A Better Way to Manage the Rails Secret Token

Re:A Better Way to Manage the Rails Secret Token by duaneb on Monday May 20, 2013 @02:36AM (#5736239)

How is the environment any less secure than memory? If someone can read or mutate your environment, you should assume your app is already compromised and OS-level permissions aren't going to do anything.

[ Parent | on HN ]

Re:A Better Way to Manage the Rails Secret Token by ctz on Monday May 20, 2013 @06:32AM (#5736855)

Certain weird-shit UNIX operating systems do not provide privacy for a process's environment. (eg. another user on the same box can see them with 'ps e'). More relevantly, POSIX does not require it. The same is not true of process memory.

[ Parent | on HN ]

Re:A Better Way to Manage the Rails Secret Token by justincormack on Monday May 20, 2013 @04:36AM (#5736585)

Most people probably set the environment for all processes not just on a need to know basis perhaps.

[ Parent | on HN ]