2 ms·
This problem is also removed by just not exporting the variables. Also you can just pass an envp to execvE.
by 1718627440 1y ago
This problem is also removed by just not exporting the variables. Also you can just pass an envp to execvE.
- bjourne 1y ago"MY_APP_SECRET_KEY=bla myapp" hardly accomplishes anything substantial over "myapp --secret-key=blah" It's just a less robust and less well-supported command-line interface. It's not supported by most gui launchers, PowerShell, nor many cron implementations, for example.
- akvadrako 1y agoThe command line can be read by any user on the host (with `ps auxww` for example) while the environment cannot. You should never pass secrets on the command line.
- bjourne 1y agoEnvironment variables are not more secure than command line parameters! It's such a common misconception that because environment variables are "not seen" they can serve as a secure channel. They emphatically cannot.
- akvadrako 1y agoSecrets being hidden ("not seen") is really their main quality...