-12

This question specifically asks "where" to store secrets. The answers provided are dangerous. Yet, my brief answer which directly answers the question posed, to store them in a system's native keychain, was abused because I also linked to a popular NPM module to accomplish the task without duplicating their how-to page in my answer. Bear in mind that neither the module or link was the answer, only additional information. As a result of the abuse, the only answers now visible advocate storing secrets in environmental variables.

Is it really Stack Exchange policy that the curation of an answer takes precedence over the accuracy, especially when said inaccuracies can be dangerous? Or is this an example of rogue, foolishly pedantic moderation?

11
  • 18
    It wasn't abuse. It was a request for a better answer. The answer meant well but wasn't very detailed. If you suggest a solution, it would be good to show how one can implement it. Otherwise, it's just another "this is bad, do something else instead"
    – Dharman Mod
    May 29, 2022 at 19:44
  • 1
    @Dharman so its better to leave detailed answers that are dangerous, than to leave an answer that concisely answers the question asked in a way thats far better aligned with best practices just because it doesnt go into extra details that weren't asked for to begin with? May 29, 2022 at 20:15
  • 33
    Why not post a detailed answer that is also secure? Explain the dangers and convince your readers why your solution is better.
    – Dharman Mod
    May 29, 2022 at 20:17
  • 1
    It would be better to point to the canonical duplicate (the ques. was closed about 1 hour later). The gist of your answer is very likely the gist of an answer to a canonical question. Many (very basic) questions are islands without an indication of the canonical duplicate. A sample: Where is the best place to store the key for encryption a password in keychain. Related: Why do I need 50 reputation to comment? What can I do instead?. Also please use standard orthography. Thanks in advance. May 30, 2022 at 10:36
  • 2
    A 100% identical answer was submitted to this question. May 30, 2022 at 10:54
  • 1
  • by deleting my comments you only prove the point i was expressing in them that its not worth contributing here when one's efforts are so casually wiped away. and no amount of mindless censorship will make it any less shocking that youre knowingly promoting the kind of dangerous information that leads to identity theft and the destruction of ppl's financial lives. shame. May 30, 2022 at 16:31
  • 12
    No one has deleted comments from you or anyone else here. The removal of answers that do not meet our guidelines is not censorship, nor is it tacit endorsement of dangerous information. You just need to write better answers. It's not that hard. Don't blame moderators for your choosing not to do so.
    – Cody Gray Mod
    May 31, 2022 at 9:14
  • 2
    @CodyGray at least one "don't count on it" of theirs was deleted when it was on MSE for obvious reasons of being unconstructive. May 31, 2022 at 9:23
  • 4
    @AntiochTechnologies to reiterate on what other have said already: this has nothing to do with censorship. The input on the drawbacks of loading secrets into the globally available environment is always welcome, you just need to follow the quality standards for contributions. Add some information on why exactly using dotenv may be a problem (f.e. malicious dependency reading the variable's value at runtime), possibly provide a usage example for the package, and flag for mod attention to undelete. It would be a constructive approach to the problem at hand resolved to the benefit of everyone. May 31, 2022 at 9:35
  • @AntiochTechnologies if you're unable to write anything to support your claims about other answers being bad or your solution being wonderful, you're nothing more that just some random guy in the internet screaming that he's right and everybody else is wrong. Jun 1, 2022 at 14:35

1 Answer 1

41

You got a comment before your answer was deleted:

Please don't just post some tool or library as an answer. At least demonstrate how it solves the problem in the answer itself.

because your whole answer read:

its more secure to store your secrets on a system's native keychain than in its environmental variables. keytar is what you want for that.

Where the last "sentence" was linked to an external resource.

That answer is simply put not of enough substance to qualify as a high-quality answer. We want answers to stand on their own, and if they refer to a tool/library or other off-site resource, make clear in your answer on Stack Overflow how the tool/library/resource should be used in the context of the question asked. Just linking to it and stating "this is what you want" is not enough.

It is definitely not rogue, foolishly pedantic moderation. Instead it is to ensure future visitors can assess the usefulness of an answer without having to visit yet another site to learn how a tool or library applies to their problem.

3
  • again, keytar wasnt the answer. storing secrets in a system's keychain, not environment variables, was the answer to the question of "where". "how" was not asked. May 29, 2022 at 20:11
  • 28
    @AntiochTechnologies then edit your answer, remove the link and flag for a mod to have it undeleted.
    – rene
    May 29, 2022 at 20:17
  • 11
    @AntiochTechnologies Or even better: Leave the link, but add an example on how keytar can be used to achive the goal.
    – BDL
    May 31, 2022 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .