71–80 of 99 posts
Earlier quoted context omitted.
Thank you. I wasn't asking whether the product could do that through integrations but whether it operates insecurely by default.
Infisical is secure by default :) It really depends on how you set it up. If you prefer, you can choose to split non-sensitive environment variables and sensitive secrets into different projects - and use them for different purposes / in different ways.
Earlier quoted context omitted.
The main goal is to provide similar levels of security at a reduced learning curve. While Hashicorp Vault has a lot of features, I found it to be quite overwhelming... We created Infisical to take a modern approach to secret management by simplifying the whole process of configuring secrets and injecting them into your stack with the least friction possible. We also invested a lot of effort in the UI/UX in order to m…
It doesn’t provide even remotely close to the same level of security as Vault because of how it’s designed with environment variables in mind. The lack of an API means if they want to add secret injection without env vars, you will be launching a CLI command in a thread or subprocess as opposed to using a native library. There is something to be said about creating a secret manager that is easier to use than vault, b…
Environment variables are not a good way to pass secrets around. For a list of reasons see this 2017 blog post: https://blog.diogomonica.com//2017/03/27/why-you-shouldnt-us... The TLDR is, first environment variables are visible to every process running as the same user on the system (try 'ps eww') and second they leak very easily in debug logs, etc.
Environment variables are not a good way to pass secrets around. For a list of reasons see this 2017 blog post: https://blog.diogomonica.com//2017/03/27/why-you-shouldnt-us... The TLDR is, first environment variables are visible to every process running as the same user on the system (try 'ps eww') and second they leak very easily in debug logs, etc.
I'm just as critical as anyone else in this space, but several popular Docker images do this and it is on the software not the management solution to enact best practices. However, as noted this software is sort of designed to accommodate those bad practices and I can give you a list of open source alternatives in this space with more security options so I don't think they are going to be able to compete well with ot…
Earlier quoted context omitted.
The main goal is to provide similar levels of security at a reduced learning curve. While Hashicorp Vault has a lot of features, I found it to be quite overwhelming... We created Infisical to take a modern approach to secret management by simplifying the whole process of configuring secrets and injecting them into your stack with the least friction possible. We also invested a lot of effort in the UI/UX in order to m…
It doesn’t provide even remotely close to the same level of security as Vault because of how it’s designed with environment variables in mind. The lack of an API means if they want to add secret injection without env vars, you will be launching a CLI command in a thread or subprocess as opposed to using a native library. There is something to be said about creating a secret manager that is easier to use than vault, b…
Not sure what you mean by "lack of an API" here as well as in other parts of this thread where you allude to the CLI connecting directly to MongoDB (it would be a terrible design choice if that was the case). Infisical does have a backend API with endpoint protection that the CLI pulls secrets from (you can inspect it yourself at the repo) — It just isn't publicly documented for folks to write their own clients for (we have this on our roadmap so do look out for it).
As mentioned though, Infisical is still new and in public alpha. We've put a lot of thought into security including our choice of cryptography and end-to-end encryption; there are certainly areas that can be fortified and those will be addressed. Check in on us a few months from now and we'll have something pretty compelling :)
Is there an API to programmatically retrieve secrets or is it CLI only? On a previous project I used the HVAC python library to get secrets from Vault and configure a Django project. (thus not using env vars at all) It would be nice to be able to do the same with Infisical.
There is a backend API (that the web UI and CLI connect to) but it's not yet publicly documented. We've wanted to do that for a while now but have just been swamped with requests for features honestly — It's just a matter of time :)
Would love to keep you updated with the progress of that over at our Slack community!
Earlier quoted context omitted.
I'm just as critical as anyone else in this space, but several popular Docker images do this and it is on the software not the management solution to enact best practices. However, as noted this software is sort of designed to accommodate those bad practices and I can give you a list of open source alternatives in this space with more security options so I don't think they are going to be able to compete well with ot…
Thank you for the feedback! Would you be able to provide a list? Then, I can easily tell you what differentiates us from them in a meaningful way. So far, we haven't found any alternatives that would have the same vision as Infisical :)
Is there an API to programmatically retrieve secrets or is it CLI only? On a previous project I used the HVAC python library to get secrets from Vault and configure a Django project. (thus not using env vars at all) It would be nice to be able to do the same with Infisical.
Hello! There is a backend API (that the web UI and CLI connect to) but it's not yet publicly documented. We've wanted to do that for a while now but have just been swamped with requests for features honestly — It's just a matter of time :) Would love to keep you updated with the progress of that over at our Slack community!
Earlier quoted context omitted.
Hello! There is a backend API (that the web UI and CLI connect to) but it's not yet publicly documented. We've wanted to do that for a while now but have just been swamped with requests for features honestly — It's just a matter of time :) Would love to keep you updated with the progress of that over at our Slack community!
Love this project but, please, give us a way to use it without the CLI. Not really keen on having the CLI on my package.json