4 ms·

With leaking secrets being such a big concern, it seems wise to require that secrets be encrypted to use dotenvx. That is, it will only work with encrypted secr

With leaking secrets being such a big concern, it seems wise to require that secrets be encrypted to use dotenvx. That is, it will only work with encrypted secrets. As others have commented, this doesn't eliminate the risk entirely, but I think having a tool that doesn't support unencrypted secrets at all, although a bit less convenient, is a win.

akvadrako 2y ago
Encrypted with what key? Do you just mean obscured?
- projektfu 2y ago
  The utility has a means of encrypting them with public key cryptography so that the plaintext is never in your development directory. GP thinks this should be made mandatory.
  - airtonix 2y ago
    point is: where and how you do get this key when in prod?
    - progx 2y ago
      The "securest" way is, you start your app and the app awaits the input of the key, it is only in the RAM. But in reality, nobody will do that.
    - michaelmior 2y ago
      Part of my point is that if you care about security, you need to be thinking about these things. Forcing encryption then also forces you to think about how to provide the key. Of course, it's possible to do this in a very insecure way that defeats the purpose of encryption in the first place, but I think it moves things in the right direction.
- cced 2y ago
  There are a lot of ways of doing this, sealed secrets is one, mozilla sops is another.
- michaelmior 2y ago
  No, I mean encrypted. I'm not sure what you mean by "obscured", but if you just mean obfuscated in some easily recoverable way without a key, then no. If you read the original post, it describes the mechanism that dotenvx already has in place for encryption.
bluelightning2k 2y ago
Not all env vars are secrets. About half is just regular config. If mandatory how would it know what's a secret?
- michaelmior 2y ago
  I'm not sure what the "it" you're referring to is, but if something is not a secret, you could either encrypt it anyway or use an alternate mechanism to provide the value.
atkailash 2y ago
[dead]

akvadrako 2y ago

Encrypted with what key? Do you just mean obscured?

projektfu 2y ago
The utility has a means of encrypting them with public key cryptography so that the plaintext is never in your development directory. GP thinks this should be made mandatory.
- airtonix 2y ago
  point is: where and how you do get this key when in prod?
  - progx 2y ago
    The "securest" way is, you start your app and the app awaits the input of the key, it is only in the RAM. But in reality, nobody will do that.
  - michaelmior 2y ago
    Part of my point is that if you care about security, you need to be thinking about these things. Forcing encryption then also forces you to think about how to provide the key. Of course, it's possible to do this in a very insecure way that defeats the purpose of encryption in the first place, but I think it moves things in the right direction.
cced 2y ago
There are a lot of ways of doing this, sealed secrets is one, mozilla sops is another.
michaelmior 2y ago
No, I mean encrypted. I'm not sure what you mean by "obscured", but if you just mean obfuscated in some easily recoverable way without a key, then no. If you read the original post, it describes the mechanism that dotenvx already has in place for encryption.

bluelightning2k 2y ago

Not all env vars are secrets. About half is just regular config. If mandatory how would it know what's a secret?

michaelmior 2y ago
I'm not sure what the "it" you're referring to is, but if something is not a secret, you could either encrypt it anyway or use an alternate mechanism to provide the value.

atkailash 2y ago

[dead]