Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env

(marketplace.visualstudio.com)

14 points | by xinbenlv 6 hours ago

5 comments

  • esperent 1 hour ago
    I recently got a phone with a high zoom level - once you factor in digital zooming it's 20x. The photo quality at that zoom level is trash, but it absolutely could be used to read text from people's laptop screens from across a big room, or even another building through a window.

    Of course, real cameras have always had this kind of zoom level. The difference is that now, someone could appear to be browsing on their phone from very far away, but actually be reading text on your laptop screen.

    It's much more likely they'll be looking for credit card details or something like that rather than .env secrets. But I guess it's better safe than sorry if you frequently work in a public, tech focused environment like a big coworking space.

    We're talking someone sitting with their phone 50 meters away from you being able to read text on your laptop screen. That's about the distance where a person with good vision will struggle to recognize faces.

    • verdverm 41 minutes ago
      Would they need something to help with stabilization at that zoom and distance?
  • __MatrixMan__ 1 hour ago
    I recently made this as a component in a larger project https://gist.github.com/MatrixManAtYrService/7fc7fb05474d971...

    The idea is that even if you can't see the full data for some reason (space constraints, in my case), different values will appear styled differently even if the non-hidden characters don't differ.

    I'm not sure how easy/hard vscode makes this, bit it might be fun to use a hash of the secret (salted by that character's index) to determine the back/foreground colors of the *'s

    That way even though you can't see the secret, you can tell that it has changed. Also you're in a position to notice if two hidden secrets are the same (this might clue the user into a mistake, like if they didn't actually copy what they think they copied and are instead pasting the previous thing.

  • dietr1ch 1 hour ago
    > I've always had this fear of accidentally flashing my .env file with production secrets to the whole room (or recording).

    Can't you just intersperse entries with multiple-screens-worth of blank lines, or add noisy variables?

    I'm thinking that 120 blank lines at the beginning and the end might be enough though, no need to make the file really hard to use.

  • theozero 5 hours ago
    Better than masking them in a file, get them out of the file entirely! Pull them declaratively instead - https://varlock.dev

    This tool also redacts from your logs if working in js.

    • verdverm 39 minutes ago
      This appears to be the only comment you make on HN

      https://news.ycombinator.com/threads?id=theozero

      Using HN less like a marketing platform would be appreciated

    • NewJazz 24 minutes ago
      What does this offer that a scriptlet that sets the envvars doesn't?
    • xinbenlv 4 hours ago
      [dead]
      • nonethewiser 1 hour ago
        Bravo Founder and CEO of Namefi, but the DNS seems to resolve just fine. Do you understand the DNS space? Perhaps you could find out more using this little side project I've been working on: https://www.google.com/.
        • xinbenlv 49 minutes ago
          Haha thanks my friend, well said.
        • theozero 1 hour ago
          yeah for our DNS we use a little provider called... Cloudflare.

          But hey some tokenized crypto dns provider is probably much more reliable! lol

          • xinbenlv 50 minutes ago
            Exactly, exactly
  • svgeek 1 hour ago
    OMG,I wish I had this years ago!
    • xinbenlv 52 minutes ago
      Thanks, glad you liked it!