News for hackers. Stuff that matters.

A comment on Railway Security Disclosure. Parent comment

Re:Railway Security Disclosure by skinfaxi on Wednesday October 21, 2026 @07:50PM (#50189220)
> Use environment variables to point to where secrets are located, not to store their values.

Now your apps need to be able to read the secret that is pointed to, as opposed to the task runner populating the secret and the app would not know about the details.Not to mention the changes it entails to development.

[ Parent | on HN ]
Re:Railway Security Disclosure by esseph on Wednesday October 21, 2026 @11:31PM (#50190869)
> Not to mention the changes it entails to development.

Oh no, guess they'll have to hire developers that can adapt!

[ Parent | on HN ]
Re:Railway Security Disclosure by skinfaxi on Thursday October 22, 2026 @09:42AM (#50195212)
I'm not sure the point of your comment.
[ Parent | on HN ]
Re:Railway Security Disclosure by esseph on Thursday October 22, 2026 @12:48PM (#50197897)
Developers often do things out of convenience, not thinking about repeatability, deployment reliability, security, or thinking about other people having to manage and patch systems for 30y after their gone.

Docker in 2026 is a perfect example of this (long lasting habits due to familiarity, not best practice).

In addition to the developers not interested in using AI to augment their skills and code.

[ Parent | on HN ]