It was discussed in https://news.ycombinator.com/item?id=45670052 and others chimed in with their own (like bkt(1) and up(1)).
The main differences I see:
- memo doesn't need to be built (its a shell script)
- once keeps output cache in a running daemon. By contrast, memo stores content under /tmp with whatever the best compression available is (it prefers zstd). There's trade-offs in that. More pareto-optimal from the security front may be to have a sort of session key and to compress-then-encrypt files on disk.Nixos does this for builds, but I've not seen it generalized to arbitrary processes.
And your network stack could handle things like: "hey last time you gave me 59MB with hash, 0xabcdef123455, can I give my caller a cached copy or has that changed?" ...so that while you're iterating on a bash pipeline that pulls data and transforms it, the data only gets pulled once.
Even attached peripherals like a scanner are in a position to know whether the old thing is still in there or whether a new thing has been loaded such that they only re-scan when there's a new thingy present to scan.
I love FP but having it at the OS level would be something new.
$ cmake ..
$ output | grep "libssl version"Been using this, for similar cli output catching. https://github.com/dimo414/bkt
Wondering what you think about the two, and what are the good reasons to use one vs the other? (Maybe: once is more actively developed? bkt hasn't been active for a year).
Uh I dont know about that one chief.
It's not a perfect fix but it keeps secrets out of env with (so far for me) minimal inconvenience.
I'll take security by inconvenience over building what becomes the primary reason for a security incident.
For example, I have a script for automating the creation of PRs which fetches the available labels for a repo from github and presents them with fzf multi select. I store the labels with a TTL of a week so that I don’t have to fetch them every time and the script compares the file’s age against the desired TTL to invalidate.
I find it useful for augmenting other programs, but I’m not typically using it on the cli directly.
Not sure if there could be other interesting uses. I can’t think of one anyways.
I just want to avoid leaving my credentials and secrets on the filesystem.
EDIT: I use a lot of direnv / mise. So reloading credentials with different values is common.
But I'm not running agents, I have different needs
I first clicked this with just a mild curiosity. But as soon as I saw the 1password example. Lightning.
I try to do everything "the right way", no secrets on disk, gitops, the whole shebang. Even for my personal projects. But when working with API keys and agents it can get so frustrating. I refuse to admit to the number of times where I've told the agent "Please write the 1Password creds to .env and use .env instead because I'm tired of clicking approve on my watch 15 times for every test run."