3 ms·
The Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this? Either don't store your secrets th
by pxc 3y ago
The Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this?
Either don't store your secrets this way or don't use Nix. Please.
- ptman 3y agoThere are unfortunately lots of software packages that don't offer a convenient passwordFile option in nix and the easiest way to get running is to specify a password in a way that ends up in the nix store.
- pxc 3y agoI knew of a few options like that, but didn't realize it was so widespread. I wish Nixpkgs had a policy against writing modules that way. This creates a policy nightmare for companies that might use Nix. Alternatively, we need ACLs for the Nix store, or at least some store paths, at a minimum. :-\
- Filligree 3y agoI use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable. /nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.