4 ms·
I like the command line capabilities of "pass", and I also agree with the author about some of its security issues and complexity. I created "passable" to do w
by jph 4y ago
I like the command line capabilities of "pass", and I also agree with the author about some of its security issues and complexity.
I created "passable" to do what I believe is a bit better (IMHO) for command line usage: symmetric encryption, and files do not use any particular in-the-clear directory structure.
The code is POSIX shell, short,and easy to audit. MIT & Apache & GPL license. Constructive feedback welcome.
https://github.com/SixArm/passable https://github.com/SixArm/passable
- latchkey 4y agoNice work. I know this is just a simple shell wrapper around gpg (which I appreciate), but if I was going to rely on this, I'd like to see: Prefer just a simple MIT over GPL (and properly license your repo on Github) Unit tests Build it with CI/CD Releases with tags Available on a package manager (brew/apt/...)
- nequo 4y agoWhat is the problem with GPL if you’re a user and not trying to reuse the code in a closed-source product for sale?
- latchkey 4y agoKISS This is a simple script, it deserves a simple license. Nobody is going to 'sell' just a simple one page script and nothing prevents me from looking at the arguments it uses and putting them into my own commercial product. You don't 'license' arguments to gpg.
- jph 4y agoIt turns out that GPL is a much simpler license for very large enterprises. In fact, this GPL license was originally chosen because it's the simplest for one of my Fortune 50 company clients.
- latchkey 4y agoSimpler than what, MIT?
- jph 4y agoYes simpler than MIT. The Fortune 50's compliance team carefully evaluated many open source licenses, including MIT, BSD, GPL, Apache, etc. and determined that GPL is the best for their company for internal tools such as these, that must be wholly separate from any product offerings. And when I say carefully, I mean multiple lawyers, for multiple years, considering many worldwide regulatory compliance laws. GPL won over all the other options.
- nequo 4y agoDo you know what makes MIT and BSD more complicated for internal tools for these companies? What about MIT or (two-clause) BSD makes it harder to comply with? Would attribution be an excessive burden for them in case such code ended up in their own products? My understanding is that BSD and Apache were historically favorable licenses for code that was intended to promote a protocol and make it an industry standard. Easy reuse helped achieving this goal. For example, IIRC FreeBSD's TCP/IP code was repurposed for Windows and MacOS X, and the Apache HTTP server also went a long way toward establishing HTTP as a standard. Edit: Paragraph on standards.
- jph 4y agoMIT and BSD et al. required the compliance team to track code, attribute it, audit it, and ensure that if the code ended up in the company's external products, then the company could prove the code was always correctly handled This necessarily included all updates to the code, subsequent patches by external contributors that come downstream, subsequent patches by internal contributors that go upstream, eventual sunset of the code, etc. GPL was akin to a bright highlighter stating "internal use only".
- latchkey 4y agoCreating a dependency on a 3rd party piece of software or releasing an internal tool as open source?
- jph 4y agoGood constructive feedback, much appreciated. > Prefer just a simple MIT over GPL Done. I added MIT or Apache-2.0 or GPL-2.0-or-later. > properly license your repo on Github Done. I added LICENSE.md file with SPDX links. > Unit tests Done. I added example tests. Do you have a preferred POSIX shell script unit test approach? > And more... Good ideas, all of them. I'll add your ideas to a new TODO section. Thank you so much!
- zokier 4y agofeels like a stretch to call that a password store when it doesn't really have any password management functionality at all
- jph 4y agoOK. I'll rephrase that. Thanks!