That would work too, if we know that openssl is always available. Not sure
we can assume that though? Could always chain $RANDOM if we just want more
bits.

Also, does it matter if the token is the same for every execution? I don't
think having tokens reset on restart is a bad thing, in which case I'd say
generate it when the bash_profile executes, and not when we're writing it.

On Saturday, April 19, 2014 1:48:35 AM, Victor Koronen <
notifications@github.com> wrote:

> In docs/VPS.md:
>
> > @@ -89,6 +89,7 @@ Stringer uses environment variables to determine information about your database
> >      echo 'export STRINGER_DATABASE_USERNAME="stringer"' >> $HOME/.bash_profile
> >      echo 'export STRINGER_DATABASE_PASSWORD="EDIT_ME"' >> $HOME/.bash_profile
> >      echo 'export RACK_ENV="production"' >> $HOME/.bash_profile
> > +    echo 'export SECRET_TOKEN="$$$RANDOM"` >> $HOME/.bash_profile
>
> I agree that using a randomized token is better that using the default,
> but I think $RANDOM is too short and we would probably be better off
> leveraging openssl like we do for Heroku<https://github.com/swanson/stringer/blob/master/README.md#installation>
> .
>
> echo "export SECRET_TOKEN=`openssl rand -hex 20`" >> $HOME/.bash_profile
>
> --
> Reply to this email directly or view it on GitHub<https://github.com/swanson/stringer/pull/311/files#r11793002>
> .
>