Viewing profile — cipherboy

Vault has had PKI since pre-v1; ACME was introduced in 2022 to modernize its APIs.

I'll bite ;-) Appreciate your replies as always tptacek! It is a fair criticism. But I think two things give us an advantage here: 1. IBM started this fork and later bought HashiCo…

Yes and https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-aut... was an earlier authN+authZ bypass in the same code block. So maybe one step down in severity, though I do no…

Since HashiCorp and OP did not opt to disclose to OpenBao, the most authoritative source right now is HashiCorp's security tracker, linked down-thread: https://news.ycombinator.com…

To quote a movie, only a Sith deals in absolutes ;-) The OpenBao community call is in 10 minutes if you want to talk more about it live: https://calendar.google.com/calendar/embed?…

OpenBao, under the Linux Foundation's OpenSSF, is making meaningful improvements to the code. I'd love to have high-quality reports, if you're willing to re-visit these. :-)

I do not speak for HashiCorp, but they have published information on this CVE here: https://discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enu... OpenBao is reasonably confident …

For anyone interested in CVE-2025-6010: https://discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enu...

On behalf of the OpenBao project, I welcome collaboration with future researchers. We were not informed of these vulnerabilities before HashiCorp posted their usual CVE bulletins, …

Dupe of https://news.ycombinator.com/item?id=44276916

While I'm sure Vault contracts run more than what I'd care to know, the project is set up under the Linux Foundation and I've been told in the past that we as a project are capable…

Not without community involvement :-) Horizontal scalability and disaster recovery is one of the next larger features on our mind. We won't use the architecture of Performance Seco…

Yes, implemented from scratch by the community but (mostly--barring one reported issue) the same functionality and behavior. Not storage-level compatible, we (likely?) made differe…

You should read this RFC: https://github.com/openbao/openbao/issues/1340 If you use that with a PostgreSQL backend (which doesn't require raft and has faster leader changes), it mi…

It is a secrets manager; I think it's a fair question. Very few individuals will want to run them, the reality is they're mostly for businesses to consume. Businesses need maintena…

Definitely. It's why I've been pushing for open governance and slowly building community's trust in additional maintainers to avoid burnout and ensure continuity. You can see maint…

Nice! The biggest gap with Vault Enterprise that I'm hoping we'll get to next release will be horizontal scalability of read requests. We should be fairly compatible otherwise! Our…

AWS plugins are released separately: https://github.com/openbao/openbao-plugins/releases

Yes, a big thank you to you, Jan, in particular! The organization has been slowly building trust in more committers and maintainers and so he's had to personally review many a pull…

If you have reproducers for behavioral differences, happy to take issues and PRs! (Entities was discussed here: https://github.com/openbao/openbao/issues/1110#issuecomment-... ) Ri…

GitHub's charts are inaccurate and a quick glance at the commit list would tell you that: https://github.com/openbao/openbao/commits/main/ -- you have to cross some threshhold numb…