[{"data":1,"prerenderedAt":833},["ShallowReactive",2],{"project-40789353":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":47,"post_text":49,"what":50,"said":83,"maker_in_thread":214,"shape":216,"grid":221,"attempts":795,"same_week":796,"maker_shows":18,"maker_hidden":826,"reader_version":827,"card":828},"40789353","From dotenv to dotenvx","better config management","title","Show HN: From dotenv to dotenvx – better config management","https:\u002F\u002Fdotenvx.com\u002Fblog\u002F2024\u002F06\u002F24\u002Fdotenvx-next-generation-config-management.html","dotenvx.com","scottmotte",1719326968,2024,354,206,146,3515,5,"legend","dev_tools","environment configuration","cli",[24,25,26,27],"dotenv","env files","encrypted secrets","config management","mixed",-0.43,{"positive":31,"neutral":32,"mixed":33,"critical":34},7,41,3,50,101,{"privacy":37,"docs":39,"idea":42,"design":44,"execution":45},{"positive":33,"critical":38},22,{"positive":40,"critical":41},0,2,{"positive":33,"critical":43},13,{"positive":40,"critical":33},{"positive":40,"critical":46},4,[33,40,48,41,40,48,33,33,41,40,48,48,48,33,40,41,33,33,48,48,48,33,48,48,48,48,48,41,48,33,41,48,46,41,33,48,33,41,48,41],1,null,{"problem":51,"audience":49,"pricing":49,"motivation":49,"time_to_build":49,"stack":67,"openness":80,"stage":81,"team_size":82},{"value":52,"source":53,"evidence":54},"Storing and sharing .env secrets safely in version control","inferred",[55,59,63],{"id":56,"by":57,"text":58},"40790251","mplanchard","Seems pretty similar to sops[0], but without the encrypted-by-default feature that makes sops feel significantly safer for secret management. Sops also integrates easily with AWS…",{"id":60,"by":61,"text":62},"40790104","brigadier132","Encrypting secrets and committing them seems very convenient but I'm paranoid about these sorts of things. Can anyone tell me why this would be a bad idea? One reason I can think…",{"id":64,"by":65,"text":66},"40793703","daralthus","GOAL: To be able to commit all your envs to git. This is the only goal and this tool archives it. In the simplest way. While keeping you as secure as you were before, manually…",[68],{"value":69,"source":70,"evidence":71},"JavaScript","commenter",[72,76],{"id":73,"by":74,"text":75},"40823273","PaulHoule","My beef with it is that it's written in Javascript whereas what it does is so simple that they should just code it up in Rust or Go and be done with it, particularly when it…",{"id":77,"by":78,"text":79},"40794420","rednafi","Written in JS; I think I’ll pass.","open_source","launched","unknown",{"praise":84,"objections":100,"requests":139,"questions":160,"alternatives":179},[85],{"value":86,"source":70,"evidence":87},"Encrypting env files so they can be committed is a sensible tradeoff",[88,92,96],{"id":89,"by":90,"text":91},"40790546","michaelmior","With leaking secrets being such a big concern, it seems wise to require that secrets be encrypted to use dotenvx. That is, it will only work with encrypted secrets. As others…",{"id":93,"by":94,"text":95},"40792864","nunez","dotenvx encryption goes a long way towards solving THE BIGGEST problem with dotenv; using multiple tools to ensure that secrets are protected. I wonder if dotenvx ensures that…",{"id":97,"by":98,"text":99},"40792386","the_duke","We implemented the exact same method for config encryption a year ago or so, using pub\u002Fprivate key auth and the same `encrypted:` prefixes for encrypted config values. This is a…",[101,112,124],{"value":102,"source":70,"evidence":103},"Committing encrypted secrets to git is a bad habit",[104,108],{"id":105,"by":106,"text":107},"40790173","golergka","I don't think encryption is a good idea, and the reason is forming bad habits. Now developers have a very strong and non-ambiguous habit: never put .env files in version control…",{"id":109,"by":110,"text":111},"40797472","sneak","This seems to encourage committing