4 ms·
The advice is good. But why is ENV capitalized? The term is just "environment variable". One heuristic I use for evaluating technical material is orthography: i
by quotemstr 6y ago
The advice is good. But why is ENV capitalized? The term is just "environment variable". One heuristic I use for evaluating technical material is orthography: if you spell or capitalize or spell something improperly, it's likely you'll get a lot else wrong too.
As for secret storage: didn't we solve this problem with keyrings? If I must put a secret in long-term plaintext storage, I might as well put it in a file, where I can see, access-control it, and audit it. Where's the audit log for someone reading an environment variable value?
- mightypirate 6y agobecause traditionally envs are all caps. I think it conveys that extremelly well
- cholmon 6y agoMaybe he's got a history of working with PHP? $_ENV is an autoglobal array that gets filled with environment variables. https://www.php.net/manual/en/reserved.variables.environment.php https://www.php.net/manual/en/reserved.variables.environment...
- irjustin 6y agoIt's also accessed that way in Ruby. ENV['MY_VAR']
- jeffbee 6y agoIt's also %ENV in Perl, and ENVIRON in AWK.
- deleted 6y ago[deleted]
- Izkata 6y agoThe example they use at the top of the article is in bash/shell, and seeing it written as in the article (as "ENV variables") is kinda like a code smell, indicating the author isn't really familiar with what they're criticizing. I think that's what GP is getting at, and it threw me as well - the article really only makes sense when looking at it from the perspective of the author not knowing how env vars are scoped.
- coldtea 6y agoIt's very common to write ENV in all caps. You can be a bona fide master in UNIX and write it that way (just like some people write UNIX and others Unix). Sorry, but technical knowledge/experience is not about particular spelling conventions and word proofing, anymore than they are about wearing "business" clothes...
- quotemstr 6y ago> Sorry, but technical knowledge/experience is not about particular spelling conventions and word proofing Yes, actually, it is. Sloppy language indicates a sloppy mind. I absolutely crank down my estimate of someone's technical competence when I see him writing badly and will continue to do so. Once in a while, you do see bad writing coupled with good technical insight --- especially in infosec for some reason --- but it's the exception, not the rule.
- coldtea 6y ago>Sloppy language indicates a sloppy mind. No, that's a 19th century schoolmaster idea. Many great hackers are messy with grammar and spelling, and even dyslexic.
- quotemstr 6y agoThe 19th century had a lot of good ideas that we've managed to forget.
- SamReidHughes 6y agoSaying "ENV," though, isn't writing badly. Or maybe it is, but it's not a sign of sloppiness. It's not like "JAVA," which was never a thing. It shouldn't trigger your brain defect detector.
- Izkata 6y agoAll caps is part of it sure, but that's not the only thing going on. Given what "env" means, either "environment variables" or "env vars" is more normal. Mixing one short and one long is an oddity on top of the capitalization. Like I said though, it's along the lines of a code smell. It's definitely possible the writer is simply doing it by reflex due to influence from some other language (but then, why not use that language in the example at the top?), but it sticks out and makes more familiar readers question why it's being written that way, where the author is actually coming from.
- jeffbee 6y agoPerhaps the author wrote the article on their MAC.
- coldtea 6y ago>One heuristic I use for evaluating technical material is orthography: if you spell or capitalize or spell something improperly, it's likely you'll get a lot else wrong too. And while the program env is lowercase, the environment is commonly referred to as ENV in technical literature, APIs and so on. If you didn't know that, it's likely you are getting a lot else wrong too... Plus, the "heuristic" is bogus anyway. Though it might be fine for evaluating candidates for secretarial roles though...