Update release-notes.md #8436

pull jwilkins wants to merge 1 commits into bitcoin:0.13 from jwilkins:patch-1 changing 1 files +1 −1

jwilkins commented at 7:09 PM on July 31, 2016: none

echo shows up in process history too
Update release-notes.md
echo shows up in process history too
31fb475763
MarcoFalke commented at 7:20 PM on July 31, 2016: member

I think the goal was about not having the password in [h]top or ps.

If someone can cat .bash_history, they can likely do cat mysecretsettings.conf as well.

in doc/release-notes.md:None in 31fb475763

  60 | @@ -61,7 +61,7 @@ The RPC command line client gained a new argument, `-stdin`
  61 |  to read extra arguments from standard input, one per line until EOF/Ctrl-D.
  62 |  For example:
  63 |  
  64 | -    $ echo -e "mysecretcode\n120" | src/bitcoin-cli -stdin walletpassphrase
  65 | +    $ cat mysecretsettings.conf | src/bitcoin-cli -stdin walletpassphrase

paveljanik commented at 7:38 PM on July 31, 2016:

We will surely not merge cat file | something reading from stdin... ;-)

paveljanik commented at 7:40 PM on July 31, 2016: contributor

The echo command is used here as an example only. We should properly mark it as such, because it is in the shell history as well, of course. But not by using cat please...
laanwj commented at 6:39 AM on August 1, 2016: member
I did try this out before writing this, and echo won't show up in ps as it is a shell built-in, e.g. try this in one window:
```
$ echo "secret" | sleep 100
```
Then in another
```
ps eafux | grep secret
```
This shows only the grep process itself.

Sure, in practice, certainly in scripts you will probably source from a file
```
src/bitcoin-cli -stdin walletpassphrase < mysecretsettings.conf
```
In any case it just an example, you can use the functionality in different ways.

edit: If you don't want something to end up in history it suffices to put a space before the line, at least in bash.
laanwj added the label Docs and Output on Aug 1, 2016

paveljanik commented at 8:10 AM on August 1, 2016: contributor

What about adding this after the example?

Warning: when used as described, the command line (including your secret
walletpassphrase) will be stored in your shell history file.

PRed as #8440.

paveljanik referenced this in commit d312711eb0 on Aug 1, 2016
laanwj commented at 3:09 PM on August 2, 2016: member

Closing in favor of #8441
laanwj closed this on Aug 2, 2016
DrahtBot locked this on Sep 8, 2021

Contributors

Labels

Linked (view graph)

#8440 Add warning about shell history file #8441 doc: Rewrite shell example to not leave secrets in the history file