Hacker News Reader

I consider this in the same realm as storing passwords to plain text. People do it out of ignorance until they're learn the hard way not to (or some kind soul saves them from that disaster).

View on HN

How is this not considered a framework bug? "Secret tokens" are project-specific configuration more or less by definition. Putting them in something that lives in a source directory is simply asking for this kind of mistake.

Rails deployments aren't leaking their ssh keys or database content because that is stored separately. To paraphrase the title: these things are stored separately for a reason.

Get this thing out of the source, guys.

database.yml is also placed in config-directory.

secret_token.rb is placed where it is, because it is a initializer.

http://guides.rubyonrails.org/configuring.html#locations-for...

How is "because it is a initializer" a response to the point? The fact that it is implemented as Ruby code has nothing to do with whether or not it should be stored in a source code directory. Clearly it should not. Yet it is. That's a framework bug.

Reply on news.ycombinator.com