4 ms·

- config.cryptography.password is always set to a default value if not provided, it will never hit your error case [0]. This is trivially verifiable and I sugge

- config.cryptography.password is always set to a default value if not provided, it will never hit your error case [0]. This is trivially verifiable and I suggest you try it. - no, you accept the algorithm as an environment variable - someone can install your package as is and still set it themselves - as kohtatsu mentioned you should be using a key derivation function. [0]: https://github.com/whatl3y/hide/blob/1c3aaca634f504c3c274bac6a184b8783cd72df8/src/config.ts#L18 https://github.com/whatl3y/hide/blob/1c3aaca634f504c3c274bac...

whatl3y 6y ago
- Wow apologies you’re exactly right, I just converted this from JS to typescript and instead of making this variable null | undefined | string, i made it a string and added a default as a shortcut to get it released. Apologies for questioning this will fix it asap, if nothing else I get some peer review when publishing a Show HN :) https://github.com/whatl3y/hide/blob/5ee54aad1b1c3da4d1865689286b28382c11ae1d/src/config.js https://github.com/whatl3y/hide/blob/5ee54aad1b1c3da4d186568... - Got it, yeah I guess my defense would be it still requires the user to make a conscious decision so it’s not as bad as it being ambiguous or unclear, although removing the ability to control this via env var might be the right move. - I’ll look into and add something to do this soon :)