Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Twelve-Factor App (2025)

12factor.net

Post reply on HN
Print view View original

111–120 of 184 posts

Re: The Twelve-Factor App (2025)

#111

Post by e12e »

nightbrawler wrote: post #95
tptacek wrote: post #67

Earlier quoted context omitted.

It's pretty normal to keep secrets in a dedicated secret store, and then have the service launcher inject them from the secret store into the environment.

normal indeed but not what i'd consider a best practice anymore. we've moved away from any secrets in the env after the typical secrets leak when secrets popped up in some debug logging that hit datadog. we now have a secret cache layer api and the app loads secrets securely at time of use from that api. there's also no secret-0 problem because we use IAM auth when calling the cache. edit: for those wondering, api re…

Just to clarify - for every seperate read, update or write to your database - you setup and teardown a new connection?

Re: The Twelve-Factor App (2025)

#112

Post by duderific »

anon7000 wrote: post #98
jt2190 wrote: post #28

Earlier quoted context omitted.

The unwritten assumption in 12 Factor is: the environment is secure . For example, a production system should always have a secure means of setting environment variables. Said another way: If a random dev can change an environment variable in production either directly by logging in or indirectly by pushing code then there is something very very wrong. If the dev is pushing code to production they should not simultan…

> Changing application behavior Configuration changes also change application behavior, otherwise is it really “config”?

I guess it depends on your definition of "behavior?" For example if the config is the endpoint address of an external resource, it's not really changing the application behavior per se.

Re: The Twelve-Factor App (2025)

#113

Post by loeg »

modeless wrote: post #85
xander_north wrote: post #24

Earlier quoted context omitted.

Okay so this may sound odd but this is literally my whole life right now... Can you explain why do you feel MFA is painful/unsustainable? How would you fix it?

Personally I hate when I use a passkey but then still get hit with an SMS second factor step. A passkey should be enough, unless I'm changing my recovery email or withdrawing a million dollars or something. Also there's still a lot of really bad UX around passkeys, both by browser/OS vendors and by individual apps, and unimplemented features like sharing. Passkeys are the right thing but they need more work.

I totally believe that someone has gotten it this wrong, but personally I've never seen an SMS 2FA on a Passkey authentication. My most common Passkey complaint is that a service doesn't support them yet.

Re: The Twelve-Factor App (2025)

#114

Post by duderific »

commandlinefan wrote: post #12
_superposition_ wrote: post #8

I can't believe how old this is and I feel like most devs still haven't internalized this which is a shame.

Is it devs that haven't internalized this? Or management? Because I'd love to do this, but I always report to people who demand that everything be done in "a few days".

Unfortunately if you don't start out building the application from these principles, the tech debt piles up, and then it's hard to recover.

Re: The Twelve-Factor App (2025)

#115

Post by duderific »

lxe wrote: post #87

I know that all of this is super relevant, but it's extremely aspirational, and I can pick apart pretty much every one of these factors on how it doesn't fully hold up when it comes to the reality of production applications.

Principles are by definition aspirational. The idea, I'd say, is to always have them in mind and get as close to them as possible.

Re: The Twelve-Factor App (2025)

#116

Post by _def »

sandeepkd wrote: post #31

Its interesting how this felt so natural and right way to do software. I remember people referencing it as the north star. And then gradually people came close to it but moved past it. Personally I feel that these concepts require to have generalist mindset aka application architect. What we have as of today are lot of product engineers within teams, product managers and management. The product engineers do not alway…

I don't know. I've seen lots of "architects" conceptualizing just overly complex structures.

Re: The Twelve-Factor App (2025)

#120

Post by nebezb »

dewey wrote: post #46
nebezb wrote: post #40

Earlier quoted context omitted.

Confidently wrong. Did you read the source I linked? > The twelve-factor app stores config in environment variables

The vault of the cloud provider would just inject the value of the environment variable securely so it doesn't have to be stored on-disk. What the parent poster wrote isn't wrong.

The parent poster is wrongly quoting me to say the original post doesn't mean “env var”. Yes, it does mean env var.
Post reply on HN