encrypted secrets, which is a bad idea. Configuration and code should be in separate repositories. Secrets should be protected elsewhere. The…",{"value":113,"source":70,"evidence":114},"Adds dependencies and is written in JavaScript",[115,119,120],{"id":116,"by":117,"text":118},"40791679","stiiv","dotenv has zero npm dependencies. dotenvx has 21, including a few I have never heard of. Is this really more secure?",{"id":73,"by":74,"text":75},{"id":121,"by":122,"text":123},"40794114","frithsun","Thanks, but I would rather go with the imperfect setup that I understand than an allegedly perfect setup with dozens of third party dependencies that I don't understand. Doubly…",{"value":125,"source":70,"evidence":126},"Environment variables and .env files are the wrong place for secrets",[127,131,135],{"id":128,"by":129,"text":130},"40792016","cimnine","I think it's good advice to not pass secrets through environment variables. Env vars leak a lot. Think php_info, Sentry, java vm dumps, etc. Also, env vars leak into…",{"id":132,"by":133,"text":134},"40789708","boxed","I don't get it. Dotenv is only good for local dev. Otherwise you should put your secrets in environment variables (the \"env\" in \".env\"). That people put .env files in prod is a…",{"id":136,"by":137,"text":138},"40789853","jitl","Secrets in env vars in production is not too secure either, ideally you’ll move to your app pulling secrets in-process from your infrastructure at boot-up or upon use. This also…",[140,146,153],{"value":141,"source":70,"evidence":142},"Option to choose .env file via environment variable",[143],{"id":144,"by":65,"text":145},"40789716","Would be nice to be able to configure which .env file to read as an environment variable. Why? Imagine a package.json with this line: `start: dotenvx run -f .env.local -f .env --…",{"value":147,"source":70,"evidence":148},"Support for secrets managers",[149],{"id":150,"by":151,"text":152},"40792626","difu_disciple","I always thought highly of the approach used by https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@strong-config\u002Fnode Does dotenvx support secrets managers?",{"value":154,"source":70,"evidence":155},"TypeScript types",[156],{"id":157,"by":158,"text":159},"40795208","Aeolun","It doesn’t have Typescript types!",[161,172],{"value":162,"source":70,"evidence":163},"How does it work with IDE run configurations and plain commands like ruby index.rb",[164,168],{"id":165,"by":166,"text":167},"40795280","kodeninja","How would this work with application-specific Intellij Run\u002FDebug configurations? Would this require switching to a \"Shell Script\" configuration, thereby losing debugging…",{"id":169,"by":170,"text":171},"40800037","Alifatisk","So with this, I have to prefix every executable with dotenvx in order to utilize the env variables? Can’t I somehow do this in the script itself so “ruby index.rb” is enough? I…",{"value":173,"source":70,"evidence":174},"Why make network requests and what is the hub",[175],{"id":176,"by":177,"text":178},"40799842","politelemon","I'm not comfortable that this tool is able to make HTTP requests, IMO it ought to be completely offline and not perform network operations. I did a search for requests and found…",[180,188,199,207],{"value":181,"source":70,"evidence":182},"sops",[183,184],{"id":56,"by":57,"text":58},{"id":185,"by":186,"text":187},"40792729","hooverd","Personally, I like sops for encrypting my secrets.",{"value":189,"source":70,"evidence":190},"Vault services",[191,195],{"id":192,"by":193,"text":194},"40790359","rrgok","Can a kind soul point me some documentation on how to put .env in a vault correctly? Possibly open-source solutions? If the vault is password protected, aren't you just adding…",{"id":196,"by":197,"text":198},"40790151","hermanradtke","I’ve been using dotenv-cli for a long time now. I appreciate the encryption, but I will keep loading