I prefer to pass secrets between programs through standard input

Re:I prefer to pass secrets between programs through standar... by stale-labs on Wednesday February 04, 2026 @09:06AM (#46885947)

The main practical win is that cmd args show up in `ps aux` for anyone on the system to see, whereas stdin keeps it off that list.

re: the /proc concerns - true, but if someones got same-user access to read your /proc/pid/fd, they can probably ptrace you or read process memory anyway. stdin is more about basic hygiene than stopping sophisticated attackers.

tbh for anything actually sensitive I've been leaning toward tmpfs files with strict perms, or using something like vault/age. stdin is a nice middle ground tho for quick scripts.

[ Parent | on HN ]

Re:I prefer to pass secrets between programs through standar... by reliefcrew on Wednesday February 04, 2026 @10:08AM (#46886738)

> The main practical win is that cmd args show up in `ps aux` for anyone on the system to see, whereas stdin keeps it off that list.

For those interested, re-mounting /proc with hidepid can prevent this:

    `mount -o remount,rw,hidepid=2 /proc`

[ Parent | on HN ]