{"action":"created","issue":{"url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/484","labels_url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/484/labels{/name}","comments_url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/484/comments","events_url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/484/events","html_url":"https://github.com/apache/incubator-brooklyn/pull/484","id":55775705,"number":484,"title":"obfuscate passwords and credentials in the gui (literal \"shadow passwords\")","user":{"login":"ahgittin","id":496540,"avatar_url":"https://avatars.githubusercontent.com/u/496540?v=3","gravatar_id":"","url":"https://api.github.com/users/ahgittin","html_url":"https://github.com/ahgittin","followers_url":"https://api.github.com/users/ahgittin/followers","following_url":"https://api.github.com/users/ahgittin/following{/other_user}","gists_url":"https://api.github.com/users/ahgittin/gists{/gist_id}","starred_url":"https://api.github.com/users/ahgittin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ahgittin/subscriptions","organizations_url":"https://api.github.com/users/ahgittin/orgs","repos_url":"https://api.github.com/users/ahgittin/repos","events_url":"https://api.github.com/users/ahgittin/events{/privacy}","received_events_url":"https://api.github.com/users/ahgittin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-28T16:06:04Z","updated_at":"2015-01-30T13:42:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/apache/incubator-brooklyn/pulls/484","html_url":"https://github.com/apache/incubator-brooklyn/pull/484","diff_url":"https://github.com/apache/incubator-brooklyn/pull/484.diff","patch_url":"https://github.com/apache/incubator-brooklyn/pull/484.patch"},"body":"applies text shadowing to blur keys that say obvious things like \"password\" and \"credential\",\r\nto config table and sensors table. clears up when you click it.\r\nthis prevents people looking over your shoulder from seeing things they shouldn't,\r\nbut it doesn't block REST access, and if you click on it you can still see it.\r\n(this is a common trick done at AWS & SL, btw.)\r\n\r\na separate feature is to enforce visibility of sensors; this can be done with entitlements on a per-sensor basis\r\nbut it might be nice to have an easy entitlements mode where \"sensitive\" info is not available,\r\nand options on config keys (similar to how i just did it with ConfigInheritance,\r\nin https://github.com/apache/incubator-brooklyn/pull/483) to allow ConfigSensitivity.\r\n\r\nan easy way to test is:\r\n\r\n    curl -v -X POST -H \"Content-Type: application/json\" --data \\\"foo\\\" http://127.0.0.1:8082/v1/applications/YKH2Dp3E/entities/NN0BJzNA/sensors/my_secret\r\n\r\nhere's what it looks like:\r\n\r\n![screen shot 2015-01-28 at 16 05 23](https://cloud.githubusercontent.com/assets/496540/5941241/89d8c3fe-a707-11e4-8b4d-7e0ef1c2b28f.png)\r\n"},"comment":{"url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/comments/72201844","html_url":"https://github.com/apache/incubator-brooklyn/pull/484#issuecomment-72201844","issue_url":"https://api.github.com/repos/apache/incubator-brooklyn/issues/484","id":72201844,"user":{"login":"alasdairhodge","id":837473,"avatar_url":"https://avatars.githubusercontent.com/u/837473?v=3","gravatar_id":"","url":"https://api.github.com/users/alasdairhodge","html_url":"https://github.com/alasdairhodge","followers_url":"https://api.github.com/users/alasdairhodge/followers","following_url":"https://api.github.com/users/alasdairhodge/following{/other_user}","gists_url":"https://api.github.com/users/alasdairhodge/gists{/gist_id}","starred_url":"https://api.github.com/users/alasdairhodge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alasdairhodge/subscriptions","organizations_url":"https://api.github.com/users/alasdairhodge/orgs","repos_url":"https://api.github.com/users/alasdairhodge/repos","events_url":"https://api.github.com/users/alasdairhodge/events{/privacy}","received_events_url":"https://api.github.com/users/alasdairhodge/received_events","type":"User","site_admin":false},"created_at":"2015-01-30T13:42:00Z","updated_at":"2015-01-30T13:42:00Z","body":"Meh. It's a cute CSS trick, but I don't think it takes us any closer to correctly solving the problem.\r\n\r\nIMO, each sensor / CK (regardless of its name) should be optionally annotable as `@Sensitive` (redacted with `*` chars) or `@Hidden` (not even shown). It's up for discussion what should be visible to other Brooklyn entities (esp. those in different apps within the same server session), and what should be presented over the REST interface.\r\n\r\nSome might argue that it's unacceptable to be able to access certain values client-side, even if it involves javascript hackery or viewing the HTML/JSON sources."}}