted]
chromano 11y ago
Does anyone here use www.passwordstore.org? I read through the source and I simply love how simple things are... therefore I wonder why something like keepass is preferred over passwordstore?
- rogerbraun 11y ago
  I use it, it's pretty good. As simple as it can be, easily integrates with everything.
- kapep 11y ago
  It seems that passwords are stored in files with plain text names that identify the website, service, etc. that the password is used for. Most other password managers don't expose this kind of information. I haven't looked at those 3rd party clients mentioned on their website but I would say a console based command isn't an option for most people when there are password managers that come with a simple management gui and a convenient keyboard shortcut that insert the right account and password information directly into html login forms in your browser.
- jgrowl 11y ago
  I also use it here. I miss not being able to autocomplete browser forms when I switched over from 1password, but it isn't really that big of a deal. As others mention, I wish there was a built in way of protecting the meta-data. I guess it wouldn't be that hard to just encrypt/decrypt the entire directory myself.
avinassh 11y ago
what is the meaning of: curses-based password manager
- Cederfjard 11y ago
  Not to be glib, but: https://en.wikipedia.org/wiki/Curses_(programming_library) https://en.wikipedia.org/wiki/Curses_(programming_library) https://en.wikipedia.org/wiki/Password_manager https://en.wikipedia.org/wiki/Password_manager

96 points by Immortalin 11y ago

DanBC 11y ago

I love this. I'm a bit surprised that there isn't currently a Linux distro that focuses on curses/ncurses apps. And if anyone is looking for the gap in the curses market there's no word processors. (Plenty of text editors though.)

creshal 11y ago
> I'm a bit surprised that there isn't currently a Linux distro that focuses on curses/ncurses apps. Is there a need for one? You can use all distributions without a graphical UI. > And if anyone is looking for the gap in the curses market there's no word processors Yeah, I've been wondering about that. People (including not-so-casual writers like GRRM) still swoon about programs like Wordstar, but it seems all Linux terminal users are content with using vim/emacs/nano/… with TeX (or lately Markdown).
- endgame 11y ago
  I think that the reason nobody's built a curses word processor is that if you're not getting a WYSIWYG editing experience, you may as well go all the way to a full markup language.
  - dagw 11y ago
    I don't know. I used to think WordPerfect 5.1 was pretty great back in the day.
    - dspillett 11y ago
      Such programs being successful was initially due to more graphical options not being available, and later due to the graphical ones being impractical if you had older hardware (and of course because you were used to the text based app and hadn't found time to learn an alternative). I doubt the niche for rich-UI text based apps like that and it's ilk (Lotus 123 anyone?) exists for enough people to make writing/maintaining one worth while - you'd either be happy with less (markdown and a post processor) or end up wanting more than such a UI could practically provide, I expect. Though I'm sure you'll find a WordPerfect mode for emacs somewhere, if you are feeling nostagic!
dagw 11y ago
http://cowlark.com/wordgrinder/ http://cowlark.com/wordgrinder/ looks like a pretty cool word processor
ge0rg 11y ago
Maybe this is due to a lack of proper widget toolkits. Curses is a real pain to program, and creating sophisticated UIs with it is borderline impossible. Things like dialog are not very flexible, and TurboVision (the best looking CUI ever) never took off, probably because of the lame C port.
- creshal 11y ago
  Termbox is an "alternative", but it's, while easier to use, even more low-level. It's a shame there's no decent, modern high-level UI toolkit for terminals.
- ape4 11y ago
  The screenshot here https://en.wikipedia.org/wiki/Ncurses https://en.wikipedia.org/wiki/Ncurses looks pretty nifty. But reading I see it has forms but no mention of widgets.
- zokier 11y ago
  And here I was thinking that the ease of programming was the main reason for ncurses to be as popular as it is. Oh well...
vezzy-fnord 11y ago
Slackware's base configuration tools are largely (n)curses-based, plus its highly vanilla unpatched nature with manual, guided package management means you can assemble something like that easily.

ubernostrum 11y ago

Why does the headline say "written in Rust" when the linked page says it's written in Python 3 (and the repository is full of Python and no Rust)?

Jweb_Guru 11y ago
> My main focus has switched to reimplement this project in Rust as it allows me to realize my vision of a secure password manager which is not possible with Python. The "reimplement" links to the Rust repository in question.
kirushik 11y ago
There is a different repo for Rust implementation: https://github.com/raymontag/rust-keepass https://github.com/raymontag/rust-keepass I guess, OP posted the link to the blog post to highlight some reasoning behind the switch, not the code itself.

schmrz 11y ago

> [Rust] allows me to realize my vision of a secure password manager which is not possible with Python. Not trying to debunk this or anything, but could anyone expand on this (eg. what does secure mean in this context)? Has the author written somewhere about his decision (I couldn't find anything)?

StavrosK 11y ago
I am also curious, because this makes very little sense to me. Is the author worried that he'll get pwned when opening random Keepass files he found on the internet?
- drdaeman 11y ago
  More likely a page getting swapped out and password remaining somewhere. Indeed, Python doesn't have builtin[1] means to do, say, mlock(2) on str objects, or assure their contents will be zeroed after variable's not used anymore. [1] upd: besides ctypes, but not sure if we can consider this builtin or not...
gnuvince 11y ago
I am not the author, so I don't speak for him, but I feel that I could write much more secure code in Rust than in Python mainly because in Python the onus of making sure everything is okay falls 100% on me. In Rust, the compiler with the type checker and the borrow checker can take a lot of load off my mind.
pornel 11y ago
My guesses: - ability to reliably erase memory that held passwords/keys with assurance it wasn't copied accidentally. AFAIK Python doesn't guarantee zeroing of freed memory. - type safety, error handling enforced by the type system, and race-condition-free concurrency might be an extra assurance.
- Gankro 11y ago
  What makes you think there's a reliable way to zero memory in Rust?

aktau 11y ago

Last I tried keepassc (about a month ago, definitely the python3 version), I couldn't find a way to make it load my .kdbx file which I routinely open/edit with keepassx. I tried renaming it to <something>.kdb and that didn't do it either. I didn't look that much into it but here goes: is my use case actually unsupported?

dnlrn 11y ago
.kdb and .kdbx are two totally different formats. .kdb is used by KeePass and KeePassX, .kdbx is used by KeePass 2 and KeePassX 2.0 (currently Beta).
deleted 11y ago
[deleted]

chromano 11y ago

Does anyone here use www.passwordstore.org? I read through the source and I simply love how simple things are... therefore I wonder why something like keepass is preferred over passwordstore?

rogerbraun 11y ago
I use it, it's pretty good. As simple as it can be, easily integrates with everything.
kapep 11y ago
It seems that passwords are stored in files with plain text names that identify the website, service, etc. that the password is used for. Most other password managers don't expose this kind of information. I haven't looked at those 3rd party clients mentioned on their website but I would say a console based command isn't an option for most people when there are password managers that come with a simple management gui and a convenient keyboard shortcut that insert the right account and password information directly into html login forms in your browser.
jgrowl 11y ago
I also use it here. I miss not being able to autocomplete browser forms when I switched over from 1password, but it isn't really that big of a deal. As others mention, I wish there was a built in way of protecting the meta-data. I guess it wouldn't be that hard to just encrypt/decrypt the entire directory myself.

avinassh 11y ago

what is the meaning of: curses-based password manager

Cederfjard 11y ago
Not to be glib, but: https://en.wikipedia.org/wiki/Curses_(programming_library) https://en.wikipedia.org/wiki/Curses_(programming_library) https://en.wikipedia.org/wiki/Password_manager https://en.wikipedia.org/wiki/Password_manager