4 ms·
Glad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you sho
by jsjohnst 11y ago
Glad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you shouldn't do this in your apps, but one super obvious one is there's way to many frameworks that expose environment variables in their debug output if not properly configured. Think you'll never misconfigure a server? Guess again, pretty much every major site (Google, FB, Twitter, Yahoo, EBay, Microsoft, etc) have all done it at some point.
- tokenizerrr 11y agoPlease review HN's guidelines on civility.
- shutupbitch 11y agoNothing uncivil about his/her response, you just need thicker skin.
- tokenizerrr 11y agoI'm glad you made a new account named 'shutupbitch' just to tell me this. Thank you for your contribution.
- dang 11y agoPlease don't feed trolls.
- jsjohnst 11y agoFair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.
- tokenizerrr 11y agoAlright, well, I've never seen an application/framework spit out environment variables when it was misconfigured. But then again, I barely work with web-related stuff so maybe I just don't use the kind of software that does this. Could you provide some examples?
- damon_c 11y agoMany web frameworks do this when in "debug" mode.
- dang 11y agoYour comment sounded more colloquial than uncivil to me, but thanks for responding so respectfully.
- otterley 11y agoThe "dump environment" problem is an issue for novice developers, but mature shops should have security-conscious frameworks for secrets handling that do things like clear the variable from the environment at initialization time. What are your other 11 objections?