3 ms·

Secrets management seems like a concern. It's really hard for developers to keep credentials and keys out of git. It looks like `gut save` adds anything that no

Secrets management seems like a concern. It's really hard for developers to keep credentials and keys out of git. It looks like `gut save` adds anything that not already in .gitignore. Even less attention to the tracked files could make that worse. I wonder if you could try to detect and warn about secrets, maybe via content inspection.

julien040 4y ago
Yes, I definitely didn't think about this issue. Secret detection seems hard. Maybe "gut save" should inform the user which file will be committed to prevent committing a credentials file, but it's probably not the right solution. I must look into that.
- danenania 4y ago
  If anyone needs help keeping secrets out of git, you could give EnvKey[1] a look (disclaimer: I'm the founder). It aims to keep all secrets out of the repo completely so that you can't be burned by forgetting to add something to .gitignore or other mistakes along those lines. It takes a few minutes to install and then all your secrets and config will be in the environment, and will stay automatically up-to-date when there are changes. Might be a way to cut out that particular failure mode when using Gut (which looks interesting btw--kinda like Git: the good parts). 1 - https://github.com/envkey/envkey https://github.com/envkey/envkey
- 8organicbits 4y ago
  There's some open source tools that attempt to help, but yeah, it's a hard problem. https://github.com/topics/secrets-detection https://github.com/topics/secrets-detection
playingalong 4y ago
I know how it works in practice... But the rule I preach everywhere is never to write credentials in your code. Even if it's your Hello World kind of a local small program to test out things. Alternative: store the credentials in /tmp/my.password and load it in your program. Most programming languages make it easy.

3 ms·

Secrets management seems like a concern. It's really hard for developers to keep credentials and keys out of git. It looks like `gut save` adds anything that no

by 8organicbits 4y ago

julien040 4y ago
Yes, I definitely didn't think about this issue. Secret detection seems hard. Maybe "gut save" should inform the user which file will be committed to prevent committing a credentials file, but it's probably not the right solution. I must look into that.
- danenania 4y ago
  If anyone needs help keeping secrets out of git, you could give EnvKey[1] a look (disclaimer: I'm the founder). It aims to keep all secrets out of the repo completely so that you can't be burned by forgetting to add something to .gitignore or other mistakes along those lines. It takes a few minutes to install and then all your secrets and config will be in the environment, and will stay automatically up-to-date when there are changes. Might be a way to cut out that particular failure mode when using Gut (which looks interesting btw--kinda like Git: the good parts). 1 - https://github.com/envkey/envkey https://github.com/envkey/envkey
- 8organicbits 4y ago
  There's some open source tools that attempt to help, but yeah, it's a hard problem. https://github.com/topics/secrets-detection https://github.com/topics/secrets-detection
playingalong 4y ago
I know how it works in practice... But the rule I preach everywhere is never to write credentials in your code. Even if it's your Hello World kind of a local small program to test out things. Alternative: store the credentials in /tmp/my.password and load it in your program. Most programming languages make it easy.