2 ms·
In general, it's a terrible idea to run a command that contains secret information in the command line. The 'API secret' will be viewable by any user on the mac
by joosters 12y ago
In general, it's a terrible idea to run a command that contains secret information in the command line. The 'API secret' will be viewable by any user on the machine. (For instance, they could run 'ps waux' and grab the key)
Of course, the script could be running on a machine with only one user, so there might be no problem for this specific case. But it's just good practice to avoid creating potential security holes.
- zrail 12y agoYep, absolutely right. This is just running on my laptop so there's no other user, but a server-based solution should absolutely hit the API using something like Faraday[1] or requests[2]. [1]: https://github.com/lostisland/faraday https://github.com/lostisland/faraday [2]: http://docs.python-requests.org/en/latest/ http://docs.python-requests.org/en/latest/
- joosters 12y agoI think there's an even easier fix here; you can solve it by getting curl to read the form parameters from a file (I'm not 100% sure, the manpage seems to suggest that -F can take a file source, but it might just be referring to how to upload an entire file?)