> If you shift from “any string can be a secret” to “secrets are secrets”, it makes things a lot easier to reason about and protect.

> const secret = new Secret("...")

one of those things that's obvious in retrospect. That's a cute trick I'll definitely be stealing.

▲

jiggawatts 4 days ago | parent [-]

.NET has SecureString: https://learn.microsoft.com/en-us/dotnet/api/system.security...

Which reminds me of why I hate tiny standard libraries as seen in JavaScript: features like SecureString work only if they're used pervasively. It has to be in the std lib and it has to be used everywhere so that you almost never have to unwrap them. It's critical that credentials are converted to SecureString as soon as possible and that they stay as SecureString values until the last possible instant when they're passed to some external API call deep inside even a third-party a library.

	▲	vbezhenar 3 days ago \| parent [-]
		Copying GC also have to cooperate with this SecureString feature, so you won't accidentally keep hanging secret in heap dump. Old Java API has the tendency to use `char[]` for secrets. You can zero it after use, so old reference will not contain useful data, but you can't protect it from copying GC, so it might still gets leaked in raw heap dump, even after zeroing it out.