3 ms·

Skimmed the readme, seems like it's not AEAD? I don't see any reason to use a tool that's not AEAD. Also, while I get the appeal of just storing it all in a g

by CBLT 1y ago

Skimmed the readme, seems like it's not AEAD? I don't see any reason to use a tool that's not AEAD. Also, while I get the appeal of just storing it all in a giant JSON, I don't really feel that's the final word in simple storage formats. I'd personally just use SQLite, or some other format I could rsync.

renerick 1y ago
Text formats have the advantage of better support in version control systems. SOPS does similar thing, it stores encrypted values in yaml/json, and from my experience using this approach with git it is indeed an improvement over, say, Ansible vault, which essentially turns text files into blobs
- CBLT 1y ago
  I use pass[0] which uses a flat directory structure and git. It works great! At $dayjob we have json lockfiles committed to git and merges get pretty gnarly. Not as big of a fan of just dropping it all in json. The toml lockfiles are a bit better in git. [0] https://www.passwordstore.org/ https://www.passwordstore.org/
ecb_penguin 1y ago
> Skimmed the readme, seems like it's not AEAD? Are you just looking for keywords? That's not how a quality security review should be done. > I don't see any reason to use a tool that's not AEAD. Do you have an actual attack? Non AEAD schemes have been used for decades without any attack. There might be entirely valid complaints against this. Lack of AEAD is not one... > I don't really feel that's the final word in simple storage formats. Literally nobody said it was > I'd personally just use SQLite, or some other format I could rsync. You can rsync a JSON file just as you can rsync a SQLite file....
- CBLT 1y ago
  > You can rsync a JSON file just as you can rsync a SQLite file.... `sqlite-rsync` does a deep comparison and only transmits new rows, without deleting other data. `rsync` on a json file just replaces the file.
w1nt3rmut3 1y ago
It is using https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.modes.CFB https://cryptography.io/en/latest/hazmat/primitives/symmetri... so no aead. And also using this library as it strongly encourages to use something else. Because of footguns like this.

by CBLT 1y ago

renerick 1y ago

Text formats have the advantage of better support in version control systems. SOPS does similar thing, it stores encrypted values in yaml/json, and from my experience using this approach with git it is indeed an improvement over, say, Ansible vault, which essentially turns text files into blobs

CBLT 1y ago
I use pass[0] which uses a flat directory structure and git. It works great! At $dayjob we have json lockfiles committed to git and merges get pretty gnarly. Not as big of a fan of just dropping it all in json. The toml lockfiles are a bit better in git. [0] https://www.passwordstore.org/ https://www.passwordstore.org/

ecb_penguin 1y ago

> Skimmed the readme, seems like it's not AEAD? Are you just looking for keywords? That's not how a quality security review should be done. > I don't see any reason to use a tool that's not AEAD. Do you have an actual attack? Non AEAD schemes have been used for decades without any attack. There might be entirely valid complaints against this. Lack of AEAD is not one... > I don't really feel that's the final word in simple storage formats. Literally nobody said it was > I'd personally just use SQLite, or some other format I could rsync. You can rsync a JSON file just as you can rsync a SQLite file....

CBLT 1y ago
> You can rsync a JSON file just as you can rsync a SQLite file.... `sqlite-rsync` does a deep comparison and only transmits new rows, without deleting other data. `rsync` on a json file just replaces the file.

w1nt3rmut3 1y ago

It is using https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.modes.CFB https://cryptography.io/en/latest/hazmat/primitives/symmetri... so no aead. And also using this library as it strongly encourages to use something else. Because of footguns like this.