7 ms·

there's this little gotcha you might want to be aware of: https://github.com/ellie/atuin/issues/752#issuecomment-1451865985 https://github.com/ellie/atuin/issue

• justinclift 3y ago
  It sounds serious, but there's not much info in that issue of what's going wrong, why it's going wrong, etc. (?)
  • cmm 3y ago
    it's not serious for most people I guess, but if you rely on bash's HISTIGNORE and don't disable bash's built-in history mechanism when you adopt Atuin, then this is as serious as you are paranoid
    • cmm 3y ago
      er, s/HISTIGNORE/HISTCONTROL/ above
• pcthrowaway 3y ago
  Can you tell me if my understanding of this issue is correct? Let's say I run a command where I've pasted in a credential from my password manager: ` some-cli login username my-secret-password` (note space at beginning) Normally this would prevent the command from getting saved in any meaningful way in my bash history, so that if I later run a malicious script, it can't collect secrets from my bash history. With the bug here, it sounds like atuin would prevent that entry from being stored in the sqlite store, but it would still be in my shell history? If so, this is really significant, and would stop me from using Atuin. Not letting users know about this behaviour is incredibly negligent, and honestly erodes my trust in Atuin to consider user security in general.
  • cmm 3y ago
    correct