4 ms·

I'd love to know, too. Best as I can tell, the only really secure option is to read them in from STDIN. Depending on how the process is running, it may also be

I'd love to know, too. Best as I can tell, the only really secure option is to read them in from STDIN. Depending on how the process is running, it may also be reasonably secure to read the secrets from files. But getting this right is tricky, and really prone to human error: all it takes is one errant chmod/chown to remove the security. Honestly, given the challenges of those options, keeping secrets in environment variables seems like a reasonable compromise to me.

lawnchair_larry 9y ago
Even putting them in text files is far better than environment variables. Consider how often people log environment variables or even leave phpinfo() lying around. As someone who does penetration tests, I can tell you that it's far more common to gain access to environment variables than it is to read files on the server. The difference between services that didn't have secrets there and the ones that did was a low severity finding that was barely worth logging, and a full remote compromise.
- eropple 9y ago
  How often people log environment variables? Maybe the places I've worked are outliers, but `puts ENV.inspect` or the use of PHP wouldn't pass code review in my prior gigs, nor would they be things I'd write today. My experience is literally the opposite--somebody forgetting a chmod is a lot more common than somebody leaking environment variables like that (leaving it up to somebody to figure out a really smart way to read `/proc/pid/environ` or something).
  - lgas 9y ago
    I suspect the vast majority of software development organizations do not do code reviews, so you're already in the minority.
    - eropple 9y ago
      Distressingly likely. Point taken.
    - lawnchair_larry 9y ago
      Even if they do, they 1) Don't reject PHP wholesale and 2) Don't require that the devops person trying to find a bug go through code review when deploying a debugging tool.
  - spc476 9y ago
    I've written code that does that [1] to log information to help diagnose crashes in long running daemons. Now, the dumping of environment variables is optional but it has been helpful to me in isolating issues with some CGI based programs (as Apache passes critical information to the script in environment variables). Of course, it was in a situation where core dumps are not generated so anything related to a crash is helpful. [1] https://github.com/spc476/CGILib/blob/master/src/crashreport.c https://github.com/spc476/CGILib/blob/master/src/crashreport...

lawnchair_larry 9y ago

Even putting them in text files is far better than environment variables. Consider how often people log environment variables or even leave phpinfo() lying around. As someone who does penetration tests, I can tell you that it's far more common to gain access to environment variables than it is to read files on the server. The difference between services that didn't have secrets there and the ones that did was a low severity finding that was barely worth logging, and a full remote compromise.

eropple 9y ago
How often people log environment variables? Maybe the places I've worked are outliers, but `puts ENV.inspect` or the use of PHP wouldn't pass code review in my prior gigs, nor would they be things I'd write today. My experience is literally the opposite--somebody forgetting a chmod is a lot more common than somebody leaking environment variables like that (leaving it up to somebody to figure out a really smart way to read `/proc/pid/environ` or something).
- lgas 9y ago
  I suspect the vast majority of software development organizations do not do code reviews, so you're already in the minority.
  - eropple 9y ago
    Distressingly likely. Point taken.
  - lawnchair_larry 9y ago
    Even if they do, they 1) Don't reject PHP wholesale and 2) Don't require that the devops person trying to find a bug go through code review when deploying a debugging tool.
- spc476 9y ago
  I've written code that does that [1] to log information to help diagnose crashes in long running daemons. Now, the dumping of environment variables is optional but it has been helpful to me in isolating issues with some CGI based programs (as Apache passes critical information to the script in environment variables). Of course, it was in a situation where core dumps are not generated so anything related to a crash is helpful. [1] https://github.com/spc476/CGILib/blob/master/src/crashreport.c https://github.com/spc476/CGILib/blob/master/src/crashreport...