From: Dana Merrick <dmerrick@...>
Date: 2008-07-01T02:49:13+09:00
Subject: Re: Hiding a password in code.

--------------enigD10B4DEDA1EDD4D0AD983D1B
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

Michael Morin wrote:
> Store your password in an encrypted file.  When you start the script up=
,=20
> enter the encryption password to decrypt the file so your Ruby script=20
> can grab it and keep it in memory.  It won't be stored in plaintext in =

> the file (but will probably end up in swap if you're really paranoid).
>=20
> This is about as effective as entering the password as the script start=
s=20
> come to think of it.  This has always been a problem.  You can't store =

> the password to be retrieved automatically, the best you can do it=20
> obfuscate it.  And you're right, never give passwords on the=20
> command-line.  Scripts that need passwords should read them from=20
> keyboard or STDIN.  Especially if you're on a shared machine.

These are excellent points. The reason I haven't done this is that I'd li=
ke to=20
have my script be able to run without action from me, in the background.

I suppose I just need to accept the fact that I'm asking to do something =

inherently insecure in an interpreted language. I'm pleased enough with t=
his=20
solution:

form['password'] =3D @options[:pass] || "AvprGel".tr("A-Za-z","N-ZA-Mn-za=
-m")

-Dana

--=20
Dana Merrick - System Administrator
Integrated Computer Solutions, Inc.
54B Middlesex Tpke, Bedford, MA 01730
617.621.0060 x112 - http://www.ics.com


--------------enigD10B4DEDA1EDD4D0AD983D1B
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAkhpHT8ACgkQ7b+8UB5G/wNWGwCgoreGpd0DpnHHaROHo2ZNoz0O
N0MAn0wu/CS60cCu2ifBDMT4hdCbbSx0
=isG8
-----END PGP SIGNATURE-----

--------------enigD10B4DEDA1EDD4D0AD983D1B--