Where .env Went Wrong(secretspec.dev)
33 pointsby domenkozar6 hours ago8 comments
  • c-hendricks5 hours ago
    Also mise: https://mise.jdx.dev/environments/
    • kstrauser5 hours ago
      Seconded. I've also had great luck with the same author's fnox secret manager, especially because you can tell it to fetch some secrets from the user's laptop's OS keychain, and some out of 1Password, and some out of AWS KMS, and some out of [probably your own favorite provider (https://fnox.jdx.dev/providers/overview)].
      • domenkozar5 hours ago
        fnox is mostly a copy of secretspec (and it's good to have one!), so you'll find the same kind of support in both. I wish instead we'd collaborate with Jeff, but oh well.

        The difference is that we're providing an interface for applications to build with, with 8 SDKs available so you can have first-class support for secrets whatever you're bulding. I do hope fnox copies that too!

        • kstrauser4 hours ago
          You keep saying that but I disagree strongly. Having looked at both fnox and secretspec, there are some obvious similarities because they're both in the same space, interacting with many of the same tools, and there are only so many ways to declaratively state "set the FOO variable with the 'my_secret_key' value out of the Bar provider".

          Those inherent similarities aside, I don't see it. They don't seem to have a lot in common as far as design or implementation or configuration.

  • eigencoder3 hours ago
    Hm, I haven't seen these issues personally. We only have one `.env` file and it's just for local secrets. Configuration emphatically does not go in `.env` and ideally is in docker compose and defined in code (we use Pydantic Settings).
  • qntty5 hours ago
    I use Pydantic Settings for this, would be nice to see a comparison to that. I do like the idea of keeping this in a configuration file.
    • domenkozar5 hours ago
      Two things:

      - Secrets don't belong in config https://secretspec.dev/blog/secrets-dont-belong-in-config/

      - You want to have flexibility of choosing between any secrets provider: https://secretspec.dev/blog/but-i-use-sops/

      • eigencoder3 hours ago
        But secrets are a kind of configuration, right? I agree they should be kept separate from non-secret config; ideally non-secret configuration can be committed to your codebase somewhere depending on the environment it's running in.
      • tomjakubowski3 hours ago
        pydantic-settings is not limited to loading from config files. It is easy to populate a settings model from environment variables, for example. With a little bit of glue code it could load from the secretspec sdk.
    • triyambakam5 hours ago
      Yeah Pydantic Settings is pretty nice
  • theozero5 hours ago
    Over at varlock (https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorator style comments to add schema info, and functions to load and compose values.

    A big difference between our tool and many other similar tools is that we combine the schema and value setting into one surface, with a way of merging many definitions together, much like cuelang - but in a way that feels more intuitive. It's extremely flexible, and can even do credential brokering for untrusted workloads.

    I've been enjoying the secretspec content lately, and watching it evolve :)

    • cyanregiment5 hours ago
      It's too bad they call background services "agents" now instead of daemons like they used to, because your slogan could be Secrets for daemons

      Varlock is clever. Sub string types for .envs pretty cool, why not

  • ctippett4 hours ago
    I'm sure there are many better alternatives to .env, but its ubiquity and support across various tools makes it super convenient.

    I'm using 1Password's .env integration[1] and although the UX is a bit clunky, I really like it. My API keys are secure, tools that ordinarily support .env just work and there's a team-sharing feature too (although I'm yet to use it). It's pretty neat.

    [1] https://www.1password.dev/environments

  • Natfan5 hours ago
    Claude, find a key underpinning of most development workflows, then make a product to disrupt (and eventually SaaSify/enshitify) it. Finally, write a convincing ad disguised blog post, and purchase a fancy domain. Here's my credit card.
    • theozero5 hours ago
      While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.
    • domenkozar5 hours ago
      Don't take the black pill <3
  • tosti5 hours ago
    One could also... Not jump on the bandwagon?

    (Am I getting thrown out the window now? :)