News for hackers. Stuff that matters.
Re:How to handle secrets on the command line by imiric on Sunday June 13, 2021 @06:18AM (#27491339)
Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/

Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is probably required. I've been using Linux for a long time and hadn't heard about `keyctl`, thanks for mentioning it. A more flexible solution might be https://github.com/mozilla/sops

Re:How to handle secrets on the command line by JimDabell on Sunday June 13, 2021 @11:17AM (#27493312)
In a maximised browser window on a 13" screen it floats above and covers up the first few characters of each line of body copy, and it’s sticky, so it moves with me as I scroll. If I have to interact with it to read the article, it’s not unobtrusive.
Re:How to handle secrets on the command line by faeyanpiraat on Sunday June 13, 2021 @06:43AM (#27491466)
It makes me feel weird that I have the option to “fill a form to not sell my personal data” though.
Re:How to handle secrets on the command line by taberiand on Sunday June 13, 2021 @06:13PM (#27497036)
It almost feels like satire.
Re:How to handle secrets on the command line by tiziano88 on Sunday June 13, 2021 @10:39AM (#27493008)
> opt-out by default

That's the definition of opt-in

Re:How to handle secrets on the command line by mkl on Sunday June 13, 2021 @09:16AM (#27492318)
That's not what I experienced. Is it just way worse for different locations (NZ here)? It's not opt-out by default; I had to turn off advertising and analytics cookies manually. The cookie consent pop-up takes up a third of a big mobile screen. As well as "Continue to site", it has buttons for "Policies", "Preferences", "Do not sell my personal information", and "Powered by CLM".

Cookie pop-ups need to die. Non-essential cookies aren't to "improve your experience", they're usually for invasive tracking, and if a site only uses strictly necessary cookies, even the GDPR doesn't require explicit consent.

Re:How to handle secrets on the command line by imiric on Sunday June 13, 2021 @10:56AM (#27493159)
That's strange. Maybe it defaults to opt-out only in the EU?

While it's not entirely unobtrusive, especially on mobile, it's far better than similar forms on most other sites that usually take up the bottom half of the screen, or block the content entirely behind a modal dialog.

> As well as "Continue to site", it has buttons for "Policies", ...

Those others aren't buttons, but links, and small ones. The most prominent element is the single button that dismisses the dialog and is actually safe to click. If you've seen most other consent forms, rejecting cookies (if possible at all) is usually done via a small link next to a prominent "Accept all" button and other such dark patterns.

So this is a great UX improvement, though I agree with you that all these forms are obnoxious and we should get rid of them. Unfortunately it's the best we currently have to mitigate this abuse legally (at least in the EU).

Also, I'd be fine with some non-essential cookies for e.g. analytics, as long as this is not shared with 3rd parties, so no Google Analytics and such, but few sites implement it that way.

Though TBH all this feels like privacy theater. There are more sophisticated ways than cookies for tracking users that aren't being discussed nearly as much, yet are probably already widely used.

Re:How to handle secrets on the command line by mkl on Sunday June 13, 2021 @05:12PM (#27496545)
> If you've seen most other consent forms, rejecting cookies (if possible at all) is usually done via a small link next to a prominent "Accept all" button and other such dark patterns.

That's exactly how this one works for me. The prominent "Continue to site" is "Accept all" in disguise, and to opt out you need to click on the little "Preferences" button/link. It's the same dark pattern as usual, not a UX improvement.

Re:How to handle secrets on the command line by croes on Sunday June 13, 2021 @12:27PM (#27493902)
Cookie banners and pop-ups only exist to make the GDPR look bad.
Re:How to handle secrets on the command line by mhitza on Monday June 14, 2021 @09:52AM (#27502528)
Cookie popups where a EU requirement before GDPR.

They just started showing up more often after, because at this point they also had to notify you/have you opt in into sharing your data.

Re:How to handle secrets on the command line by calvinmorrison on Sunday June 13, 2021 @11:10AM (#27493262)
> idontcareaboutcookies
Re:How to handle secrets on the command line by croes on Sunday June 13, 2021 @12:25PM (#27493887)
You mean, takemydata
Re:How to handle secrets on the command line by kamil3141 on Sunday June 13, 2021 @10:14AM (#27492779)
It’s not unobtrusive on mobile :(
Re:How to handle secrets on the command line by kenty on Sunday June 13, 2021 @06:50AM (#27491505)
About the cookie: just install the extensions `CookieAutoDelete` and `I don't care about cookies`. No more cookie warnings, no more privacy problems. About the article: TL;DR: use a secrets file.
Re:How to handle secrets on the command line by klntsky on Sunday June 13, 2021 @07:04AM (#27491555)
How is that different/better than uBlock with annoyances filters turned on?
Re:How to handle secrets on the command line by joosters on Sunday June 13, 2021 @08:13AM (#27491884)
Auto-deleting cookies means that you don’t need a filter list to block bad sites, every site will be wiped. There’s no chance that a missed site will sneak through.

The downside is that you will need to whitelist every site that you want to remember your login/settings for when revisiting them.

Re:How to handle secrets on the command line by imiric on Sunday June 13, 2021 @08:54AM (#27492171)
You can achieve that by just using incognito mode. Though the extension would surely be more flexible.

Still, I haven't used a browser extension in years, partly because of extensions like this that require access to all browsing data, even if they're open source like in this case (though the author of "I don't care about cookies" has a strange concept of distribution[1]). The inconvenience of wiping cookies and clicking through cookie consent forms is much more tolerable than allowing random extensions access to all my browsing data.

[1]: https://teddit.net/r/privacy/comments/bru6wd/p/eohtox3/

Re:How to handle secrets on the command line by contravariant on Sunday June 13, 2021 @10:41AM (#27493027)
Well uBlock can't block all cookie warnings, some of them are more than just cosmetic. And uBlock doesn't remove the cookies if any get through.
Re:How to handle secrets on the command line by atkailash on Sunday June 13, 2021 @03:33PM (#27495547)
I use sops for my dot files. There’s some oddities if you want to commit only an encrypted one to git and use a sops.yaml but not a big deal. Hadn’t thought of using it for local only use in this sort of thing, but is a good idea