alt Hacker NewsUnfortunately, with secrets in the OS env, you‘re one `printenv` or improperly written third party dependency that leaks env vars away from a security incident.
The env and more importantly what populates it should be secure, but security works best in layers. Sanitizing the env after loading it is a nicer middleground, k8s-style secrets materialized to files work best and are conceptually close enough to the OS env.
Replies
tbf thats what a good logging lib is for, and if printenv can be run within the machine, then it's already too late
systemd-creds too, for anyone who has not found it yet like I was a week ago.
> you‘re one `printenv` or improperly written third party dependency that leaks env vars away from a security incident.
Game over already if anyone can run commands or arbitrary code. Not using the environment won't help you.
It's not my intuition that materializing secrets to files is a better way to protect them than just injecting them into the environment, where they don't persist.