Mix.Shell.IO, prompt, and security

Don’t know how to turn off echo’ing offhand, but I know the hex.publish takes a password that it immediately deletes as it is typed, maybe take a look at it’s code?

I discovered that there is an undocumented function :io.get_password() that reads input from the shell without echoing it and returns a password. That seems to be what I need ([erlang-questions] Getting a password from escript / I/O server introduction)

My code now reads:

    username = Mix.Shell.IO.prompt("username:")
    IO.write("password: ")
    password = :io.get_password()

For others looking to this solution, read the rest of the thread. This was a solution for me in one context, but may not be general purpose solution.

Unless you are developing something to integrate with mix, you should not use it. It is usually not included in production builds and will probably fail then.

Unless you are developing something to integrate with mix, you should not
use it. It is usually not included in production builds

“usually not” based on what? It seems to be in my production builds.

Then you either have mix mentioned in your (extra_)applications-list, or you are running you generated application on a machine that has elixir installed.

Then you either have mix mentioned in your (extra_)applications-list,

Nope.

are running you generated application on a machine that has elixir
installed.

“Elixir” or Erlang? It’s present on a system without Elixir but with
Erlang installed, but – I thought the whole point of a release was to
use the bundled version.

Just search the forum, there are plenty of threads because mix is not available in production or release. Its always suggested to not rely on mix when not in build time.

So if you have a proper release and access to mix, its probably a bug, so could you please explain how you built and run the release?

Just search the forum, there are plenty of threads because mix is not
available in production or release. Its always suggested to not rely on mix
when not in build time.

Who is talking about mix?!

The OP mentioned finding an undocumented function :io.get_password()
and you responded with:

“It is usually not included in production builds…”

So maybe in the future be more specific what you mean by “it”?

The OP… The subject… The code example…

Or do you want to say, that Mix.Shell.IO is not part of mix?

Also I said:

All “it”s are clearly refering to mix that I mentioned in the very same paragraph. Nothing there seems to be related to :io-module.

The OP… The subject… The code example…

You didn’t reply to the first post, but to the one that starts out
mentioning finding the :io.get_password() function.

All “it”s are clearly refering to mix that I mentioned in the very same
paragraph.

They definitely weren’t “clearly” referring to Mix from my reading, or
I wouldn’t have had the question I did.

And if we replace “it” in your statement with “mix”,

Unless you are developing something to integrate with mix, you
should not use mix.

That doesn’t seem meaningful to me