Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Infisical – open-source secrets manager

github.com

Post reply on HN
Print view View original

1–10 of 99 posts

Show HN: Infisical – open-source secrets manager

#1

Post by vmatsiiako »

Last month, we open-sourced Infisical (https://github.com/Infisical/infisical) - a simple, end-to-end encrypted tool to sync environment variables across your team and infrastructure. You can use it to store environment variables and inject them into your applications locally or into CI/CD and production infrastructure. It can be used with any language/framework and is platform independent with a super easy setup.

We know secret managers exist but, in our experience, they’re too complicated, not comprehensive, not user-friendly, or a mix of all three — other nicer ones are closed-source and don’t have self-hosted options available. That’s why we’re on a mission to make secret management more accessible to every developer — not just security teams.

We’ve launched this repo under the MIT license so any developer can use the tool. The goal is to not charge individual developers. We make money by charging a license fee for some future enterprise features as well as providing a hosted version and support.

In the coming weeks, we plan to add features like key rotation, access logs + more integrations. We’d love to hear your thoughts and any feature requests!

Give it a try (https://github.com/Infisical/infisical), and let us know what you think!

Main website: https://infisical.com/

Show HN: Infisical – open-source secrets manager
github.com

Re: Show HN: Infisical – open-source secrets manager

#5

Post by vmatsiiako »

vorpalhex wrote: post #3

It looks like part of your plan is to charge for premium plugins. How do you intend to react to open source clones of such plugins?

Actually not! Most of the integrations are going to be completely free. Only a few very-enterprise integrations that are not needed for individual developers or small teams will be paid. We intend to earn money from some advanced compliance and security enterprise features while providing a service to small developer teams for free.

Re: Show HN: Infisical – open-source secrets manager

#6

Post by vmatsiiako »

candiddevmike wrote: post #4

Obligatory how does this compare to Vault or Conjur?

The main goal is to provide similar levels of security at a reduced learning curve.

While Hashicorp Vault has a lot of features, I found it to be quite overwhelming... We created Infisical to take a modern approach to secret management by simplifying the whole process of configuring secrets and injecting them into your stack with the least friction possible.

We also invested a lot of effort in the UI/UX in order to make everything more intuitive for developers when compared to Vault or Conjur. Plus, we have a handful of features in store for the future that Vault does not have yet! You should try and let me know what you think

Re: Show HN: Infisical – open-source secrets manager

#7

Post by jbotz »

Environment variables are not a good way to pass secrets around. For a list of reasons see this 2017 blog post: https://blog.diogomonica.com//2017/03/27/why-you-shouldnt-us...

The TLDR is, first environment variables are visible to every process running as the same user on the system (try 'ps eww') and second they leak very easily in debug logs, etc.

Re: Show HN: Infisical – open-source secrets manager

#8

Post by gregwebs »

This looks great! But after looking through the docs and Github, I don't know what the architecture is beyond there is a CLI and a browser UI that interact with some sort of central service.

The main thing stopping me from using Vault is that it can become a central point of failure. If the cloud provider secret managers are down then its likely that something else in the cloud is having major issues as well so from an uptime perspective and easy of operations that has always seemed a safe approach, although the pricing is kind of outrageous. But just storing (e2e encrypted, etc) in cloud object storage is also an option. Berglass for example gives the option of storing in the secret manager or in cloud storage directly: https://github.com/GoogleCloudPlatform/berglas

Post reply on HN