Live data from Hacker News

The Twelve-Factor App (2025)

12factor.net

181–184 of 184 posts

Re: The Twelve-Factor App (2025)

#181
post #16

Still incredibly relevant. Even if you don’t apply it, there is so much to learn by reading this in 15 minutes. The only grievance I have with this is Chapter 3: Config [1] “Store config in the environment”, “Credentials to external services such as Amazon S3 or Twitter” Besides being bad advice, this had the second-order effect of leading devs to believe they could put all their local env secrets in ~/.bashrc files.…

Even putting secrets aside, the environment is a crappy place for config data. It's got a maximum size cap, is trivially introspectable by via any process that can read `/proc`, and sucks at representing hierarchical or structured data beyond k=v. The proliferation of tools that come up with all sorts of contortions to encode e.g. JSON-ish structures into the environment is evidence that this ain't a great way to go.…

> It's got a maximum size cap,

It's ok, it's a kv store.

> is trivially introspectable by via any process that can read `/proc`,

It's ok, containerized apps are expected to run in isolated environments where you are the only one with access to this info.

> and sucks at representing hierarchical or structured data beyond k=v.

It's ok, it's a KV store.

If it isn't, you are doing something terribly wrong.

Virtually all config systems developed in the past decade follow this pattern, where multiple config providers are applied hierarchically and env vars are the last chain in the chain of responsibility that overrides all other providers. It works well.

Re: The Twelve-Factor App (2025)

#183

I can't believe how old this is and I feel like most devs still haven't internalized this which is a shame.

Pass the word! I hired about 50 software interns and junior in the past 5 years. None had ever heard of it before I told them.

I do. May as well be gospel. It's up there.

Re: The Twelve-Factor App (2025)

#184

Earlier quoted context omitted.

No I’ve never seen software that broke because someone added a config key.

Are you talking about altering environment variables in a system, or altering software to read different environment variables? I read jt2190 as talking about the former.

I don’t use env variables for this and many other reasons. They seem like a spectacularly bad idea for config, as the op noted.

I’m talking about altering a config which you control - adding to a config is pretty risk free if it is your program, altering a config of course is not.

Post reply on HN