21–30 of 99 posts
Ahhh, a self-hosting option. I might actually take a look at it! I'm so tired of systems handling highly-confidential information (such as passwords and secrets material) being Cloud-only. Or even cloud-first.
Is this like an open-source version of Doppler? Love Doppler.
See the page for Vault: https://www.hashicorp.com/vault-compliance
Or 1Password: https://support.1password.com/security-assessments/
As the comment from jbotz mentioned, exposing secrets in environment variables seems like a major issue and it would be one of the first points covered in such an audit.
This looks great! But after looking through the docs and Github, I don't know what the architecture is beyond there is a CLI and a browser UI that interact with some sort of central service. The main thing stopping me from using Vault is that it can become a central point of failure. If the cloud provider secret managers are down then its likely that something else in the cloud is having major issues as well so from…
Thank you! Besides the CLI and browser UI, we also support a range of integrations (we're still working on this but you can already see some of them in the Integrations section of our ReadMe: https://github.com/Infisical/infisical ; or here in docs: https://infisical.com/docs/integrations/overview ). With that, you can auto-inject your secrets into those 3-rd party services. You can also inject your secrets into Kube…
How do I stay up to date on developments for the AWS/GCP integration?
HN Title: Infisical – open-source secrets manager
Github text: Infisical is an open-source, end-to-end
encrypted tool to sync environment variables across
your team and infrastructure.
Earlier quoted context omitted.
Thank you! Besides the CLI and browser UI, we also support a range of integrations (we're still working on this but you can already see some of them in the Integrations section of our ReadMe: https://github.com/Infisical/infisical ; or here in docs: https://infisical.com/docs/integrations/overview ). With that, you can auto-inject your secrets into those 3-rd party services. You can also inject your secrets into Kube…
I see. Some of the integrations, such as K8s would offload the downtime to k8s itself so then it wouldn't be much of a problem (other than alerting if the secret sync is broken). How do I stay up to date on developments for the AWS/GCP integration?
Environment variables are not a good way to pass secrets around. For a list of reasons see this 2017 blog post: https://blog.diogomonica.com//2017/03/27/why-you-shouldnt-us... The TLDR is, first environment variables are visible to every process running as the same user on the system (try 'ps eww') and second they leak very easily in debug logs, etc.
That is considered better, but there are still potential attack vectors such as directory traversal. More secure yet is to have the application decrypt the secret in memory.
HN Title: Infisical – open-source secrets manager Github text: Infisical is an open-source, end-to-end encrypted tool to sync environment variables across your team and infrastructure. Which does it do? Does it manage secrets, or does it sync environment variables?
Infisical is designed to be both easy and efficient enough to store any environment variables, but also secure and end-to-end encrypted to store secrets.