Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management • Hacker News Board

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#51

Post by ttldr » Tue, Mar 13, 2018, 2:14 AM UTC

danenania wrote: post #47

ttldr wrote: post #46

looks neat! would love to use something like this at work. with regards to the S3 fail-over, how do you manage per-account access/authz? source of fetch.go seems to indicate a single bucket is used for the fail-over: http://bit.ly/2p6ozyN do you create per-account restricted policies and somehow have the client assume a particular IAM role or do you just have a world-readable bucket and rely on PGP for secrecy? UPDAT…

Thanks for the feedback and for laying out your investigation :) I'd say it's pretty unfair to call a 20 char id 'security-by-obscurity', unless you want to call almost every username/password authentication mechanism the same. The id has vastly more entropy than the average password and is far beyond brute-forcible. Along the same lines, there are no known attacks that can break 2048 bit PGP with a sufficiently stro…

all fair points. and your product seems to be designed/documented/marketed with the notion of keeping the username (which is part of the ENVKEY) secret, so agreed that "security-by-obscurity" is unfair (coupled w/ massive ID space).

your product is very well designed, seems like a tremendous customer experience. best of luck; i hope you continue to grow

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#52

Post by jeffnappi » Tue, Mar 13, 2018, 2:52 AM UTC

If you're on AWS, I highly recommend taking a look at Chamber + Parameter Store for secret management. If you're not on AWS, EnvKey looks like a reasonable solution with ease of use. Just don't misplace the key!

https://github.com/segmentio/chamber/blob/master/README.md

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#53

Post by stevekemp » Tue, Mar 13, 2018, 3:59 AM UTC

danenania wrote: post #8

smgoller wrote: post #5

How would you compare EnvKey to something like HashiCorp's Vault?

I've been meaning to write up a comparison with Vault for the website. Simplicity is definitely the main differentiator. EnvKey is designed to "just work" from a developer's perspective, and to actually save time/boost productive instead of being an obstacle. There's no server setup or administration, and integration is just 1-2 lines of code and a single environment variable, vs. being a good amount of work with Vau…

I think it's a little weird and biased to imply that Hashicorp's vault needs special setup to manage development secrets.

Vault stores secrets. That's all it does. (Well it can also generate TLS certificates, handle AWS integration and more..) Once you have a vault instance adding a new secret takes seconds and the having an instance for development, and a second for production is trivial.

You can also prefer a single instance with more restrictions, logging, and similar.

* secret/$application/development/db_user * secret/$application/development/db_pass * secret/$application/development/db_host

vs

* secret/$application/production/db_user * secret/$application/production/db_pass * secret/$application/production/db_host

But the vault itself doesn't care about dev vs. prod. That's more an infrastracture question about which hosts can talk to it, etc.

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#54

Post by sametmax » Tue, Mar 13, 2018, 4:34 AM UTC

cyberferret wrote: post #29

We've been using EnvKey since nearly the first day it was launched, and it has really made key management for our project and team easier on a massive scale. Prior to that, we were looking at Vault or the AWS baked in key management solutions, but all of those were extremely tedious to set up and maintain. In total honesty, we migrated over to EnvKey within about 20 minutes (from over 30 secrets stored in server envi…

So when EnvKey fails or is under attack, you lost access (or give away MITM) to all your infra ?

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#55

Post by leesalminen » Tue, Mar 13, 2018, 4:40 AM UTC

danenania wrote: post #49

CaveTech wrote: post #33

Earlier quoted context omitted.

PHP has an execution model that's /really/ bad for per-process requests. Even attempting to grab the parent pid is probably not sufficient as you can have execution contexts with no parent (ex: running php from cron). On linux you can get the master process through posix-getppid ( http://php.net/manual/en/function.posix-getppid.php ) but this won't work on windows and has the same limitations as above. Have you thoug…

> Have you thought about having a linux daemon/agent that runs in the background and keeps the ENV in sync? Yes, though I think it's also important to give developers control of when their config reloads, since surprises here can be dangerous.

I think having a daemon running on the OS that only syncs with an explicit ‘service envkey reload’ would work well.

If running php with nginx (via php-fpm), it’s still common for worker processes to come and go rather frequently. Imo, per-request pricing just won’t work well with php.

I would love to use your product, btw. Congratulations on launch.

-php dev

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#56

Post by danenania » Tue, Mar 13, 2018, 5:36 AM UTC

stevekemp wrote: post #53

danenania wrote: post #8

Earlier quoted context omitted.

