Website feedback: Click to start video only works at the edges of the video, not the center (Firefox 110.0, MacOS)
Fixing this!
Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
21–30 of 124 posts
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#22How does the Kubernetes integration work? Can we specify a infisical secret to reference inside of a Kubernetes secret manifest yaml? Thanks.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#23Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…
Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#24Earlier quoted context omitted.
How does getting permission make you “able” to read secrets? It seems like maybe you can read everyone’s secrets but you’re promising not to.
Presumably the permissions switch is in the client rather than the server. It's true that you have to trust the client, but that's unavoidable.
Yeah that's correct.
The permissions switch can only be on the client because that's where sharing the vault key with Infisical by encrypting it under one of its public keys occurs.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#25Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…
Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.
OK. I'll stop looking now. However if you do require a security review then I would be happy to oblige.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#26Also, check out roadmap and let us know if you have any suggestions: https://www.notion.so/infisical/be2d2585a6694e40889b03aef96e...
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#27How does the Kubernetes integration work? Can we specify a infisical secret to reference inside of a Kubernetes secret manifest yaml? Thanks.
The Kubernetes integration allows you to periodically fetch secrets from an Infisical project and save them to a native Kubernetes secret. You simply specify the service token that should be used to retrieve the secrets from infisical and the operator handles the rest. Read more about it here! https://infisical.com/docs/integrations/platforms/kubernetes
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#28As soon as I see a product is open core, I immediately start wondering what critical features are going to be proprietary. I don't see this information immediately on your website- is there a page where you outline what features you plan to keep proprietary?
Right now most of the features are available under the MIT license. For example, absolutely all the integrations, CLI, API, etc are available like that. Basically, all the features that are needed by individuals and small teams will always stay completely free. Some of the features that we are thinking to make proprietary are audit logs, sso, role-based access controls. Would love to hear your thoughts on this, becau…
What you decide is "needed by individuals and small teams" is not always what an individual or small team actually needs. This makes the open core model extremely difficult to get right (I am not sure I know any examples of anyone who has continued to do it right for very long).
For example, I would love SSO for my homeserver, so that I can share secrets with my family. I would guess that my family is a "small team", but many open core products don't open source SSO features. Many small actual businesses would prefer SSO too, as juggling multiple logins is as much a pain for a small team member as it is for a member of a big team.
I appreciate any open source contribution even if it is missing features. I understand it can be difficult to sell a product that is 100% open source.
Even when I am implementing something for a larger organization, I always prefer to specify open source over open core.
I end up very rarely adopting any open core product due to missing features- and when I do, I am often spending money re-implementing the closed source features, and thus the money isn't there to pay the company for support. I don't know how common this approach is, I just know a lot of open core products get skipped by me because of limitations.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#29Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…
Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.
You open-sourced your code - isn't this scrutiny exactly what you would want to achieve? Alternatively, I would expect these reports to be reported via your issues tracker.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#30Earlier quoted context omitted.
Right now most of the features are available under the MIT license. For example, absolutely all the integrations, CLI, API, etc are available like that. Basically, all the features that are needed by individuals and small teams will always stay completely free. Some of the features that we are thinking to make proprietary are audit logs, sso, role-based access controls. Would love to hear your thoughts on this, becau…
What you decide is "needed by individuals and small teams" is not always what an individual or small team actually needs. This makes the open core model extremely difficult to get right (I am not sure I know any examples of anyone who has continued to do it right for very long). For example, I would love SSO for my homeserver, so that I can share secrets with my family. I would guess that my family is a "small team",…
Would you say GitLab didn't manage to keep it right over the period of many years?
I agree that it's very hard but that's also why we talk to our community and wee what they say about what features they need. I really happy hope that we can create a great open product for small teams and individuals over a long term too.