3 ms·

I just can’t get over using environment variables for this type of stuff. An attacker can bootstrap a lot just from compromising an ssh login. Platforms like JW

I just can’t get over using environment variables for this type of stuff. An attacker can bootstrap a lot just from compromising an ssh login. Platforms like JWS had the right idea. You used tokens in config files and the platform vault knew how to inject the value at runtime. Nothing was exposed in the environment variables or run command.

linuxdude314 4y ago
Yes, same here. It’s such an absurd design decision it makes me question if this isn’t a honeypot of sorts. Injection at runtime is the target secret managers should be trying to hit.