Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Infisical – open-source secrets manager for developers

infisical.com

Post reply on HN
Print view View original

11–20 of 32 posts

Re: Show HN: Infisical – open-source secrets manager for developers

#11

Post by vmatsiiako »

rubenfiszel wrote: post #9

I saw your post a few months ago and already thought it was awesome. Congrats on quitting your job to devote yourself to this project. I would assume that you have considered joining YC? I'm the founder of the OSS project windmill [1] that, among others, separates the code logic from the management of secrets. We are in the same boat of being a small team doing too many features and hence have covered very lightly th…

Thank you for your kind words! Yes, we have joined the YC W23 batch :)

You’ll be surprised but I actually heard a lot about windmill - would love to talk! I sent you a LinkedIn invite

Re: Show HN: Infisical – open-source secrets manager for developers

#12

Post by vmatsiiako »

lucideer wrote: post #10
iLoveOncall wrote: post #7

With such a huge load of new features in such a short lapse of time, I wonder about the quality of the code. I quickly glanced at the GitHub repository and basically couldn't find any test for example. It'd be fine for any other startup, but this is something hosting seriously sensitive data and I feel like the focus is not right. Any considerations about security you can share?

> Any considerations about security The copy on their website is somewhat non-committal on this: > Infisical uses end-to-end encryption (E2EE) whenever possible [...] it makes no security guarantees for malicious events that can occur beyond its control [...] we do our best to maintain platform privacy and security [...] we will be adding more opt-in security measures > > -- https://infisical.com/docs/security/overvi…

Thank you so much for this!

I agree with all of your points. This phrasing is just something we need to write for legal reasons - if you check vault, you will see that they have similar words in their TOS.

We are currently still in public alpha - with time, Infisical will become more stable and the security measure taken will only improve from here on! As we mentioned earlier, we do want to go through the security and compliance audits this year.

We will be working on reducing the number of dependencies - stay tuned!

If you are interested, please join our Slack community to stay updated: https://join.slack.com/t/infisical-users/shared_invite/zt-1k...

Re: Show HN: Infisical – open-source secrets manager for developers

#13

Post by Aeolun »

vmatsiiako wrote: post #8
iLoveOncall wrote: post #7

With such a huge load of new features in such a short lapse of time, I wonder about the quality of the code. I quickly glanced at the GitHub repository and basically couldn't find any test for example. It'd be fine for any other startup, but this is something hosting seriously sensitive data and I feel like the focus is not right. Any considerations about security you can share?

I would say the quantity of the features does not mean that their quality is bad. We are very grateful to our open-source community for helping us out with many of these features (e.g., custom environment names were developed fully by one of our contributors Akhi - https://github.com/akhilmhdh ). Quality of the code is something that we care about increasingly more as we go further. We currently have a huge frontend…

> Tests are also something that we are going to add very soon!

Famous last words.

I used to say this for years before we finally got around to it, but at that point it had become such a chore (and the team so used to not writing them) that it took much longer than necessary to add any.

Start while you still can.

Re: Show HN: Infisical – open-source secrets manager for developers

#14

Post by MollyRealized »

In this context, what does the noun (secrets manager) and adjective (secret versioning) mean? Asking for purposes of learning. If this is laid out on a particular "for dummies" page, linkage would be appreciated ('secrets' being such a common word otherwise).

I asked ChatGPT, but this appeared to be one of its "there-is-no-horsehead-in-Godfather" moments.

Re: Show HN: Infisical – open-source secrets manager for developers

#15

Post by vmatsiiako »

MollyRealized wrote: post #14

In this context, what does the noun (secrets manager) and adjective (secret versioning) mean? Asking for purposes of learning. If this is laid out on a particular "for dummies" page, linkage would be appreciated ('secrets' being such a common word otherwise). I asked ChatGPT, but this appeared to be one of its "there-is-no-horsehead-in-Godfather" moments.

Yeah! It's not a common term - just something that we call it

Secret can technically be any piece of information (e.g., API-key, credential). Though it may also include some non-sensitive data like environment variables

Secret versioning is a feature which tells you how the secret was changed over time (you can think of it as google docs history); it also tells which user it was modified by

Re: Show HN: Infisical – open-source secrets manager for developers

#16

Post by ComputerGuru »

Congrats on the launch.

For anyone looking for an open source community project without business aspirations in a much simpler and easier to audit format, have a look at SecureStore. It's encrypted and versioned secrets stored alongside your code in your git repo. Cross-language, cross-platform, with native libraries for different languages/frameworks. Useable by teams big and small, up until the point you want a standalone, full-fledged secrets management server and are fine with adding that heavy network dependency to all your services.

https://neosmart.net/blog/tag/securestore/

Re: Show HN: Infisical – open-source secrets manager for developers

#17

Post by franky47 »

Slight typo in https://infisical.com/docs/security/overview: x2519-xsalsa20-poly1305 should be x25519-xsalsa20-poly1305 (PR submitted).

You mention password-based encryption of user private keys, do you have more information on how it's done? I can think of a famous "secret manager" that got this very wrong recently.

Also, when you have the time, consider adding a security.txt [1] to your main website so security researchers know how to report vulnerabilities.

[1] https://securitytxt.org/

Re: Show HN: Infisical – open-source secrets manager for developers

#18

Post by vmatsiiako »

ComputerGuru wrote: post #16

Congrats on the launch. For anyone looking for an open source community project without business aspirations in a much simpler and easier to audit format, have a look at SecureStore. It's encrypted and versioned secrets stored alongside your code in your git repo. Cross-language, cross-platform, with native libraries for different languages/frameworks. Useable by teams big and small, up until the point you want a sta…

Infisical's goal is to provide the main functionality to the community for free - only enterprise-level features will be paid.

Frankly speaking, I don't believe in open-source projects without paid components (and this can be in different ways) - there have been so many examples of rug pulls for full FOSS just because maintainers are tired of running the project and there is no money to support it.

Post reply on HN