5 ms·
The idea might not be too bad, but it is ridiculous to have to put something so long and ugly as fullname "secret-token:". Why not just: "Secret:" or "token:"
by greatgib 6y ago
The idea might not be too bad, but it is ridiculous to have to put something so long and ugly as fullname "secret-token:".
Why not just:
"Secret:" or "token:" or "ost:" for example?
- JimDabell 6y agoSeems like all of those would be much more susceptible to false positives.
- vntok 6y agoWhy would you link a secret token to an original sound track header?
- greatgib 6y agoOauth secret token.
- dmd 6y agoWhat problem does that solve? This isn't something that a human will ever have to type. Explicit long names are much better.
- jlokier 6y agoTyping isn't everything. Humans won't have to type "secret-token:" but they will have to read it and it looks ugly :-) I would probably have voted for "secret:[..]". But maybe ugly is good. Secret tokens shouldn't survive for long in source code or files you read, or .bash_history files, or your editor's buffers. They should be in secret config files that you don't read often or even open in an editor. Maybe it's better that they are annoying to see, as a reminder to move them somewhere you don't look at.
- EamonnMR 6y agoThe uglyness is a feature. I wish it where all caps. You should see that line in a PR and the hair on the back of your neck should stand up and you're off to rotate that secret.
- topspin 6y agoBrevity for common things is useful. More useful would be keeping the value (the part to the right of 'secret-token:') concise. Some of the systems that grant tokens generate really lengthy base64 encoded strings that one must then schlep around with every request. A few have solved this with UUID-like hash values, thankfully.