4 ms·
"MY_APP_SECRET_KEY=bla myapp" hardly accomplishes anything substantial over "myapp --secret-key=blah" It's just a less robust and less well-supported command-li
by bjourne 1y ago
"MY_APP_SECRET_KEY=bla myapp" hardly accomplishes anything substantial over "myapp --secret-key=blah" It's just a less robust and less well-supported command-line interface. It's not supported by most gui launchers, PowerShell, nor many cron implementations, for example.
- akvadrako 1y agoThe command line can be read by any user on the host (with `ps auxww` for example) while the environment cannot. You should never pass secrets on the command line.
- bjourne 1y agoEnvironment variables are not more secure than command line parameters! It's such a common misconception that because environment variables are "not seen" they can serve as a secure channel. They emphatically cannot.
- akvadrako 1y agoSecrets being hidden ("not seen") is really their main quality...