scottmotte

Cryptographic systems are mostly designed for machines, not humans. We end up staring at long strings. I wanted to experiment with how to better visualize them - in a more human way. The result is KEYSEE⎔. Try it out and hope you enjoy! There is also a whitepaper that goes into more details (under the /api section).

> If you did 'dotenvx run -- env', all your secrets would be printed right there in plaintext

Same for sops.

> The equivalent in vercel would be encrypted in the database (the encrypted '.env' file), with a decryption key in the backend

The encrypted .env file is actually committed to source code, and the decryption key is placed in Vercel's environment variables dashboard. The attacker only gained access to the latter here if using dotenvx so they can't get your secrets. Unless they also gained access to the codebase in which they have terabytes of data to go through and match up private keys from the database with encrypted .env files from the source code exfiltration - much more effort for attackers.

Encrypting your .env file with dotenvx, or something similar, can help mitigate this need for trust.

> developers could still potentially commit private keys the repo or commit the decrypted env file

to prevent this, use:

$ dotenvx ext precommit --install

I've tried all four, and Render is the closest experience to Heroku. It still isn't as easy to use as Heroku, but it is close.

> people are most comfortable being around people like themselves

Inertia. This is everything. It takes effort to be around people unlike those currently around you.

We all have personal biases against the strata economically above us and below us. I think most of the individuals that move up economically are able to get beyond these biases for one reason or another. Otherwise, even the most hardworking individuals tend to self-sabotage when they start to feel out of place.