secrets from a vault instead.",{"value":200,"source":70,"evidence":201},"dotenv-cli and foreman",[202,203],{"id":196,"by":197,"text":198},{"id":204,"by":205,"text":206},"40790068","VWWHFSfQ","I always used foreman [0] which I found to be superior to dotenv in every way. Even superior to this new dotenvx [0] https:\u002F\u002Fgithub.com\u002Fddollar\u002Fforeman",{"value":208,"source":70,"evidence":209},"phase.dev",[210],{"id":211,"by":212,"text":213},"40792112","nimishk","I don't think this is the best approach. I am building https:\u002F\u002Fphase.dev which lets you import secrets (.env), encrypt secrets (end-to-end encrypted with keys you control), sync…",{"comments":40,"answered":40,"key":215},[],{"commenters":217,"max_depth":218,"maker_replies":40,"first_comment_mins":219,"lifespan_hours":220},145,8,25,290,[222,224,228,231,233,236,239,242,245,247,251,253,257,260,262,265,267,270,272,275,278,280,283,286,288,290,292,294,296,299,302,305,308,311,314,316,319,323,327,330,333,336,339,342,346,349,351,354,357,360,363,365,368,370,373,375,376,379,382,384,385,389,393,396,400,403,405,408,409,412,414,417,420,422,425,428,431,433,438,440,444,446,450,453,456,459,461,464,467,469,473,476,478,480,483,486,489,491,493,495,497,501,503,506,508,511,514,516,520,524,527,530,534,537,541,544,546,549,552,554,557,560,562,565,568,572,575,577,580,583,586,589,591,594,597,599,602,604,606,608,611,613,616,618,620,624,626,629,633,635,639,642,646,648,650,654,657,659,663,666,671,673,677,682,685,687,689,691,696,698,700,701,703,707,711,715,718,721,723,725,727,730,732,735,738,741,744,747,749,752,754,756,758,760,763,765,768,771,773,775,777,779,783,786,788,792],[128,40,33,223,129,40],"project\u002Fneutral\u002Fprivacy",[225,40,40,226,227,40],"40794845","commenter\u002Fneutral\u002Fprivacy","skissane",[229,40,40,226,230,40],"40795927","itchyouch",[232,40,40,226,227,40],"40796020",[234,40,40,226,235,40],"40796057","qweqwe14",[237,40,40,226,238,40],"40796763","delusional",[240,40,40,226,241,40],"40798796","merb",[243,40,40,226,244,40],"40800017","macNchz",[246,40,40,226,235,40],"40800325",[248,40,40,249,250,40],"40800889","commenter\u002Fneutral\u002Fnone","jampekka",[252,40,40,249,235,40],"40800990",[254,40,48,255,256,40],"40796385","project\u002Fcritical\u002Fprivacy","andrewmcwatters",[258,40,48,255,259,40],"40797475","graemep",[261,40,40,226,227,40],"40797832",[263,40,48,255,264,40],"40797880","anentropic",[266,40,33,223,259,40],"40799645",[268,40,33,269,264,40],"40802619","project\u002Fneutral\u002Fdocs",[271,40,48,255,259,40],"40810642",[273,40,40,226,274,40],"40798534","csomar",[276,40,40,249,277,40],"40800666","justinclift",[279,40,40,226,256,40],"40796363",[281,40,40,226,282,40],"40796582","TristanBall",[284,40,40,249,285,40],"40797289","nprateem",[287,40,40,249,227,40],"40797419",[289,40,40,249,256,40],"40801955",[291,40,40,226,227,40],"40796748",[293,40,40,226,238,40],"40796857",[295,40,40,226,227,40],"40797471",[297,40,33,223,298,40],"40796860","bhawks",[300,40,48,255,301,40],"40796872","jillesvangurp",[303,40,40,249,304,40],"40797213","vitalysh",[306,40,40,249,307,40],"40797893","wegfawefgawefg",[309,40,40,249,310,40],"40798846","jen20",[312,40,40,249,313,40],"40800111","lucasyvas",[315,40,40,249,310,40],"40812699",[317,40,33,223,318,40],"40801340","darkwater",[320,48,33,321,322,40],"40792455","project\u002Fneutral\u002Fnone","neonate",[324,41,40,325,326,40],"40791606","other\u002Fneutral\u002Fnone","sandstrom",[328,41,40,325,329,40],"40791715","ralgozino",[331,41,40,325,332,40],"40795013","renewiltord",[334,41,40,325,335,40],"40798695","maleldil",[337,41,40,325,338,40],"40799504","mystickphoenix",[340,41,40,325,341,40],"40815054","horse666",[343,33,48,344,345,40],"40792422","project\u002Fcritical\u002Fdocs","treflop",[347,33,48,344,348,40],"40809436","pnt12",[89,46,18,350,90,40],"project\u002Fpositive\u002Fprivacy",[352,46,40,226,353,40],"40793877","akvadrako",[355