👷 Join the FREE Code Diagnosis Workshop to help you review code more effectively using my 3-Factor Diagnosis Framework: www.arjancodes.com/diagnosis
@diegovargas3853
5 ай бұрын
Hey Arjan, thank you for your work from Spain. Would be great if you create a video with your top python books "to improve your python skills to another level", thank you!
@JohnTelford1
6 ай бұрын
Great tips, thanks! For item 4. "Don't share credentials in plain text". If you're developing for AWS, then AWS Secrets Manager is a good choice.
@obijan42
6 ай бұрын
Pro Tip: Use a secrets manager, like 1 password CLI that can dynamically embed your secrets from your vault into the env. It also allows you to share the secrets securely with team, and rotate them centrally.
@_baco
6 ай бұрын
Instead of using the dotenv package I rather like using direnv configured with `load_dotenv = true`. That way the project becomes agnostic of any particular package populating environment variables from `.env`. The project receives all the variables the same way, but without having to import anything extra. This technique works for any project in any language, even though for a specific language there is no dotenv package provided.
@EnergiaRocket
4 ай бұрын
The 'keyring' library is also very handy to store credentials using the OS's built-in credential manager in a structured way.
5 ай бұрын
Despite the hints are appliable to any repository you can use, that's one of the reasons why I (and my teams) use our self-hosted Gitea servers for private projects (and similar ones for job's). Gitea is practically identical to github as far as I use it. I think that github is only for public sharing tested, non private and/or thoroughfully reviewed things.
@maleldil1
6 ай бұрын
You can also use tools like 'git filter-branch' and 'git filter-repo' (recommended) to remove any secrets from your git history. The downside is that you have to force push afterwards since you're changing the history.
@yes-i-am
6 ай бұрын
What if I'm making executables with pyinstaller?
@diegovargas3853
5 ай бұрын
Hey Arjan, thank you for your work from Spain. Would be great if you create a video with your top python books "to improve your python skills to another level", thank you!
@kenjain
6 ай бұрын
Several companies that I have worked at use Vault as the de facto way of sharing credentials with services running in production. I would say this is probably more secure than all of the ways described in this video.
@nierodwirski3515
6 ай бұрын
Agree. But then, how did you store the Vault token? :)
@kenjain
6 ай бұрын
@@nierodwirski3515 you can store the Vault token using any of the methods above or even plain text. The way it works if properly set up is that the Vault token by itself won’t get you the credentials from Vault. You will need to pass the Vault token + some ID (E.g. Mesos Task ID, Kubernetes Job ID, etc.) and your vault service will validate that the job ID belongs to an active job running on your cluster before responding with the creds your service requested.
@udos19928
5 ай бұрын
Thanks a lot! Nice tips, everybody should do so.
@ArjanCodes
5 ай бұрын
Glad the content was useful!
@PaulLessor
13 күн бұрын
You mention using a password manager and that you use Bitwarden. to me this is kind of a "chicken or egg" problem. If the API keys are stored in Bitwarden, how do you retrieve them from your script? The script still needs credentials to access Bitwarden. Am I missing something here? The password manager just moves the API key to a secure location while access to the API key is granted via the insecure credentials you've stored for your script. We've just moved the problem to a different level.
@megatron324
6 ай бұрын
arjan out here fleeced out new hoodie i gotta step it up
@KoenigNord
6 ай бұрын
A few collegues of mine discussed using a centralized service to store credetials for multiple software projects. Ideally including monitoring for any credetials that involve external API-services. Any suggestions?
@moadtahri6605
6 ай бұрын
Second 😂 ! Thanks man for your amazing content. From a teacher, you are a good example of someone who knows the art of teaching. Good luck
@ArjanCodes
6 ай бұрын
Thank you so much for the kind words!
@CharlieSmithv2
6 ай бұрын
If server is hacked, attacker can dump environment variables. How to defend against this ?
@amarasa2567
6 ай бұрын
I think once you get your server hacked, it's mostly game over anyway. My advice would be to secure your server, and at least encrypt your keys before storing them. That will at least slow attackers down, but if they can dump memory, you're not going to be able to defend much…
@anonapache
6 ай бұрын
@@amarasa2567That's not healthy to think like this about the problem. You should always maintain multiple layers and barriers of defense.
@amarasa2567
6 ай бұрын
@@anonapache oh, definitely, but that only slows attackers down, that doesn't make it impossible to get your keys. And once again, if attackers can dump memory, it's all over anyway, since they have to be somewhere in memory at some point... The point is making it too complicated to get to this point to be worthwhile. Defence in depth also adds cost, performance, and usability constraints (if not outright penalties). Yeah it's required, but there's always a tradeoff
@Naej7
6 ай бұрын
If your server gets hacked, I don’t think environment variables are the biggest issue… If the server gets hacked, be sure to be alerted, and just change all of your credentials
@flosrv3194
2 ай бұрын
impossible to get any variable, still fighting on this crap since three days and it systematically returns me none
@astrogerard
6 ай бұрын
Nuttige tips!!
@ArjanCodes
6 ай бұрын
Graag gedaan ☺️
@AJsWorld
6 ай бұрын
I think that the people who are likely to commit private key files are also the same kind of people who would create a .env file and not add a gitignore rule for it.
@Naej7
6 ай бұрын
That’s way Arjan tells them to add the .env file to the .gitignore
@AloisMahdal
6 ай бұрын
this weird convention of making env definitions hidden drives me crazy. I have no idea where it comes from, to me it's completely illogical
@Naej7
6 ай бұрын
Do you plan on using another VSCode theme ? The default one is pretty lame if you ask me, it does not have enough colors to differentiate the different types of words in a Python script. I suggest you to use Atom Dark Pro, as it’s close enough to the original theme, but with way more colors for the scripts. I can understand that you don’t want beginners to be disturbed, but I think that past a certain point, everyone has a custom theme, and it might not be a good idea to accustom beginners to the bad default theme
@valorien1
6 ай бұрын
os.environ[key]/os.environ.get() is faster than os.getenv() and is also a good practice, because it lowers the chances of people thinking they should in turn use the (broken) os.setenv() when they need to set environment variables.
Пікірлер: 38