sysctl -q proc.cmdline=0400
Which OS? Does not work on Linux.
There's new hidepid mount option on Linux though.
How to handle secrets on the command line
71–77 of 77 posts
Re: How to handle secrets on the command line
#72tl;dr - If worried about leaking the path to a secret file, use Sorry for the top level comment, but I am surprised this hasn't been shared by someone else already. Process substitution(1) (e.g. From RTFA, the author is using "$( For example... lets say for an arbitrary example, I didn't want folks knowing from the process table that I was getting the file details of /etc/passwd ### LEAKY ~ % wc /etc/passwd 110 297 6…
How is the first case ("Don't do :") in base64 example different from the second one? It seems to me to be exactly same thing. In both cases base64 reads from stdin and echo builtin is used. What am I missing?
Re: How to handle secrets on the command line
#73I defer to using AWS SSM to retrieve secrets https://github.com/kaihendry/dotfiles/blob/master/bin/ssm
But yeah, reading secrets of env or ps or the clipboard is a real issue, so I focus on making sure that doesn't leak.
I've made terrible mistakes leading /proc accidentally in my Web app https://github.com/securego/gosec/issues/569
Re: How to handle secrets on the command line
#74Earlier quoted context omitted.
That's not what I experienced. Is it just way worse for different locations (NZ here)? It's not opt-out by default; I had to turn off advertising and analytics cookies manually. The cookie consent pop-up takes up a third of a big mobile screen. As well as "Continue to site", it has buttons for "Policies", "Preferences", "Do not sell my personal information", and "Powered by CLM". Cookie pop-ups need to die. Non-essen…
Cookie banners and pop-ups only exist to make the GDPR look bad.
Cookie popups where a EU requirement before GDPR.
They just started showing up more often after, because at this point they also had to notify you/have you opt in into sharing your data.
Re: How to handle secrets on the command line
#75You have envchain to store secrets as ENV variables in your keyring and execute commands: https://github.com/sorah/envchain Not really something you would use for production web apps, I think envconsul covers that usecase: https://github.com/hashicorp/envconsul
ENV vars are global variables; they will be visible to all the child processes as well unless care is taken. Is that really worth it?
If your app needs a secret, and it forks, I would assume the child processes also need that secret.
Re: How to handle secrets on the command line
#76tl;dr - If worried about leaking the path to a secret file, use Sorry for the top level comment, but I am surprised this hasn't been shared by someone else already. Process substitution(1) (e.g. From RTFA, the author is using "$( For example... lets say for an arbitrary example, I didn't want folks knowing from the process table that I was getting the file details of /etc/passwd ### LEAKY ~ % wc /etc/passwd 110 297 6…
How is the first case ("Don't do :") in base64 example different from the second one? It seems to me to be exactly same thing. In both cases base64 reads from stdin and echo builtin is used. What am I missing?
In the second case it isn’t actually reading from standard in, but from an process listing opaque ephemeral file.
Re: How to handle secrets on the command line
#77Earlier quoted context omitted.
Sounds similar to Powershell's SecureString, if you want to compare vs a non-"toy" equivalent.
In isolation, yes, but my version is a subclass of string, which adds another layer of functionality on top of the base feature set.
I don’t really see the value in considering it a subclass of a string. Without decryption, the only meaningful “string-like” operations on it are equality (well, even that’s assuming that like strings share encrypted values, or equality is stored in a separate property). Why even make it a subclass of string in the first place?