6 ms·
I agree that ENV variables are useful for general configuration, that's exactly what they were invented for... ENV variables are not restricted by user though,
by mreinsch 12y ago
I agree that ENV variables are useful for general configuration, that's exactly what they were invented for...
ENV variables are not restricted by user though, your process can spawn another process under a different user and give it the same environment. It's the nature of the environment that it is usually inherited from the parent which causes the issues when we're talking about secrets.
- geocar 12y agoDelete sensitive environment variables after you read them, or don't run programs you don't trust with an unsanitary environment/argument list (e.g. execve not system)
- mreinsch 12y agoThanks for that idea of deleting sensitive environment variables. I like that for hosters such as heroku which use ENV variables for config (including secrets) by default.