Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 150 posts

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#71

Post by dang »

quinndiggity wrote: post #69

Wait wait wait, and this is paid and hosted too? Bleh, nooooo thanks. I'm not sending private and secret key material to a bunch of ex-Uber employees (gross on that point alone), but nevermind to ones who looked at the existing market, didn't understand the tool-scape, and essentially decided to roll their own crypto...

Whoa, please don't be a jerk in response to other people's work on HN. It's fine if you don't like it, and it's certainly fine if you have substantive criticism. But it's not fine to put down others, or their work; internet cultures can easily turn in that direction and we're hoping to avoid that here.

The Show HN guidelines (which also apply to Launch HNs) have a few things to say about this: https://news.ycombinator.com/showhn.html, and of course the site guidelines do also: https://news.ycombinator.com/newsguidelines.html.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#73

Post by kbyatnal »

rgmvisser wrote: post #59
kbyatnal wrote: post #53

This is very neat - my favorite part so far is being able to synchronize local .env across all developers instantly. We currently use 1Password as a hacky solution for this, which is a bit of a pain. I saw the demo video which looks great - one question though, how does this work with Heroku add-ons? If you configure Heroku Postgres for example, a DATABASE_URL env var gets automatically added. This variable can chang…

I am glad you asked! I built the Heroku integration at Doppler. We are doing a one way syncing as we believe Doppler should be the single source of truth for your secrets. However, we know that addons & attachments are an important part of Heroku, so we make sure we never overwrite any of the addons/attachments env vars. Those continue to live within Heroku as they wouldn't make much sense or be useful outside of tha…

Got it, thanks for sharing that! I just got local development setup via Doppler and it was a breeze.

"dev": "doppler run -- nodemon --exec \"heroku local\" --signal SIGTERM"

For managing our production secrets, we're obviously a bit more hesitant to give those over to an additional third party. Heroku secrets management works well for us, so I think we will continue to use that for now. But for managing development secrets, this is perfect.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#74

Post by adriaanmulder »

tompic823 wrote: post #2

Tom here from Doppler. I'm a founding engineer at Doppler and work on most of our security. Feel free to hit me with any security questions about our product, philosophy, etc.

Hey Tom! I see in the security section it says "We secure your data at rest through a mechanism called tokenization, which ensures our systems only store references to your secrets. In the event of a data breach, attackers would only gain access to the references." If this is the case, then where are the secrets stored? How can you view the secrets from the web console if they aren't stored anywhere? Thanks!

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#75

Post by quinndiggity »

dang wrote: post #71
quinndiggity wrote: post #69

Wait wait wait, and this is paid and hosted too? Bleh, nooooo thanks. I'm not sending private and secret key material to a bunch of ex-Uber employees (gross on that point alone), but nevermind to ones who looked at the existing market, didn't understand the tool-scape, and essentially decided to roll their own crypto...

Whoa, please don't be a jerk in response to other people's work on HN. It's fine if you don't like it, and it's certainly fine if you have substantive criticism. But it's not fine to put down others, or their work; internet cultures can easily turn in that direction and we're hoping to avoid that here. The Show HN guidelines (which also apply to Launch HNs) have a few things to say about this: https://news.ycombinato…

Understood, and yes my comment was harsh, perhaps a bit much so

However `Enterprise tools like HashiCorp Vault and AWS Parameter Store felt like we were stuck using FTP instead of Dropbox!` is in itself bashing other peoples' work, and misleading prospective users.

It's not alright to mislead people, and the trends over the years of new engineers without a ton of experience looking at a battle-hardened, vetted system with their one specific use case and no understanding of the endless numbers of refinements that resulted in the predominant solution that solves more problems and edge cases than just their partially understood use case, is... why we have shit like this coming out of Apple (for example)

https://lapcatsoftware.com/articles/macl.html

Despite being a millennial, I can't help but agree with this sentiment:

> When I try to list the contents of the Documents folder in Terminal, I get a permissions dialog, because Millennials are killing Unix.

Understand _why_ things are done the way they are before you write them off as inferior and re-invent the wheel, otherwise you'll simply discover all the things you didn't understand previously, and create effectively the same solution, only poorly implemented and without all the vetting and refinement that went into what was already there before you came and "did it better".

