61–70 of 150 posts
What are your thoughts on Secrethub? https://secrethub.io
Comparing FTP and Dropbox to Doppler and Vault; there are several logical fallacies in their marketing material.
https://yourlogicalfallacyis.com/anecdotal
I'll take Vault+Nomad+Consul, because I'd rather run Nextcloud than use Dropbox, kthx
Seriously though, if you can't market your product on its merits alone, don't try to misrepresent your competition.
Earlier quoted context omitted.
Hey there! I completely agree with you on the tradeoffs between UX and security when it comes to end-to-end encryption. It's a tricky balance to get right, and I think it's great that there are multiple approaches out there in the market. People should weigh their own unique needs and comfort level when making the choice. That said, a Content Security Policy doesn't actually address the issue I'm raising, because an…
Server access is an interesting scenario to explore. If we're considering an attacker gaining server access, what's to stop that attacker from shipping a modified EnvKey binary that steals your customers' secrets and their encryption keys? If the security of your binary is predicated on GitHub repo access, what happens in the event of GitHub account takeover? At some point, no system is infallible, and I think our Th…
Of course, no system is invulnerable to any attack. But in practice, Doppler's architecture implies a much larger degree of trust (any server breach = secrets compromised) than EnvKey's (servers can be fully breached and secrets still aren't compromised). Doppler looks like a great product in many other ways, but I do think it's important for users to fully understand the risks they're taking.
Earlier quoted context omitted.
Vault is definitely much more of a beast, but it also does a lot more, such as dynamic credentials. For just storing static secret/env vars this seems like a simpler solution.
Great point about dynamic secrets. This is an area we currently don't address, but it is definitely on our roadmap. There is a segment of the market for which dynamic secrets are an absolute requirement and we fully acknowledge that.
You lost the entire audience who have actually used Vault before when you claimed it was too complex for your team to understand.. Why would I trust a company staffed with a crew that can't even understand the tools they are trying to compete with
Earlier quoted context omitted.
A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.
how does that actually work? Vault has the user/password, and then acts as a gateway to the db?
It's incredibly simple, and a breeze to use.
``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = edit: thanks HN formatting
This looks neat. Do you have any plans to provide a Kubernetes CRD or something else to pull/sync secrets into pods?
Earlier quoted context omitted.
how does that actually work? Vault has the user/password, and then acts as a gateway to the db?
It looks like this https://www.nomadproject.io/docs/integrations/vault-integrat... It's incredibly simple, and a breeze to use. ``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = edit: thanks HN formatting
Can do all sorts of great things with this; for example TLS (ssl) certificate renewals, etc, as the certificate expiry IS the TTL; when a certificate needs to be renewed it can happen automatically and your application can receive any signal you choose (SIGHUP, for example)