Consumer secret is displayed in ps output

[Jamu Kakar]

I don't know what a "consumer secret" is, but the name implies it's
something sensitive. It probably shouldn't be visible in ps output:

$ ps ax|grep ubuntu
 6965 ? S 0:02 /bin/bash /usr/bin/ubuntuone-storage-start
 7375 ? Ssl 0:23 /usr/bin/python /usr/bin/ubuntuone-storagefs /home/jkakar/.ubuntuone -o oauth_realm=https://ubuntuone.com,consumer_key=ubuntuone,consumer_secret=hammertime
 7396 ? Sl 2:55 /usr/bin/python /usr/bin/ubuntuone-oauth-login
23911 pts/3 S+ 0:00 grep ubuntu

Here's the versions of ubuntuone-related packages I've got
installed:

$ dpkg -l|grep ubuntuone
ii nautilus-ubuntuone 0.1~8.10-687-1 nautilus-ubuntuone is a nautilus extension f
ii ubuntuone-oauth-login 0.1~8.10-687-1 ubuntuone-oauth-login is a mechanism for aut
ii ubuntuone-storage-protocol 0.1~8.10-687-1 ubuntuone-storage-protocol is a network clie
ii ubuntuone-storagefs 0.3~8.10-687-1 ubuntuone-storagefs is a FUSE filesystem for

[Steve Alexander (stevea)]

This is why secrets that aren't really secret should have values like "public-token" or "not-a-secret", rather than the opaque but amusing "hammertime". :-)

[Elliot Murphy (statik)]

Thanks for the bug report! Consumer secret is a somewhat misleading term
from OAuth, we expect that it's not secret at all, especially since it's
an open source application.

Rodney is working on some changes that will probably remove this from
the ps output anyway though.

 status triaged
 assignee dobey

--
Elliot Murphy | https://launchpad.net/~statik/