"pass" alternative using age - looking for review

[telent]

I wrote a Ruby script that could reasonably be described as "inspired by pass" - it's not quite identical, but it's close enough to scratch my itch - which uses age instead of GPG for encrypting secrets

It's arguably not "security software" but it's definitely "security-adjacent". I think I've exercised reasonable diligence in its construction but I'd be super happy to get any kind of review/feedback from security experts

https://github.com/telent/moss/blob/main/README.md

[alerque]

because it seemed like less effort to write one than to understand the uses and limitations of anyone else's

So you want other people to spend time reviewing your implementation for security weaknesses but you can't be bothered to look into the basic workings of other implementations first?

[FiloSottile]

Hey @alerque, this comment is not in line with the kind of community we want to cultivate around age. We don't have a formal CoC, but I suggest looking at the Gopher values to get an idea.

@telent built a thing because they wanted to, or because that way it would more closely fit their needs. I myself sometimes rebuild something rather than learn everything about existing solutions first. Sometimes it's faster, sometimes it's more fun. You don't owe them your time to review it, but they are more than welcome to share their project here and seek feedback.

Welcome both to the community, and let's be nice to each other.

[telent]

So you want other people to spend time reviewing your implementation for security weaknesses but you can't be bothered to look into the basic workings of other implementations first?

Harsh but fair, or possibly vice versa. As I recollect, when I wrote that rather flip comment I'd found a bunch of things that might work but no strong signals as to whether any of them were tested, actively maintained, etc etc. and in the spirit of "how hard can it be" I decide it would be a fun exercise to write my own (narrator: it was). That said - in reality there seem to be far fewer other implementations around than I thought there were at the time. The ones I've been able to find again are

• https://git.sr.ht/~gpanders/passage/ # rust implementation, uses a library for age
• https://github.com/stchris/passage # archived, unmaintained
• https://github.com/biox/pa # posix shell

I don't know a lot (read; anything at all) about rust, so that's a research topic. There's an intriguing comment in pa https://github.com/biox/pa/blob/master/pa#39 that says "A heredoc is used here instead of a 'printf' to avoid leaking the password through the '/proc' filesystem." but I am guessing this refers to having the password appear in ps output, rather than some gnarly hack on /proc/pid/fd/n to intercept a pipe

[alerque]

@FiloSottile Correction accepted.

My apologies @telent, my comment was not called for.