Top all-time · #21593
Forces Unseen
Company blog · blog.forcesunseen.com/blogsecurityai
Forces Unseen is the company blog at blog.forcesunseen.com, writing about security and ai. Since 2021, 3 different Hacker News readers have linked it 12 times, most often “Stop Storing Secrets in Environment Variables”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
Cited in HN threads on Django and the Twelve-Factor App as an argument against storing secrets in environment variables, since they leak via /proc and child processes. Suggests mounting secrets from tmpfs instead.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Forces Unseen is an offensive cybersecurity consulting firm specializing in application, infrastructure, and novel security penetration testing.
Most-linked posts?
- Stop Storing Secrets in Environment Variables3 people · 4 mentions · first linked 2022-01-28
What Hacker News says?
Some reasons: - https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-... - https://blog.forcesunseen.com/stop-storing-secrets-in-enviro... They both recommend mounting them into a tmpfs, and then unmounting, but I've not yet tried this.
Comment linking /stop-storing-secrets-in-environment-variables
on “Things I do every time I start a Django project”Submitted Stop Storing Secrets in Environment Variables as a story · 24 points
HN discussionI agree completely. Storing secrets in environment variables is wrong: https://blog.forcesunseen.com/stop-storing-secrets-in-enviro... Even unsetting environment variables leaves them in /proc/self/environ. There isn't a thread-safe way to unset environment variables in POSIX, so even if you `unset TOP_SECRET` from within a program the contents of /proc/self/environ will remain unchanged and available.
Comment linking /stop-storing-secrets-in-environment-variables
on “The Twelve-Factor App (2011)”Submitted A Primer for Testing the Security of GraphQL APIs as a story · 5 points
HN discussionSubmitted Stop Storing Secrets in Environment Variables as a story · 4 points
HN discussionSubmitted Make Search Engines Great Again as a story · 3 points
HN discussionSubmitted LLM Sandboxing: Lessons Learned as a story · 2 points
HN discussionSubmitted GraphQL Security Testing Without a Schema as a story · 2 points
HN discussionSubmitted $ Email Blame as a story · 2 points
HN discussionSubmitted A Primer for Testing the Security of GraphQL APIs as a story · 2 points
HN discussionSubmitted Jailbreaking LLM (ChatGPT) Sandboxes Using Linguistic Hacks as a story · 1 points
HN discussionSubmitted Make Search Engines Great Again as a story · 1 points
HN discussion