16 ms·
> It doesn't traverse parent directories So there is chance it won't be massive security hole enabled by default! Great! > it doesn't have good overwrite/merg
by ilyt 3y ago
> It doesn't traverse parent directories
So there is chance it won't be massive security hole enabled by default! Great!
> it doesn't have good overwrite/merge logic, multiline support, or variable expansion - things that dotenv has supported for years (sometimes with add-ons)
99% of what I used env files for was just a bunch of key-values for db passwords so their minimal implementation is probably good enough for most. Then again, that's experience from other than node ecosystems, and if config requires "multiline support, or variable expansion" we either make proper config file or a template for CM to deploy.
- willio58 3y ago> So there is chance it won't be massive security hole enabled by default! Great! True that. Sometimes committees lead to bloat. And sometimes committees lead to not adding magic to everything that ends up being abused by malicious actors. I love that deno and bun exist and are getting rapidly developed. By I also love the Node has been and continues to be a rock for the industry.
- hotnfresh 3y agoThat is a strong argument for using external tools to define the environment, and not installing any of the sort that’d read a .env file on any kind of deployed environment at all (just local dev machines) So another mark in the “why have this feature in the first place?” column. The whole concept is for dev ergonomics, but this one’s making that worse for security reasons? Ugh. Just leave it out entirely, then.