4 ms·
Even putting them in text files is far better than environment variables. Consider how often people log environment variables or even leave phpinfo() lying aro
by lawnchair_larry 10y ago
Even putting them in text files is far better than environment variables.
Consider how often people log environment variables or even leave phpinfo() lying around. As someone who does penetration tests, I can tell you that it's far more common to gain access to environment variables than it is to read files on the server. The difference between services that didn't have secrets there and the ones that did was a low severity finding that was barely worth logging, and a full remote compromise.
- eropple 10y agoHow often people log environment variables? Maybe the places I've worked are outliers, but `puts ENV.inspect` or the use of PHP wouldn't pass code review in my prior gigs, nor would they be things I'd write today. My experience is literally the opposite--somebody forgetting a chmod is a lot more common than somebody leaking environment variables like that (leaving it up to somebody to figure out a really smart way to read `/proc/pid/environ` or something).
- lgas 10y agoI suspect the vast majority of software development organizations do not do code reviews, so you're already in the minority.
- eropple 10y agoDistressingly likely. Point taken.
- lawnchair_larry 10y agoEven if they do, they 1) Don't reject PHP wholesale and 2) Don't require that the devops person trying to find a bug go through code review when deploying a debugging tool.
- spc476 10y agoI've written code that does that [1] to log information to help diagnose crashes in long running daemons. Now, the dumping of environment variables is optional but it has been helpful to me in isolating issues with some CGI based programs (as Apache passes critical information to the script in environment variables). Of course, it was in a situation where core dumps are not generated so anything related to a crash is helpful. [1] https://github.com/spc476/CGILib/blob/master/src/crashreport.c https://github.com/spc476/CGILib/blob/master/src/crashreport...