Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 150 posts

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#121

Post by bvallelunga »

rswail wrote: post #119
tompic823 wrote: post #104

Earlier quoted context omitted.

Thanks for pointing this out, you're absolutely right. I'm linking to our Security page[0] and our security docs[1] below, but we'll definitely be updating our marketing site to place more of an emphasis on this. I hope the rest of this post and our comments here illustrate that trust and security are things we think a lot about, despite our oversight with the landing page. [0] https://doppler.com/security [1] https:…

Are you planning external compliance certification similar to AWS [1]? In particular the PCI/DSS world requires underlying auditing and compliance of infrastructure components. [1] https://aws.amazon.com/compliance/programs/

Similar to AWS we plan to get extensive external compliance certifications starting with SOC 2. We are currently in our first audit cycle and plan to expand into other compliances there after. Truthfully we are still evaluating which compliances to get next (PCII, ISO, etc) based on customer demand.

We also do frequent pentests to help vet our infrastructure and security posture.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#122

Post by bvallelunga »

gervwyk wrote: post #120
bvallelunga wrote: post #117

Earlier quoted context omitted.

We built it using Webflow (an amazing YC company!) and used the Timber template as the foundation: https://webflow.com/templates/html/timber-ui-kit-website-tem... One thing we strived for during the design phase was to make it feel like a tool you would want to use. From the colors to the bold fonts and large screenshots. I personally was inspired by what Stripe and Slack did, take a traditionally "unsexy" space and…

Great job on the landing page and congrats on the launch! Definitely addressing a real pain with this! One question, how did you do the cli / typing text animation? Also in webflow?

Thank you! In Webflow you can use HTML Embed components. In there I wrote some javascript to type out each character.

I put a Gist that has all the code but fair warning it is pretty hacky as I made it over a weekend for fun. I definitely wouldn't treat this code as "high quality" code. https://gist.github.com/bvallelunga/6846593ca50500f058a1f07f...

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#123

Post by gervwyk »

bvallelunga wrote: post #122
gervwyk wrote: post #120

Earlier quoted context omitted.

Great job on the landing page and congrats on the launch! Definitely addressing a real pain with this! One question, how did you do the cli / typing text animation? Also in webflow?

Thank you! In Webflow you can use HTML Embed components. In there I wrote some javascript to type out each character. I put a Gist that has all the code but fair warning it is pretty hacky as I made it over a weekend for fun. I definitely wouldn't treat this code as "high quality" code. https://gist.github.com/bvallelunga/6846593ca50500f058a1f07f...

Ahh! This is great thanks!

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#124

Post by aliswe »

fimoreth wrote: post #6

Sounds interesting, but could you explain to me why I should use this over something like Azure KeyVault?

Ick, talk about different products fimoreth! Look at the 4min video. Keyvault could theoretically be a good datastore for the secrets, though.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#125

Post by rswail »

quinndiggity wrote: post #75
dang wrote: post #71

Earlier quoted context omitted.

Whoa, please don't be a jerk in response to other people's work on HN. It's fine if you don't like it, and it's certainly fine if you have substantive criticism. But it's not fine to put down others, or their work; internet cultures can easily turn in that direction and we're hoping to avoid that here. The Show HN guidelines (which also apply to Launch HNs) have a few things to say about this: https://news.ycombinato…

Understood, and yes my comment was harsh, perhaps a bit much so However `Enterprise tools like HashiCorp Vault and AWS Parameter Store felt like we were stuck using FTP instead of Dropbox!` is in itself bashing other peoples' work, and misleading prospective users. It's not alright to mislead people, and the trends over the years of new engineers without a ton of experience looking at a battle-hardened, vetted system…

Not to start a flamewar, but as a 35 year veteran, the permissions dialog is the same as what SELinux would give you. Apple are implementing an RBAC and require authentication and authorization on a per-app basis.

This is on top of their SEP and read only System volumes with secure boot. Leave aside the argument about system openness to modification, that is beyond Unix's security and permissions model.

Sure, Unix offers some of that with chmod and mount options, but it's hardly a comprehensive solution.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#126

Post by phist_mcgee »

kfrzcode wrote: post #96
neximo64 wrote: post #86

You have to give Doppler your secrets which is absolutely crazy. Is there a self hosted version? How does it fair against Vault? Vault is self hosted and open source. Does everyone in this thread know the founder or something? No one is asking these and they're in my view the absolutely most important questions.

I came here to find/make this comment - especially with secrets management, I don't want to rely on an external vendor being up to access/manage my secrets. I want full access. License the software, let me deploy and manage it.

That completely changes the kind of software that is being built, and would be a radical departure to their cloud based solution. Where do you store your secrets? AWS? GCP?

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#127

Post by jerrygoyal »

bvallelunga wrote: post #88
neximo64 wrote: post #86

You have to give Doppler your secrets which is absolutely crazy. Is there a self hosted version? How does it fair against Vault? Vault is self hosted and open source. Does everyone in this thread know the founder or something? No one is asking these and they're in my view the absolutely most important questions.

We realize that storing secrets requires trust and for some companies it may be outside of their comfort zone at the moment. We are currently focused on creating a super easy to use solution. An analogy: there are open source versions of Dropbox for users that don't trust Dropbox with their files (NextCloud, ownCloud, etc.), however this comes with the friction of having to host your own solution. We are more like Dr…

just thinking out loud.. isn't it a better solution if you implement e2e encryption with dashboard and cli like how password managers do? i mean it's secrets and as a company you also wouldn't want to get into any trouble. if user losses the password he can always disable old keys of respective services and generate new ones.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#128

Post by ricklamers »

llarsson wrote: post #58

I could not find anything about Terraform integration. That is something I bet many of your customers will need.

We're also building on Terraform so this kind of integration would be neat! How well are GitHub Actions supported? We've been dancing with secrets there too.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#129

Post by nicoburns »

jerrygoyal wrote: post #127
bvallelunga wrote: post #88

Earlier quoted context omitted.

We realize that storing secrets requires trust and for some companies it may be outside of their comfort zone at the moment. We are currently focused on creating a super easy to use solution. An analogy: there are open source versions of Dropbox for users that don't trust Dropbox with their files (NextCloud, ownCloud, etc.), however this comes with the friction of having to host your own solution. We are more like Dr…

just thinking out loud.. isn't it a better solution if you implement e2e encryption with dashboard and cli like how password managers do? i mean it's secrets and as a company you also wouldn't want to get into any trouble. if user losses the password he can always disable old keys of respective services and generate new ones.

Totally agree with this. I'd love a hosted solution for secret management, but e2e encryption seems like an absolute necessity.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#130

Post by edpichler »

bvallelunga wrote: post #88
neximo64 wrote: post #86

You have to give Doppler your secrets which is absolutely crazy. Is there a self hosted version? How does it fair against Vault? Vault is self hosted and open source. Does everyone in this thread know the founder or something? No one is asking these and they're in my view the absolutely most important questions.

We realize that storing secrets requires trust and for some companies it may be outside of their comfort zone at the moment. We are currently focused on creating a super easy to use solution. An analogy: there are open source versions of Dropbox for users that don't trust Dropbox with their files (NextCloud, ownCloud, etc.), however this comes with the friction of having to host your own solution. We are more like Dr…

That is a fair reason and I understand the target market you are aiming.
Post reply on HN