Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Dotenv, if it is a Unix utility

github.com

Post reply on HN
Print view View original

21–30 of 108 posts

Re: Show HN: Dotenv, if it is a Unix utility

#21

Post by 3836293648 »

TheRoque wrote: post #12
kelnos wrote: post #7

Earlier quoted context omitted.

I've used direnv, but I think a nice property of OP's dotenv is that it's explicit: if I want to pass env vars, I run my program under it. If I don't, then I don't. There's no "hidden behavior" for me to forget about and then get surprised by.

As far as I'm aware of, Direnv's behavior is not hidden at all. Whenever you cd into the directory, you get a message listing all the new en var activated. And when you change the .envrc, you get another message saying that direnv has been deactivated. I never had happen to me "oh shoot !! I forgot this env var was activated because I'm in this dir".

Oh yeah, that's the default. Everyone I know im ediately disabled that and I even forgot about it till now

Re: Show HN: Dotenv, if it is a Unix utility

#23

Post by gyf304 »

spullara wrote: post #17
VWWHFSfQ wrote: post #16

Earlier quoted context omitted.

what are the suggestions

GPT-4: The code provided has a few potential issues, including security vulnerabilities: Buffer Overflow and Memory Allocation Errors: The malloc function in read_file does not check if the memory allocation fails (it checks if buffer is NULL instead of buffer). This can lead to a null pointer dereference if malloc fails and returns NULL. There's a possibility of buffer overflow or improper handling if the file size…

* Memory allocation NULL check: this is a bona-fide bug introduced by my refactoring

* MAX_FILE_SIZE: I don't think this is true.

* skip_until_charset, skip_charset bound check bug: I don't think this is true

* Uninitialized value_end: I don't think this is true - and if true should be caught by -Wall -Werror flags.

* argc * Error Handling: Currently all parsing errors should cause the program to exit, which I think is the desired behavior.

* Unsanitized input for .env: Intended behavior.

* Unsanitized input for execvp: Intended behavior.

Re: Show HN: Dotenv, if it is a Unix utility

#25

Post by spullara »

brenns10 wrote: post #20
spullara wrote: post #17

Earlier quoted context omitted.

GPT-4: The code provided has a few potential issues, including security vulnerabilities: Buffer Overflow and Memory Allocation Errors: The malloc function in read_file does not check if the memory allocation fails (it checks if buffer is NULL instead of buffer). This can lead to a null pointer dereference if malloc fails and returns NULL. There's a possibility of buffer overflow or improper handling if the file size…

I think if you're not willing to manually verify the output of these generative machine learned algorithms, then you probably shouldn't present them to somebody as if you've done them the service of a free code review.

I suggested he look at it since he is the expert on his code lol.

Re: Show HN: Dotenv, if it is a Unix utility

#26

Post by gertop »

brenns10 wrote: post #20
spullara wrote: post #17

Earlier quoted context omitted.

GPT-4: The code provided has a few potential issues, including security vulnerabilities: Buffer Overflow and Memory Allocation Errors: The malloc function in read_file does not check if the memory allocation fails (it checks if buffer is NULL instead of buffer). This can lead to a null pointer dereference if malloc fails and returns NULL. There's a possibility of buffer overflow or improper handling if the file size…

I think if you're not willing to manually verify the output of these generative machine learned algorithms, then you probably shouldn't present them to somebody as if you've done them the service of a free code review.

I don't understand people who chime in just to regurgitate GPT slop that they haven't verified (and sometimes not even read!)

I don't it hard to believe that they truly believe they're doing us a favor. Surely they're doing it just to feel smart or included?

Re: Show HN: Dotenv, if it is a Unix utility

#27

Post by fyrn_ »

kzrdude wrote: post #22

This idea seems to be cloned everywhere now, so something is causing the popularity

Kubernetes / containderd / docker apps are much more convenient to configure through ENV vars, as they easily pass through the sandbox layer (whatever that may be) files are not so easy to make work. Because that's how prod works devs want to be able to recreate prod to run locally, hence the cambrian explosion of tools like this.

Re: Show HN: Dotenv, if it is a Unix utility

#28

Post by emmanueloga_ »

mongol wrote: post #6

Would not sh -c '. .env; echo $MY_VAR' do the same thing? (I am not in front of a shell at the moment.)

There are like a couple dozen different ways to do this...

I have this on my .bashrc:

    alias loadenv='export $(xargs
source: [1]

--

1: https://stackoverflow.com/a/60406814/855105

Re: Show HN: Dotenv, if it is a Unix utility

#30

Post by geysersam »

emmanueloga_ wrote: post #28
mongol wrote: post #6

Would not sh -c '. .env; echo $MY_VAR' do the same thing? (I am not in front of a shell at the moment.)

There are like a couple dozen different ways to do this... I have this on my .bashrc: alias loadenv='export $(xargs source: [1] -- 1: https://stackoverflow.com/a/60406814/855105

Very nice! Thanks for the suggestion. Seems more Unix-esque. Are there any important drawbacks of this version compared to the dedicated tool? (dotenv or dotenvx)
Post reply on HN