Top all-time · #3151
Diogo Mónica
Personal blog · diogomonica.comsecuritystartupscareer
Diogo Mónica's personal blog at diogomonica.com covers security, startups and career. Since 2013, 24 different Hacker News readers have linked it 33 times, most often “Don't use ENV variables for secret data (2017)”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link his posts on secrets handling, environment variables, password security, hitless TLS certificate rotation and GDPR access requests, plus one on moving a blog to containers.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
General Partner at Haun Ventures. Co-founder and Executive Chairman of Anchorage Digital. Chairman of the NEAR Foundation. Director at Erebor.
Most-linked posts?
- Don't use ENV variables for secret data (2017)9 people · 9 mentions · first linked 2017-03-27
- Bot wars - The arms race of restaurant reservations in SF3 people · 3 mentions · first linked 2013-07-25
- Crypto Anchors: Exfiltration Resistant Infrastructure3 people · 3 mentions · first linked 2017-10-09
- A Pirate's Take on Strategy vs. Tactics2 people · 3 mentions · first linked 2018-10-10
- Build once run where? Migrating my blog to hyper.sh2 people · 2 mentions · first linked 2016-12-03
- Creating a CSP Policy from Scratch2 people · 2 mentions · first linked 2015-12-31
What Hacker News says?
To protect "sensitive, low-entropy data", the main things I've seen people do are encryption, tokenizing, or anchored hashing. I'm certain there's a bunch of academic work out there I'm not across so I'm writing from the limited perspective of "things I've seen people do in industry". The best thing to do tends to depend on how you need to use the data, exactly. With hashing alone there's just no reasonable cost fun…
Comment linking /2017/10/08/crypto-anchors-exfiltration-resistant-infrastructure/
on “533M Facebook users' phone numbers and personal data have been leaked online”Submitted Bot wars - The arms race of restaurant reservations in SF as a story · 166 points
HN discussionYou can get most of the way there though: https://diogomonica.com/2017/10/08/crypto-anchors-exfiltrati...
Comment linking /2017/10/08/crypto-anchors-exfiltration-resistant-infrastructure/
on “The Nightmare Letter: A Subject Access Request Under GDPR”Submitted A Pirate's Take on Strategy vs. Tactics as a story · 149 points
HN discussionTL;DR: Move from Digital Ocean to Hyper.sh and run the same blog in a container for $3.69 per month. -- If you'd rather run you applications as Docker containers take a look at Hyper.sh. Diogo Monica describes the process nicely here: https://diogomonica.com/2016/12/03/build-once-run-where-migr... Pricing details are here: https://hyper.sh/pricing.html
Comment linking /2016/12/03/build-once-run-where-migrating-my-blog-to-hyper-sh/
on “$5 Showdown: Linode vs. DigitalOcean vs. Amazon Lightsail vs. Vultr”Submitted Crypto Anchors: Exfiltration Resistant Infrastructure as a story · 142 points
HN discussionSome reasons: - https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-... - https://blog.forcesunseen.com/stop-storing-secrets-in-enviro... They both recommend mounting them into a tmpfs, and then unmounting, but I've not yet tried this.
Comment linking /2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
on “Things I do every time I start a Django project”Submitted Don't use ENV variables for secret data (2017) as a story · 110 points
HN discussionOops, I've been putting secrets in environment variables since I can remember. Your comment piqued my curiousity on why this is a bad idea. Found this: https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-... https://security.stackexchange.com/questions/197784/is-it-un...
Comment linking /2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/
on “Don’t use environment variables for configuration”Submitted Increasing Attacker Cost Using Immutable Infrastructure as a story · 110 points
HN discussion"we just can't memorize unique, strong passwords, for every single on-line service out there" ... right. Apparently we don't speak in a language with an absurd amount of subtle differences that need to be remembered (one example is punctuation, and all the subtle rules with punctuation as well). We also apparently don't memorize other things such as face recognition, navigation, mathematics, physics, x amount of mov…
Comment linking /about/
on “Password Security: Why the horse battery staple is not correct”Submitted Password Security: Why the horse battery staple is not correct as a story · 89 points
HN discussionAuthor here, I actually added a footnote exactly because of that fact: https://diogomonica.com/2017/01/11/hitless-tls-certificate-r...
Comment linking /2017/01/11/hitless-tls-certificate-rotation-in-go/
on “Hitless TLS Certificate Rotation in Go”Submitted Hitless TLS Certificate Rotation in Go as a story · 84 points
HN discussionThis blog posts offers absolutely nothing new relative to what was in Diogo's original post [0] and accompanying previous discussion [1]. In fact it offers less since it doesn't include the original scripts Diogo used. I (and I'm sure many others) would love it if there were some way for moderators to aggregate all upvotes for related articles that don't offer substantial new information or commentary on the origina…
Comment linking /bot-wars-the-arms-race-of-restaurant-reservations-in-sf/
on “Bots Gobble Up Restaurant Reservations in the Bay Area”Submitted Why should hard be secure enough? Information and non-invertibility as a story · 58 points
HN discussionOriginal source, from the previous discussion: https://diogomonica.com/bot-wars-the-arms-race-of-restaurant... The siliconbeat.com article here just seems to be a reblog/summary.
Comment linking /bot-wars-the-arms-race-of-restaurant-reservations-in-sf/
on “Bots Gobble Up Restaurant Reservations in the Bay Area”Submitted A Pirate's Take on Command vs. Leadership as a story · 6 points
HN discussionSubmitted Why you shouldn't use ENV variables for secret data as a story · 5 points
HN discussionSubmitted Creating a CSP Policy from Scratch as a story · 5 points
HN discussionSubmitted A Pirate's Take on Strategy vs. Tactics as a story · 4 points
HN discussionSubmitted Why you shouldn't use ENV variables for secret data as a story · 3 points
HN discussionSubmitted From F to A+: Getting Good Grades on Website Security Evaluations as a story · 3 points
HN discussionSubmitted You shouldn't use ENV variables for secret data (2017) as a story · 2 points
HN discussionSubmitted Password Security: Why the XKCD horse battery staple password is not correct as a story · 2 points
HN discussionSubmitted Strategy vs. tactics as a story · 2 points
HN discussionSubmitted Why you shouldn't use ENV variables for secret data as a story · 2 points
HN discussionSubmitted Why you shouldn't use ENV variables for secret data as a story · 2 points
HN discussionSubmitted Skynet (beta): The rise of the Beam robot as a story · 2 points
HN discussionSubmitted The Two Metrics That Matter for Host Security as a story · 1 points
HN discussion
