Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Infisical – open-source secrets manager

github.com

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Show HN: Infisical – open-source secrets manager

#91

Post by segudev »

POPOSYS wrote: post #87
vmatsiiako wrote: post #36

Earlier quoted context omitted.

This is always a very heated discussion topic :) We started developing Infisical for the majority of people using environment variables right now. We actually have some plans for accommodating for other more secure approaches very soon. Stay tuned. Feel free to join our Slack for any updates: https://join.slack.com/t/infisical-users/shared_invite/zt-1k...

Sorry, there is no heated discussion, the issues are very clear and using ENV is a thing of the past, a bad practice that should not be propagated. Simple.

I'm afraid I have to disagree. There are so many different needs it is impossible to discredit them so simply. I recommend that readers take inspiration from this model of maturity to see more clearly: https://www.gitguardian.com/files/secrets-management-maturit...

Re: Show HN: Infisical – open-source secrets manager

#92

Post by ponytech »

vmatsiiako wrote: post #54
ponytech wrote: post #51

Is there an API to programmatically retrieve secrets or is it CLI only? On a previous project I used the HVAC python library to get secrets from Vault and configure a Django project. (thus not using env vars at all) It would be nice to be able to do the same with Infisical.

This is something that we are actively thinking about actually! It's currently CLI only. API's definitely quite a lot of work, but it's probably worth it. Could you please create an issue for it here: https://github.com/Infisical/infisical/issues This way, you can stay updated about when it's ready. Thank you!

Done https://github.com/Infisical/infisical/issues/138

Re: Show HN: Infisical – open-source secrets manager

#93

Post by vmatsiiako »

encryptluks2 wrote: post #77
vmatsiiako wrote: post #74

Earlier quoted context omitted.

Thank you for the feedback! Would you be able to provide a list? Then, I can easily tell you what differentiates us from them in a meaningful way. So far, we haven't found any alternatives that would have the same vision as Infisical :)

There is vaultwarden, gopass, Vault, SOPS, Conjur, dotenv, etc.

Well, without pointing fingers:

- some of these don't have a Web UI at all - which I think is very important

- some of these don't have integrations with 3rd party services

- some of these are only compatible with JS

- some of these are just so complicated so you need at least a week to figure them out :)

Re: Show HN: Infisical – open-source secrets manager

#94

Post by idealmedtech »

IncRnd wrote: post #90
idealmedtech wrote: post #55

Earlier quoted context omitted.

This is my problem with key management; at some point you have to have some sort of bespoke key management strategy for the key manager itself . I've yet to find a satisfactorily clear and modern way to accomplish this securely.

It's not that complex, and many products and approaches handle this properly. Keep the key out of band with the secrets. Never keep the secrets in an unencrypted form. Keying material can be composed of or accessed by what you know, what you have, and what you are. Don't store the key anywhere, either by protecting the key with a kek, shared secrets, or any one of many other workable models. In some cases private key…

But how do you protect the shared secrets? Do you see my point? I wish there was some sort of industry best practice tool or book for modelling your threats and suggesting an architecture.

Re: Show HN: Infisical – open-source secrets manager

#96

Post by bearzdev »

vmatsiiako wrote: post #44
bearzdev wrote: post #39

Earlier quoted context omitted.

Has anyone on staff been through a soc audit? Which trust criteria will be used? Does the app support data stores other than mongo?

Yes, we're quite familiar with SOC guidelines. We will be including all of Security, Confidentiality, Privacy, Availability, and Processing integrity categories into the SOC 2 examination. I think, given that Infisical is a secret-manager, all of these are very important! Currently, we only support Mongo, although we received requests for some other ones. Which one are you interested in?

SQLite/filesystem and etcd or some kind of distributed store.

The SQLite and fs option would get you usage in Homelabs.

That's a heavy order for the SOC 2, especially if you're just starting out as a company.

Imho, it's more important that the code base is audited and the company is transparent.

Re: Show HN: Infisical – open-source secrets manager

#97

Post by IncRnd »

idealmedtech wrote: post #94
IncRnd wrote: post #90

Earlier quoted context omitted.

It's not that complex, and many products and approaches handle this properly. Keep the key out of band with the secrets. Never keep the secrets in an unencrypted form. Keying material can be composed of or accessed by what you know, what you have, and what you are. Don't store the key anywhere, either by protecting the key with a kek, shared secrets, or any one of many other workable models. In some cases private key…

But how do you protect the shared secrets? Do you see my point? I wish there was some sort of industry best practice tool or book for modelling your threats and suggesting an architecture.

I gave you the overarching theory and one specific method in my comment to which you replied. PS The shared secrets I mentioned were not in that context symmetric keys but split keys.

A tool will never solve a security problem by creating an optimal design. That requires someone with security knowledge. There are threat modeling tools that can help but only when the tools are used as designed.

Re: Show HN: Infisical – open-source secrets manager

#98

Post by encryptluks2 »

vmatsiiako wrote: post #93
encryptluks2 wrote: post #77

Earlier quoted context omitted.

There is vaultwarden, gopass, Vault, SOPS, Conjur, dotenv, etc.

Well, without pointing fingers: - some of these don't have a Web UI at all - which I think is very important - some of these don't have integrations with 3rd party services - some of these are only compatible with JS - some of these are just so complicated so you need at least a week to figure them out :)

> Well, without pointing fingers: - some of these don't have a Web UI at all - which I think is very important

Why?

> some of these don't have integrations with 3rd party services

Like?

> some of these are only compatible with JS

What do you mean only compatible with JS?

> some of these are just so complicated so you need at least a week to figure them out :)

You could say the same about anything. So you want users to just trust yours but have to figure everyone elses out? If they had to understand yours from a more fundamental perspective I'd imagine yours would take just as long.

Re: Show HN: Infisical – open-source secrets manager

#99

Post by jd_mongodb »

linuxdude314 wrote: post #56
vmatsiiako wrote: post #44

Earlier quoted context omitted.

Yes, we're quite familiar with SOC guidelines. We will be including all of Security, Confidentiality, Privacy, Availability, and Processing integrity categories into the SOC 2 examination. I think, given that Infisical is a secret-manager, all of these are very important! Currently, we only support Mongo, although we received requests for some other ones. Which one are you interested in?

Almost any other standard database would be a better choice: Postgres, MySQL, even Redis. Most companies avoid using MongoDb and lack the staff needed to administer it properly. It’s also hard to find a managed solution for Mongo in most cloud providers.

MongoDB provides MongoDB Atlas, our own managed service. which is supported on every cloud (AWS, Azure, GCP).
Post reply on HN