Bug#480417: Duplicity exposes credentials in the nvironment without need

2008-05-10 Thread Florian Weimer
* Sam Hartman: > The process environment is public Only on some systems (Solaris with /usr/ucb/bin/ps, IIRC). On Linux, is private. The command line is public, though. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#480417: Duplicity exposes credentials in the nvironment without need

2008-05-10 Thread Sam Hartman
> "Alexander" == Alexander Zangerl <[EMAIL PROTECTED]> writes: Alexander> severity 480417 normal tags 480417 = pending thanks Alexander> On Fri, 09 May 2008 17:25:24 -0400, Sam Hartman writes: >> The process environment is public; Alexander> that's not correct. (are you maybe

Bug#480417: Duplicity exposes credentials in the nvironment without need

2008-05-09 Thread Alexander Zangerl
severity 480417 normal tags 480417 = pending thanks On Fri, 09 May 2008 17:25:24 -0400, Sam Hartman writes: >The process environment is public; that's not correct. (are you maybe mixing this up with the cmdline which is indeed public?) >setting passwords in the >environment is problematic becau

Bug#480417: Duplicity exposes credentials in the nvironment without need

2008-05-09 Thread Sam Hartman
package: duplicity severity: important tags: security Version: 0.4.10-1 The boto class in backends.py requires that AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY be set. However python-boto is perfectly happy to read these values out of ~/.boto. The process environment is public; setting passwords