Re: [dev] [ii] exposed password on process monitoring

From: Ivan Kanakarakis <ivan.kanak_AT_gmail.com>
Date: Fri, 20 Apr 2012 04:01:54 +0300

On 20 April 2012 03:37, Nico Golde <nico_AT_ngolde.de> wrote:

> Hi,
> * Ivan Kanakarakis <ivan.kanak_AT_gmail.com> [2012-04-20 01:54]:
> > On 20 April 2012 02:24, Connor Lane Smith <cls_AT_lubutu.com> wrote:
> > > On 19 April 2012 23:51, Connor Lane Smith <cls_AT_lubutu.com> wrote:
> [...]
> > however if one wants to connect to more than one server
> > and has a different password for that other server then
> > the env var doesn't help, scriptwise talking.
> >
> > ofcourse one can reset the var and invoke the new ii isntance,
> > but if you're doing that in a script and you don't want to be
> > including the passwd within the script then this cant work.
>
> Why not, the script could read it from a file not? Even though I don't see
> the
> difference. Whoever can read that script likely can also read the file.
>
>

I was also thinking one could share the
script ie in a public repo somewhere
for example, I use this
https://github.com/c00kiemon5ter/iii/blob/master/connect
and using the getenv patch I can just
  $ II_KEY=".." connect
my password is not there and people can reuse the script



> > well, what I have in mind with that ^ is something like:
> > $ IRCPASS="fooo" connect.sh
> > and connect.sh fires up two ii instances to connect to
> > two different server which need a different password.
> >
> > I think a nice thing to do that would also resolve the
> > naming choice would be to have -k or some other argument
> > mean that ii should read the -k flag as an env var. so
> > $ ii -k IRCPASS
> > would getenv("IRCPASS"), and
> > $ ii -k OFTCPASS
> > would getenv("OFTCPASS")
> > etc
>
> I agree this is actually also a very nice solution! I will think about
> that a
> little before I commit.
>
>

that's great,
having that I can just replace ii invokation on the above script
with: ii -k $server .. ..
and invoke the whole script like
  $ irc.freenode.net="foopass" irc.oftc.net="barpass" connect
the extra space ignores the entry to the history
and each server automatically gets his password
(although in this example the env vars are too big :P).
so I can still share the script and not save the passwords
in anywhere (but the terminal's scroll buffer)

thanks



> Cheers
> Nico
>



-- 
*Ivan c00kiemon5ter V Kanakarakis*  >:3
Received on Fri Apr 20 2012 - 03:01:54 CEST

This archive was generated by hypermail 2.3.0 : Fri Apr 20 2012 - 03:12:04 CEST