I would like to know why - what is it that I'm missing? In the mentioned MySQL manual(I'm using this as an example), passing password via
-p option in command line is considered as "insecure" and via env var as "extremely insecure", bold italic font.
I'm not an expert but I do know the fundamentals: simple
ps command, even issued by unprivileged user reads every program alongside with command parameters while only the same user (and root, of course) may read environment of the process. So, only
johndoe may read environment of the
johndoe - started process, while hacked
www-data script reads all via
There must be some big deal here that I'm missing - so please explain me what am I missing?
My objective is to have a mean of transferring secret from one program to other, generally, non-interactive.