3 ms·
Rails and others mis-trained a generation of web devs to put credentials into a big environment file. This was always a bad idea, and even worse now that thing
by michael1999 3y ago
Rails and others mis-trained a generation of web devs to put credentials into a big environment file. This was always a bad idea, and even worse now that things like AWS credentials can be turned into cash so quickly.
- p10_user 3y agoWhat is a more proper way to do it? And I'm assuming you aren't talking about an environment file that is part of the codebase - unless your point is that it is very easy to accidentally add the env file to the codebase - then I get your point.
- michael1999 3y agoThat's exactly what lots of early web frameworks did. One big yaml/ini file with every credential for every environment, and a single "environment" selection when launching the app. A truly huge footgun. In their defence, it wasn't as bad back then. They were created by/for small teams/sole practitioners with no separation of responsibility. Source control would be on-prem (or just local directory backups). The Java EE model with explicit separation between development and deployment as separate activities was a disliked, or not understood.