I've been meaning to write up a comparison with Vault for the website. Simplicity is definitely the main differentiator. EnvKey is designed to "just work" from a developer's perspective, and to actually save time/boost productive instead of being an obstacle. There's no server setup or administration, and integration is just 1-2 lines of code and a single environment variable, vs. being a good amount of work with Vau…

I think it's a little weird and biased to imply that Hashicorp's vault needs special setup to manage development secrets. Vault stores secrets. That's all it does. (Well it can also generate TLS certificates, handle AWS integration and more..) Once you have a vault instance adding a new secret takes seconds and the having an instance for development, and a second for production is trivial. You can also prefer a singl…

Fair enough. My point is just that getting it working smoothly with a development workflow is another task that likely won't be trivial.

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#57

Post by gingerlime » Tue, Mar 13, 2018, 7:20 AM UTC

danenania wrote: post #48

gingerlime wrote: post #40

Earlier quoted context omitted.

> I'm sure they're reasonable about upgrading and/or paying for additional usage if you go over the limits. I certainly hope so, but we've been bitten by surcharges before when we had a mini-DoS on our system... Besides that, there's a big element of trust here. I'm going to trust these guys with my most important secrets. I expect a trustworthy, transparent and simple solution that doesn't surprise me. Pricing is an…

Thanks for laying out your concerns. Is your feeling that any sort of usage-based tiers that go beyond per-user pricing are too complex? Or is there some way to limit usage in a reasonable way that wouldn't rub you the wrong way?

Just to clarify, I truly believe it's in your interest to make pricing simpler. It just helps building trust, and conveys the same product simplicity. This is key (no pun intended) with this kind of service.

Specifically, I think per-developer pricing should correlate well with value. Sharing secrets increases in complexity when more people are involved.

One other thing I can think of perhaps is environments. Maybe bigger customers would have more environments that need to be kept separately? (production, staging, test, dev come to mind, but potentially a more granular split in larger orgs. Billing environment, Marketing etc). Maybe you could offer totally separate accounts that are independent of each other, but billed together. Keeping things separate also has security value.

Servers: it gets much more messy much quicker in my opinion. Docker-based setups, auto-scaling groups etc make this difficult. So this reduces pricing predictability for us, and I imagine others.

Config requests: I don't even have a clue what this means before I start. But seeing this deters me. You explain it on the FAQ section, but I still have to do some homework to figure out roughly my usage, before I even try your product... This is the worse pricing element in my humble opinion.

In any case, I'm just one data point. If you have enough traffic, then you should A/B test this. Otherwise, talk to your customers (although then there's selection bias at play), or copy from someone else with a similar service?

At your early stage, I think building momentum and traction is more important than worrying about outliers. You have many more years to refine pricing and figure out how not to lose money and attract the right customers. But now you should probably get as many customers as possible to see that it's a viable business and build a reputation. Just my 2 cents.

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#58

Post by ipfaffy » Tue, Mar 13, 2018, 4:47 PM UTC

sametmax wrote: post #54

cyberferret wrote: post #29

We've been using EnvKey since nearly the first day it was launched, and it has really made key management for our project and team easier on a massive scale. Prior to that, we were looking at Vault or the AWS baked in key management solutions, but all of those were extremely tedious to set up and maintain. In total honesty, we migrated over to EnvKey within about 20 minutes (from over 30 secrets stored in server envi…

So when EnvKey fails or is under attack, you lost access (or give away MITM) to all your infra ?

This is the key to me. This tech would make life easier, but what happens when there is an outage or they get hacked or $reason?

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#59

Post by topraman » Tue, Mar 13, 2018, 5:39 PM UTC

sametmax wrote: post #54

cyberferret wrote: post #29

We've been using EnvKey since nearly the first day it was launched, and it has really made key management for our project and team easier on a massive scale. Prior to that, we were looking at Vault or the AWS baked in key management solutions, but all of those were extremely tedious to set up and maintain. In total honesty, we migrated over to EnvKey within about 20 minutes (from over 30 secrets stored in server envi…

So when EnvKey fails or is under attack, you lost access (or give away MITM) to all your infra ?

this

Re: Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

#60

Post by danenania » Wed, Mar 14, 2018, 6:54 AM UTC

sametmax wrote: post #54

cyberferret wrote: post #29

We've been using EnvKey since nearly the first day it was launched, and it has really made key management for our project and team easier on a massive scale. Prior to that, we were looking at Vault or the AWS baked in key management solutions, but all of those were extremely tedious to set up and maintain. In total honesty, we migrated over to EnvKey within about 20 minutes (from over 30 secrets stored in server envi…

So when EnvKey fails or is under attack, you lost access (or give away MITM) to all your infra ?

This is of course a legitimate concern, but it's also one that is addressed in EnvKey's design. Client-side encryption means that even if we are attacked, no sensitive data will be exposed. And we have a failover to S3 so that you won't lose access if the service goes down.

Storing config and secrets obviously requires trust, but at the same time, many other services that developers use without a second thought actually require a lot more trust than EnvKey does.