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#76

Post by chrisacky »

Is the primary use-case only for configuration secrets?

Would it be suitable for a use-case where we manage (hypothetically) 400~ API keys, secrets, usernames etc for different use-cases. Our main application would need to be able to grab the secrets for APIs which run periodically.

I'm guessing Vault is more suited for this.. and not Doppler?

PS. My very last post on HN last week was about secrets: https://news.ycombinator.com/item?id=24625934

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#77

Post by bvallelunga »

chrisacky wrote: post #76

Is the primary use-case only for configuration secrets? Would it be suitable for a use-case where we manage (hypothetically) 400~ API keys, secrets, usernames etc for different use-cases. Our main application would need to be able to grab the secrets for APIs which run periodically. I'm guessing Vault is more suited for this.. and not Doppler? PS. My very last post on HN last week was about secrets: https://news.ycom…

This is the exact use case that Doppler was built for! Doppler is designed to store API keys, secrets, config vars, etc. Depending on your setup (monolith vs microservices), you can group these into one project or many. From there you can fetch all your secrets in one call.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#78

Post by incognos »

danenania wrote: post #63
tompic823 wrote: post #57

Earlier quoted context omitted.

Server access is an interesting scenario to explore. If we're considering an attacker gaining server access, what's to stop that attacker from shipping a modified EnvKey binary that steals your customers' secrets and their encryption keys? If the security of your binary is predicated on GitHub repo access, what happens in the event of GitHub account takeover? At some point, no system is infallible, and I think our Th…

The private certificates that sign our binaries are tightly controlled and not accessible to our servers or our GitHub accounts, so the scenario you're describing could only happen if an attacker compromised our Github account and our private signing certs (gaining access to our back end servers wouldn't help an attacker at all). Of course, no system is invulnerable to any attack. But in practice, Doppler's architect…

Although the approaches are different, they both address a security need for all developers. For EnvKey it would be nice if you address the freelancer/single user Marketing tin some way - $20 a month for 5 users is a bit pricey for 1 user. Is that something you are considering?

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#79

Post by stimur »

kbyatnal wrote: post #53

This is very neat - my favorite part so far is being able to synchronize local .env across all developers instantly. We currently use 1Password as a hacky solution for this, which is a bit of a pain. I saw the demo video which looks great - one question though, how does this work with Heroku add-ons? If you configure Heroku Postgres for example, a DATABASE_URL env var gets automatically added. This variable can chang…

you can do similar things with 1Password CLI.

Here is short example: https://github.com/stumyp/ope

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#80

Post by quinndiggity »

qchris wrote: post #46
tompic823 wrote: post #2

Tom here from Doppler. I'm a founding engineer at Doppler and work on most of our security. Feel free to hit me with any security questions about our product, philosophy, etc.

Hi, congrats on the launch! Potentially a little off topic, but I'm curious how you came up with the name Doppler. After the audio effect, or the Witcher creature, or something else entirely?

It is a re-use/pivot of a name for a previous project from Brian that didn't take off:

``` Show HN: Doppler – Machine learning marketplace of pretrained models (producthunt.com) - 6 points by bvallelunga on Apr 25, 2018 | 1 comment ```

It's a cool name for sure, but after perusing the founder of this project's blog posts and other web activity, their highly misleading marketing ("you have three options: waste time, don't even try, or pay us!" https://doppler.com/blog/build-vs-manual-vs-buy | "we recreated what these specific competitors which are already established made; they sucked, you don't want to use them, take our word for it and pay us instead of looking for yourself!" https://news.ycombinator.com/item?id=24719722 ) I question their morals.

Substantive criticism: your marketing needs not be slinging mud, and referencing specific established players in your marketing material in order to give false credibility that you are a one-for-one replacement is a shady practice. I looked at your post solely because it contrasted itself from your competitors claiming superiority, and was disappointed by all of the above AND that the fact that it couldn't do the things it claimed to by making those contrasts.

All in all, disappointed to see a ycombinator funded project hoisted on HN with all the above going on, and one with a large number of investors behind it and no open source to back up their claims. This isn't just a community built tool to improve developers' lives, this is a marketing push by a corporation with the intent to get a burst of customers with misleading/questionable marketing.

Post reply on HN