[{"data":1,"prerenderedAt":182},["ShallowReactive",2],{"project-22640370":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":40,"post_text":42,"what":43,"said":63,"maker_in_thread":112,"shape":117,"grid":121,"attempts":140,"same_week":145,"maker_shows":41,"maker_hidden":175,"reader_version":176,"card":177},"22640370","S-Cache","Secure storage for cryptographic secrets, modeled after sudo","title","Show HN: S-Cache – Secure storage for cryptographic secrets, modeled after sudo","https:\u002F\u002Fgithub.com\u002Frongarret\u002Fscache","github.com","lisper",1584730122,2020,51,8,1058,3028,35,"notable","security_privacy","secret storage","cli",[21,24,25,26,27],"setuid","cryptographic secrets","sudo","key management","curious",-0.25,{"positive":31,"neutral":32,"mixed":31,"critical":33},0,4,2,6,{"execution":36,"idea":38,"design":39},{"positive":31,"critical":37},1,{"positive":31,"critical":31},{"positive":31,"critical":37},[37,31,41,37,41,41,31,41],3,null,{"problem":44,"audience":42,"pricing":42,"motivation":42,"time_to_build":42,"stack":52,"openness":61,"stage":62,"team_size":62},{"value":45,"source":46,"evidence":47},"Lets processes access cryptographic secrets without managing them directly","commenter",[48],{"id":49,"by":50,"text":51},"22643891","blendergeek","I'm a little confused here. The author compares S-Cache to 'sudo'. 'sudo' is a command that lets an unprivileged user run a privileged command. S-Cache lets a process access a…",[53],{"value":54,"source":55,"evidence":56},"C","inferred",[57],{"id":58,"by":59,"text":60},"22644504","mgerdts","The mention of setuid thing for storing personal secrets seemed a little odd, so I looked at the code. It seems the only thing that has been updated recently is the README and…","open_source","unknown",{"praise":64,"objections":65,"requests":77,"questions":86,"alternatives":92},[],[66,70],{"value":67,"source":46,"evidence":68},"Setuid C code has security flaws: HOME env trust, stat\u002Ffopen symlink risk, unsanitized popen",[69],{"id":58,"by":59,"text":60},{"value":71,"source":46,"evidence":72},"Shadow file comparison is questionable since shadow stores hashes, not raw secrets",[73],{"id":74,"by":75,"text":76},"22643388","mothershipper","Not sure how I feel about the comparison to the shadow passwords file -- the shadow file doesn't contain the raw password, but a hashed version. If someone steals the shadow…",[78],{"value":79,"source":46,"evidence":80},"Use secure C practices and sanitize environment before subprocesses",[81,82],{"id":58,"by":59,"text":60},{"id":83,"by":84,"text":85},"22645112","catlifeonmars","It’s been a few years since I’ve used GCC, but I believe you’ll want to compile with security flags (e.g. -fPIE -fstack-protector and friends)",[87],{"value":88,"source":46,"evidence":89},"Why compare to the shadow passwords file",[90,91],{"id":74,"by":75,"text":76},{"id":49,"by":50,"text":51},[93,100,104,108],{"value":94,"source":46,"evidence":95},"GNOME Keyring",[96],{"id":97,"by":98,"text":99},"22644088","loeg","As you might imagine, there is some prior art in this space. In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory…",{"value":101,"source":46,"evidence":102},"Linux keyctl",[103],{"id":97,"by":98,"text":99},{"value":105,"source":46,"evidence":106},"macOS Keychain",[107],{"id":97,"by":98,"text":99},{"value":109,"source":46,"evidence":110},"Windows CryptProtectData",[111],{"id":97,"by":98,"text":99},{"comments":37,"answered":31,"key":113},[114],{"id":115,"text":116},"22644651","Thanks for the tips. I'll fix those issues.",{"commenters":118,"max_depth":32,"maker_replies":37,"first_comment_mins":119,"lifespan_hours":120},7,383,18,[122,124,126,128,130,131,135,138],[58,31,37,123,59,31],"project\u002Fcritical\u002Fexecution",[115,31,31,125,11,37],"maker\u002Fpositive\u002Fexecution",[97,37,41,127,98,31],"project\u002Fneutral\u002Fidea",[74,33,37,129,75,31],"project\u002Fcritical\u002Fdesign",[49,33,41,127,50,31],[132,33,41,133,134,31],"22643936","project\u002Fneutral\u002Fdesign","antoncohen",[136,33,31,137,50,31],"22646278","commenter\u002Fneutral\u002Fnone",[83,41,41,139,84,31],"project\u002Fneutral\u002Fexecution",[141,144],{"id":142,"t":143,"points":118,"comments":31},"10444743",1445718587,{"id":4,"t":12,"points":14,"comments":15},[146,151,156,161,166,171],{"id":147,"name":148,"points":149,"category":150},"22687086","bingetogether.com",515,"consumer_social",{"id":152,"name":153,"points":154,"category":155},"22685011","Skynet Simulator",500,"games",{"id":157,"name":158,"points":159,"category":160},"22681270","MVP.css",471,"dev_tools",{"id":162,"name":163,"points":164,"category":165},"22676040","Screen",406,"productivity",{"id":167,"name":168,"points":169,"category":170},"22650725","findcovidtesting.com",305,"infrastructure",{"id":172,"name":173,"points":174,"category":160},"22659216","Zoom Redirector",279,false,"v2",{"id":178,"name":5,"line":6,"ai":175,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":179,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":180,"url":9,"mix":181,"praise":-1,"objection":67,"sub":21},22640370,[21,24,25,26,27],"10313303",[31,32,31,33],1794036587761]