[HN Gopher] Show HN: Partially encrypt a file based on its HEREDOCs
___________________________________________________________________
Show HN: Partially encrypt a file based on its HEREDOCs
Hi HN! I wrote a tool that partially encrypts files based on the
presence of a HEREDOC. Check it out:
https://github.com/higgins/privatize When added to a git repo, it
will automatically transparently encrypt/decrypt files you want
privatized. For example if you configured your repo to privatize
the file `example.txt`, you could write: ```
Today I a burrito. <<PRIVATE I was on the toilet
for hours. PRIVATE I got a lot of reading done.
``` but when git-commit'ed would become:
``` Today I a burrito. <<PRIVATE
xuJ0fld2vmNWaVLogTIufmWsiFso PRIVATE I got a lot of
reading done. ``` Diffing works as you expect (on the
unencrypted source) and only those with the `privatize` symmetric
key would be able to unlock and decrypt these files. Why did I do
this? I keep a public log of what I plan to accomplish and what
I'm working on both personally/professionally. At the end of the
day, I write a summary of everything that happened. Naturally,
there are some details of my life that should be kept private
(details of too-be-launched projects, sensitive family events,
etc). It's helpful for me to track everything in one file so as to
keep the day's context together. Would love to know what you
think! Justin
Author : higgins
Score : 22 points
Date : 2022-03-16 19:48 UTC (3 hours ago)
| [deleted]
| nnf wrote:
| This is a neat idea. I wrote something similar recently but with
| the aim of encrypting sensitive values (like API keys) in YAML
| config files, for similar reasons -- so people without the key
| can see most of the config but not the secret parts. The script
| is then used by an automated deployment process to decrypt the
| sensitive values when the config file is moved into place.
| higgins wrote:
| Nice!
|
| You can use it as a cli tool too: ``` #
| Create a stand-alone symmetric key for use outside of git
| privatize create-key symmetric.key # Encrypt a file
| and pipe to stdout cat someFileToPartiallyEncrypt |
| privatize encrypt symmetric.key # Decrypt a file and
| pipe to stdout cat someFileToPartiallyDecrypt | privatize
| decrypt symmetric.key ```
|
| Open to pull requests if you want to adapt to your use cases
| too
| amenghra wrote:
| I might not have properly understood this tool, but is the
| encryption key and iv getting reused? If so, it's usually quite
| unsafe to reuse IVs (but consult a cryptographer, YMMV). Feels
| weird to stuff the IV with the key, it should live with the
| ciphertext.
|
| (I only glanced at the code for a few minutes, so I could be
| wrong:
| https://github.com/higgins/privatize/blob/0.1.1/index.js#L73)
| higgins wrote:
| Thanks for taking a look! Yeah, I should cleanup the wording in
| here a bit:
|
| The IV is a sha1 hmac of the content to be encrypted. The 16B
| that are stored with the key is used to initialize the sha1
| hmac:
|
| https://github.com/higgins/privatize/blob/0.1.1/index.js#L20...
| deathanatos wrote:
| Given that you store the IV alongside the ciphertext anyways,
| I'm not seeing what advantage this has over just choosing the
| IV at random.
| higgins wrote:
| FYI: this was inspired by the great `git-crypt`
| (https://github.com/AGWA/git-crypt)
|
| More on my motivations here:
| https://encapsulate.me/writing/Privatize.html
| mdaniel wrote:
| Yikes, do all filters do that?
| https://github.com/higgins/privatize/blob/0.1.1/index.js#L98
|
| Also, it's 2022 and I still have to remind people not to commit
| binary assets into git repos, as the repo will grow without
| bound: https://github.com/higgins/privatize/tree/main/release
|
| That's the very problem that GitHub Releases were designed to
| address, and has the extra awesome benefit of using (currently)
| AWS S3 for distribution, which is almost certainly going to be
| faster and place less load upon github.com than
| .../raw/main/release/whatever.exe
|
| Also, while the Brew tap indicates your code is ISC, there is no
| license file in your repo: https://github.com/higgins/homebrew-
| privatize/blob/main/Form...
| [deleted]
| higgins wrote:
| Thanks for your thorough feedback! Much appreciated
|
| Added some more TODOs to address your comments. :)
|
| FWIW, the `git reset --hard` is only on unlocking a repo that
| was previously privatize'd. Still, not a great FTUX. Will
| update.
| klyrs wrote:
| Do you check that the sentinel string PRIVATE does not occur in
| the encrypted data?
| higgins wrote:
| hey, thanks! added to my TODOs:
| https://github.com/higgins/privatize/commit/53f62483f943112e...
___________________________________________________________________
(page generated 2022-03-16 23:01 UTC)