3 ms·
Isn't it totally verboten to put secret tokens / passwords into scripts? Regardless of language? When I write, say, bash scripts which do work using ssh, I don
by einpoklum 6y ago
Isn't it totally verboten to put secret tokens / passwords into scripts? Regardless of language?
When I write, say, bash scripts which do work using ssh, I don't specify a password: The user running the script will provide their own manually, or use ssh-copy-id, or edit the authorized_keys file on the target machine if they want to save themselves some typing. That is - authentication is decoupled from my script's actual work. Why is that not how things work with PyPI?
- progval 6y agoIt is. But even if it is strongly discouraged, some people will commit it anyway. Look at any beginner's repository, there is a high chance it contains files compiled from the source of the repo (executable, .pyc, ...), the developer's IDE config (.vscode, ...), __MACOSX, ...
- klyrs 6y ago> Isn't it totally verboten to put secret tokens / passwords into scripts? It's only a rule because people have made the mistake enough to learn the lesson...
- dragonwriter 6y ago> Isn't it totally verboten to put secret tokens / passwords into scripts? No, it's not “totally verboten” (forbidden by whom?), and people do it all the time. Mostly, perhaps, for stuff they aren't planning to share, but plans change. It doesn't help that lots of example code embeds placeholders for secrets directly (with notes to replace with your actual credentials), so lots of stuff gets embedded in the course of copy-and-paste coding.