Secret readable in process table

[paulmenzel]

Passing the secret using the switch --secret is insecure, as every local user can read it running ps aux.

[paulmenzel]

I guess one solution would be, that the application itself is extended to parse the config file or read environment variables instead of using switches.

[bbaldino]

I guess one solution would be, that the application itself is extended to parse the config file or read environment variables instead of using switches.

We've actually got this change already mostly implemented in JVB 2.

[paulmenzel]

The change, that jvb reads the configuration file itself?

[bbaldino]

Well, even JVB 1 does read a config file itself (sip-communicator.properties). I don't know the reason why these were passed as switches instead of the config (perhaps easier for deployment), but this is for XMPP component mode of the JVB, right? That's technically deprecated at this point anyway (or maybe I'm misremembering what this switch is for).

[damencho]

secret is for component connection which is already deprecated and new packages does not default to it.