,46,40,226,356,40],"40794214","projektfu",[358,46,40,226,359,40],"40796062","airtonix",[361,46,40,226,362,40],"40798755","progx",[364,46,40,226,90,40],"40799613",[366,46,33,321,367,40],"40794286","cced",[369,46,40,226,90,40],"40799598",[371,46,40,226,372,40],"40794766","bluelightning2k",[374,46,40,226,90,40],"40799584",[56,18,48,255,57,40],[377,18,48,255,378,40],"40792639","pmccarren",[380,18,40,325,381,40],"40792978","hadlock",[105,383,48,255,106,40],6,[60,31,48,255,61,40],[386,31,33,387,388,40],"40790200","project\u002Fmixed\u002Fidea","Atotalnoob",[390,31,40,391,392,40],"40791271","commenter\u002Fneutral\u002Fidea","prepend",[394,31,40,249,395,40],"40791554","nahtnam",[397,31,48,398,399,40],"40791563","project\u002Fcritical\u002Fidea","solatic",[401,31,40,249,402,40],"40795466","Grimburger",[404,31,40,249,399,40],"40807915",[406,31,40,325,407,40],"40798087","jrockway",[192,218,33,321,193,40],[410,218,40,325,411,40],"40790440","c0brac0bra",[413,218,40,325,193,40],"40790521",[415,218,40,325,416,40],"40790811","freeone3000",[418,218,40,249,419,40],"40791498","boarnoah",[421,218,40,249,416,40],"40792331",[423,218,40,325,424,40],"40790858","pluc",[426,218,40,325,427,40],"40793246","postalrat",[429,218,40,325,430,40],"40794173","hluska",[432,218,40,325,94,40],"40792961",[434,435,33,436,437,40],"40792215",9,"project\u002Fneutral\u002Fidea","hamasho",[439,435,48,398,94,40],"40792947",[441,442,33,436,443,40],"40795484",10,"clord",[445,442,40,249,298,40],"40796926",[447,448,33,436,449,40],"40790514",11,"wodenokoto",[451,448,33,321,452,40],"40790610","bogdan",[454,448,33,321,455,40],"40790651","newzisforsukas",[457,448,33,321,458,40],"40790985","ruined",[460,448,33,321,449,40],"40797053",[462,448,33,321,463,40],"40791172","eternauta3k",[465,448,33,321,466,40],"40792877","gkfasdfasdf",[468,448,40,325,177,40],"40799658",[470,471,40,325,472,40],"40793002",12,"TZubiri",[474,471,40,249,475,40],"40793470","NegativeK",[477,471,40,249,472,40],"40794520",[479,471,40,249,235,40],"40796221",[481,471,40,325,482,40],"40898703","stephenhuh",[484,43,40,325,485,40],"40790360","ComputerGuru",[487,43,48,255,488,40],"40790949","curiousdeadcat",[490,43,40,249,485,40],"40792397",[492,43,40,325,488,40],"40794585",[494,43,40,325,57,40],"40791273",[496,43,40,325,485,40],"40792462",[498,43,40,499,500,40],"40791723","other\u002Fcritical\u002Fnone","jahewson",[502,43,40,249,485,40],"40792368",[121,504,48,505,122,40],14,"project\u002Fcritical\u002Fnone",[116,507,48,505,117,40],15,[509,507,48,398,510,40],"40794039","caliwagon",[512,507,40,325,513,40],"40798294","iamsaitam",[515,507,40,325,117,40],"40803078",[517,518,33,436,519,40],"40791100",16,"boundlessdreamz",[521,518,33,522,523,40],"40791216","project\u002Fneutral\u002Fdesign","vinnymac",[525,518,40,325,526,40],"40795241","kinduff",[528,518,33,321,529,40],"40795573","kevlened",[531,532,40,325,533,40],"40796795",17,"dagss",[535,532,40,325,536,40],"40800594","pak9rabid",[538,539,33,269,540,40],"40789873",18,"ashenke",[542,539,48,505,543,40],"40791759","ssahoo",[196,545,48,398,197,40],19,[547,548,48,398,372,40],"40790134",20,[550,548,48,551,65,40],"40790741","project\u002Fcritical\u002Fdesign",[553,548,40,325,372,40],"40791469",[555,548,48,551,556,40],"40791202","OJFord",[558,548,40,249,559,40],"40791255","triyambakam",[204,561,48,505,205,40],21,[563,561,40,325,564,40],"40790111","edward28",[566,561,33,436,567,40],"40792682","itslennysfault",[569,38,48,570,571,40],"40795010","project\u002Fcritical\u002Fexecution","drchickensalad",[573,574,40,325,449,40],"40807569",23,[176,576,48,255,177,40],24,[578,219,40,249,579,40],"40790088","pictur",[136,581,40,582,137,40],26,"other\u002Fneutral\u002Fprivacy",[584,581,40,325,585,40],"40789912","Etheryte",[587,581,40,325,588,40],"40790047","nevir",[590,581,40,582,137,40],"40790397",[592,581,48,255,593,40],"40790898","Spivak",[595,581,40,582,596,40],"40791343","aforwardslash",[598,