3 ms·
Fair criticism. I seek feedback like this, which is why I posted it here. You could call `sendenv` syntactic sugar on top of the first example, allowing you to
by aster0id 3y ago
Fair criticism. I seek feedback like this, which is why I posted it here.
You could call `sendenv` syntactic sugar on top of the first example, allowing you to do things neatly in bulk instead of having to write ad hoc scripts. Additionally once you store a vault, you can send it any number of times Granted, its likely not a very frequent need, but still handy I guess.
Tracking secrets in version control is exactly what I wanted to sidestep by creating this. Sharing environment variables is an ad hoc manual process at my current company (and was the same way in previous workplaces as well).
Ansible or other centralized secret stores felt too heavy for something that should be simple.
The point of trusting the sender is applicable to anything you would send over magic wormhole, but I accept that this solution is more vulnerable given that it writes to rc files directly. I will be adding more validation at the receiver end before writing to rc files, as a response to this criticism.
- flakes 3y ago> Sharing environment variables is an ad hoc manual process at my current company (and was the same way in previous workplaces as well). It really shouldn’t be that way. If the data is meant to be selectively accessed, it should have access controls in place with Authentication, Authorization and Auditing. If its any employees discretion to share the data with another adhoc, I certainly hope the secret is not of great value.
- aster0id 3y agoOh we share secrets using a password manager. But it's a long laundry list of secrets that you have to manually load into your system somehow. There's also an env file there somewhere but it's not up to date. Eliminating the cognitive load of looking up the relevant secret, writing it manually into the RC file, testing whether it works (and starting over if it doesn't, because it's possible the secret is outdated) was one of the goals of creating this.
- TrickardRixx 3y agoSounds to me like a configuration-driven interface with the password manager is the appropriate solution here, then. I used this pattern to write config files out of secrets stored in SSM, which previously was ad-hoc secret sharing. FWIW I would never use Sendenv.
- aster0id 3y agoThat is one solution yes, if you already have a password manager which gives APIs to work with it's secrets. Or a separate product like Doppler which is specialized for this use case. My idea was to avoid a central store, and honestly I don't intend to compete with these massive companies with my weekend long project. If a few people find it useful, I'm happy with it. Thanks for your feedback!
- alsetmusic 3y agoWhy is logout and login required? Why not just source the profile after writing the changes? I must be missing something about how this works.