Live data from Hacker News

Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

v2.envkey.com

41–50 of 67 posts

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#41
Initially, I was pretty thoroughly perplexed by what this actually did since all I did was click the original link and didn't even see this post text. I figured it out through mostly the 2017 link above. I have a pretty good idea now and see its value.

That being said, when looking at your actual website initially with no context, I couldn't really figure out what it did. My first instinct was to hit the "Docs" button.

The "Don't README" header and the just download my code and run it and figure out how it works later mantra with regard to an end-to-end encryption software (or software in general) was very off-putting to me. I actually wasn't very interested in figuring out what your software did at that point, as it just was flashing red-flag in my head. Was it malware? Was it really end-to-end encrypted?

Just a suggestion, you might want to reword some of that front landing page of the Docs page. I understand your wanting to convey that it "just works", but you might want to convey a bit better somehow what exactly what is just working in the first place, and do so in a way that isn't screaming "don't try to figure out how it's working". Maybe also advertise a bit more clearly that it's open source.

The whole "unless you really want to" is a little weird, too. Every end-to-end encryption software you use you should understand fully what encryption is being used, especially when targeting developers handling core secrets for major organizations or what have you.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#43

Eyeing Business Cloud: How do you recommend to store the server key?

It depends on the platform you're using, but basically wherever you would store your secrets currently (API keys, database credentials, etc.) is where you should store your server ENVKEY.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#44
post #8

How does this compare to Doppler[1]? Is there a way to handle the configuration in Terraform? [1] https://www.doppler.com/

I've met the Doppler founders and greatly respect them (even played some poker with them!). Doppler has great design and UX. That said, I'd say the key difference is that EnvKey places much more emphasis on security and privacy. Doppler is cloud-hosted and doesn't use end-to-end encryption, so it requires that you trust them to keep your data safe and not make any mistakes in their data security, network security, wh…

Co-founder/CTO of Doppler here. I'd agree that Doppler currently focuses very heavily on UX. We aim to fit into developer workflows, regardless of where devs run their code. This includes local development (macOS/Windows/Linux), CI/CD, Kubernetes, Vercel, and just about anywhere else. We've found that security tools that are difficult to use end up being worked around by developers, which ultimately decreases an org's security posture (see HashiCorp Vault). This does come with some tradeoffs- specifically that you must trust Doppler with your secrets, given our tokenization model[0].

We do recognize that the current security tradeoffs of Doppler aren't going to satisfy everyone. For Enterprises, we offer Enterprise Key Management (EKM), which allows orgs to encrypt their secrets using a cloud KMS. Of course, this still doesn't satisfy every concern. And so, for customers requiring additional security guarantees, stay tuned!

[0] https://docs.doppler.com/docs/security-fact-sheet

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#45

Initially, I was pretty thoroughly perplexed by what this actually did since all I did was click the original link and didn't even see this post text. I figured it out through mostly the 2017 link above. I have a pretty good idea now and see its value. That being said, when looking at your actual website initially with no context, I couldn't really figure out what it did. My first instinct was to hit the "Docs" butto…

Thanks for your feedback! I'm sorry that the intro in the docs rubbed you the wrong way. I wanted to make sure people realize that it's not a complicated tool that requires a lot of setup or research to start using, and I guess to have a little fun too, but perhaps the tone is not quite right. I'll try to improve this.

Edit: what do you think now that I've removed the (probably misguided) playful language in the headings? https://docs-v2.envkey.com/docs Better?

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#46

Earlier quoted context omitted.

The process management code lives here: https://github.com/envkey/envkey/blob/main/public/sdks/envke... Basically, on unix systems, the command you pass in to envkey-source is run via: exec.Command("sh", "-c", c) (c is the command you passed as a string.) Stdout/stderr is piped through, and .Wait() is called on the command. If envkey-source is in watch mode, it will send a SIGTERM when the environment is updated, the…

In the short term you could just tell people to use your 'eval' approach, and punt on the issue. :) Looking at your code, what's missing is a SIGCHLD handler. Basically, your code doesn't know when one of its children dies. You're making an assumption that you know how many children you currently have, based on how many you spawned; but this is misleading due to PID1 semantics re: orphaned processes. SIGCHLD lets you…

Thank you. This comment sums up why I love HN! We will improve this ASAP.

Is there somewhere I can ping you once we make the changes? Would be great to be sure we haven't missed anything in your estimation.

Edit: made an issue to track this: https://github.com/envkey/envkey/issues/3

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#48

Initially, I was pretty thoroughly perplexed by what this actually did since all I did was click the original link and didn't even see this post text. I figured it out through mostly the 2017 link above. I have a pretty good idea now and see its value. That being said, when looking at your actual website initially with no context, I couldn't really figure out what it did. My first instinct was to hit the "Docs" butto…

Thanks for your feedback! I'm sorry that the intro in the docs rubbed you the wrong way. I wanted to make sure people realize that it's not a complicated tool that requires a lot of setup or research to start using, and I guess to have a little fun too, but perhaps the tone is not quite right. I'll try to improve this. Edit: what do you think now that I've removed the (probably misguided) playful language in the head…

Yeah that's a lot better. Don't get me wrong, I love playfulness, especially in documentation. It's just that before you even really know what a product is or does it seemed like it was worded like "don't even try to figure out what we are doing here and execute untrusted code" or something, haha.

I totally understood what you were trying to do, I just think if I interpreted it that way at first, others might as well. I at least had your other stuff to go off of to eventually get me to figure it out, whereas people encountering your page on the internet wouldn't. Was just trying to help :)

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#49

Earlier quoted context omitted.

Thanks for your feedback! I'm sorry that the intro in the docs rubbed you the wrong way. I wanted to make sure people realize that it's not a complicated tool that requires a lot of setup or research to start using, and I guess to have a little fun too, but perhaps the tone is not quite right. I'll try to improve this. Edit: what do you think now that I've removed the (probably misguided) playful language in the head…

Yeah that's a lot better. Don't get me wrong, I love playfulness, especially in documentation. It's just that before you even really know what a product is or does it seemed like it was worded like "don't even try to figure out what we are doing here and execute untrusted code" or something, haha. I totally understood what you were trying to do, I just think if I interpreted it that way at first, others might as well…

Thanks! You're absolutely right that if you had that impression, others likely would as well, and there's not much to gain from it--the same information can be conveyed in a more fitting tone. Thanks again, I really appreciate it!

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#50
post #47

Are there any local equivalents to this, where I can store project environment variables in something like libsecret ?

You can get programatic access to keypass databases. Not sure if there's out of the box support though.
Post reply on HN