581,48,255,137,40],"40791684",[600,581,40,325,601,40],"40790141","bbor",[603,581,40,325,372,40],"40790164",[605,581,40,325,137,40],"40790569",[607,581,33,223,523,40],"40791298",[609,581,40,325,610,40],"40790313","smallerfish",[144,612,33,436,65,40],27,[614,612,33,522,615,40],"40790124","fiddlerwoaroof",[617,612,33,269,523,40],"40791340",[109,619,48,255,110,40],28,[621,622,40,325,623,40],"40790522",29,"bradgessler",[211,625,40,325,212,40],30,[627,625,40,249,628,40],"40793082","poopsmithe",[630,631,48,398,632,40],"40792659",31,"tracker1",[73,634,48,570,74,40],32,[636,637,48,255,638,40],"40797178",33,"globular-toast",[97,640,18,641,98,40],34,"project\u002Fpositive\u002Fidea",[643,644,40,325,645,40],"40796613",35,"skeledrew",[169,647,33,522,170,40],36,[150,649,33,321,151,40],37,[651,652,33,223,653,40],"40795279",38,"blacksoil",[655,652,33,223,656,40],"40795385","nightpool",[165,658,33,522,166,40],39,[660,661,48,255,662,40],"40796555",40,"sampli",[664,32,48,255,665,40],"40790400","ptdorf",[667,668,33,669,670,40],"40791001",42,"project\u002Fmixed\u002Fprivacy","tamimio",[185,672,48,505,186,40],43,[674,675,48,570,676,40],"40796265",44,"panzi",[678,679,40,680,681,40],"40790648",45,"other\u002Fneutral\u002Fidea","0xbadcafebee",[683,679,40,325,684,40],"40802809","theozero",[686,679,40,499,681,40],"40847721",[64,688,18,641,65,40],46,[690,688,40,325,65,40],"40793790",[692,693,18,694,695,40],"40793341",47,"project\u002Fpositive\u002Fnone","swedonym",[157,697,48,570,158,40],48,[77,699,48,505,78,40],49,[93,34,18,350,94,40],[702,34,33,223,65,40],"40793585",[704,705,33,321,706,40],"40798799",51,"yashbindal",[708,709,48,398,710,40],"40798206",52,"jbverschoor",[712,713,48,255,714,40],"40791417",53,"cyberax",[716,713,40,325,717,40],"40791675","gregwebs",[719,713,18,350,720,40],"40791915","slt2021",[722,713,48,255,714,40],"40793278",[724,713,40,226,720,40],"40794827",[726,713,40,226,714,40],"40796570",[728,713,48,255,729,40],"40792330","tptacek",[132,731,48,398,133,40],54,[733,731,48,398,734,40],"40789786","isoprophlex",[736,731,48,398,737,40],"40789861","aendruk",[739,731,40,249,740,40],"40790051","Tainnor",[742,731,33,436,743,40],"40790991","adolph",[745,731,40,325,746,40],"40792549","hu3",[748,731,18,641,65,40],"40789803",[750,731,40,325,751,40],"40790193","candiddevmike",[753,731,48,551,65,40],"40790893",[755,731,33,522,751,40],"40790997",[757,731,48,255,638,40],"40797216",[759,731,33,223,362,40],"40798882",[761,731,33,387,762,40],"40789807","randomdata",[764,731,40,325,362,40],"40798928",[766,731,33,321,767,40],"40789984","l5870uoo9y",[769,731,48,255,770,40],"40790055","rhplus",[772,731,40,249,720,40],"40794893",[774,731,48,398,424,40],"40790914",[776,731,48,398,133,40],"40817988",[778,731,40,325,638,40],"40797225",[780,781,48,398,782,40],"40789679",55,"bdcravens",[784,781,33,436,785,40],"40789723","smartplaya2001",[787,781,33,436,782,40],"40789935",[789,790,33,269,791,40],"40789814",56,"throwaway240403",[793,790,33,436,794,40],"40790129","dymk",[],[797,802,807,811,816,821],{"id":798,"name":799,"points":800,"category":801},"40740021","rahulilango.com",1054,"learning_science",{"id":803,"name":804,"points":805,"category":806},"40789672","flipdisc",455,"creative",{"id":808,"name":809,"points":810,"category":20},"40757951","Web Check",411,{"id":812,"name":813,"points":814,"category":815},"40802557","alpha.reconquer.online",340,"games",{"id":817,"name":818,"points":819,"category":820},"40805010","Cerebrium voice agent (fastvoiceagent)",315,"ai",{"id":822,"name":823,"points":824,"category":825},"40788648","Triplit",279,"data",false,"v2",{"id":829,"name":5,"line":6,"ai":826,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":29,"top":18,"kw":830,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":831,"url":9,"mix":832,"praise":86,"objection":102,"sub":21},40789353,[24,25,26,27],"3012013320111302331113111112132142313212",[31,32,33,34],1794036656732]