{"action":"created","issue":{"url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/437","labels_url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/437/labels{/name}","comments_url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/437/comments","events_url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/437/events","html_url":"https://github.com/mesosphere/marathon-ui/pull/437","id":118826638,"number":437,"title":"Show only last 4 characters of environment variables","user":{"login":"pradeepchhetri","id":2232667,"avatar_url":"https://avatars.githubusercontent.com/u/2232667?v=3","gravatar_id":"","url":"https://api.github.com/users/pradeepchhetri","html_url":"https://github.com/pradeepchhetri","followers_url":"https://api.github.com/users/pradeepchhetri/followers","following_url":"https://api.github.com/users/pradeepchhetri/following{/other_user}","gists_url":"https://api.github.com/users/pradeepchhetri/gists{/gist_id}","starred_url":"https://api.github.com/users/pradeepchhetri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pradeepchhetri/subscriptions","organizations_url":"https://api.github.com/users/pradeepchhetri/orgs","repos_url":"https://api.github.com/users/pradeepchhetri/repos","events_url":"https://api.github.com/users/pradeepchhetri/events{/privacy}","received_events_url":"https://api.github.com/users/pradeepchhetri/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-25T12:29:49Z","updated_at":"2015-11-25T12:41:31Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mesosphere/marathon-ui/pulls/437","html_url":"https://github.com/mesosphere/marathon-ui/pull/437","diff_url":"https://github.com/mesosphere/marathon-ui/pull/437.diff","patch_url":"https://github.com/mesosphere/marathon-ui/pull/437.patch"},"body":"Some of the environment variables are secret which shouldn't be exposed as plain-text. This patch just prints the last 4 digits of the variable value. I know it is not the general use-case. I am just opening this pull request to get a feedback on what is the ideal way of implementing it in marathon."},"comment":{"url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/comments/159596182","html_url":"https://github.com/mesosphere/marathon-ui/pull/437#issuecomment-159596182","issue_url":"https://api.github.com/repos/mesosphere/marathon-ui/issues/437","id":159596182,"user":{"login":"philipnrmn","id":2989362,"avatar_url":"https://avatars.githubusercontent.com/u/2989362?v=3","gravatar_id":"","url":"https://api.github.com/users/philipnrmn","html_url":"https://github.com/philipnrmn","followers_url":"https://api.github.com/users/philipnrmn/followers","following_url":"https://api.github.com/users/philipnrmn/following{/other_user}","gists_url":"https://api.github.com/users/philipnrmn/gists{/gist_id}","starred_url":"https://api.github.com/users/philipnrmn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philipnrmn/subscriptions","organizations_url":"https://api.github.com/users/philipnrmn/orgs","repos_url":"https://api.github.com/users/philipnrmn/repos","events_url":"https://api.github.com/users/philipnrmn/events{/privacy}","received_events_url":"https://api.github.com/users/philipnrmn/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T12:41:31Z","updated_at":"2015-11-25T12:41:31Z","body":"Interesting idea. \r\n\r\nObviously, doing this in the UI is not any improvement in security - an attacker with access to the UI has access to the API, and it's trivial to hit the relevant `apps` endpoint and get the unredacted value. \r\n\r\nBut I'm also not sure I understand the value of doing this in the API. Could you describe a scenario in which having write- but not read-access to the EVs would improve security?\r\n\r\nAlso tagging @aquamatthias for his opinion. "}}