Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#31

Post by dangtony98 »

ianpurton wrote: post #11

Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…

Ack. Thanks for the points. Un-packing a few things:

3. Definitely — We're working to cut our dependencies in the coming months. Most existing dependencies (the backend at least - I focus more on this area) we stick to those widely used and those essential to the platform; there're also certain dependencies directly linked to integrations with third-party platforms (e.g. AWS, Octokit - GitHub, etc.).

4. We'll definitely take a look at this — This is on our immediate roadmap as well. We had a few ideas in mind related to a mix of components in browser-memory, session-storage, etc. as well but wanted to make sure we get it 100% right before deploying any changes - based on recommended practices like from Auth0. This article may be relevant: https://auth0.com/docs/secure/security-guidance/data-securit...

5. We actually did evaluate both PKDF2 and Argon2id options in addition to seeing what other secure platforms are doing. We found most to start out with PKDF2 but overtime to introduce support for Argon2id — Take Bitwarden and Dashlane as two examples of this; Bitwarden of which introduced it as of only a few months back. This article may help: https://soatok.blog/2022/12/29/what-we-do-in-the-etc-shadow-...

The choice of Argon2id KDF is sound and recommended; we have it with memory cost of 64MiB, ops cost of 3, and parallelism of 1.

6. argon2-browser is still used well and reliably throughout the ecosystem — take Bitwarden as the biggest example of a solution recently making the switch to use it.

Anyways, happy to move this discussion to email!

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#32

Post by camjw »

vmatsiiako wrote: post #23
ianpurton wrote: post #11

Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…

Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.

> sounds more like an ad for your project

I feel like somehow your response is the opposite of an ad for your project.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#33

Post by dangtony98 »

sveme wrote: post #29
vmatsiiako wrote: post #23

Earlier quoted context omitted.

Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.

You open-sourced your code - isn't this scrutiny exactly what you would want to achieve? Alternatively, I would expect these reports to be reported via your issues tracker.

Yup!

We appreciate feedback we can get across all aspects including security but employ a security policy of reporting any security concerns via email - this is pretty standard practice we've seen.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#34

Post by debarshri »

vmatsiiako wrote: post #7
Terretta wrote: post #5

OK, aside from "open source", and assuming clients will be comparing paid enterprise to paid enterprise, how would you describe your value prop relative to Doppler?

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

Open source is a distribution strategy. Dont forget cyberark, thycotic et al in the enterprise space. They have super strong sales motion in the JP Morgans of the world.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#35

Post by ensignavenger »

vmatsiiako wrote: post #30
ensignavenger wrote: post #28

Earlier quoted context omitted.

What you decide is "needed by individuals and small teams" is not always what an individual or small team actually needs. This makes the open core model extremely difficult to get right (I am not sure I know any examples of anyone who has continued to do it right for very long). For example, I would love SSO for my homeserver, so that I can share secrets with my family. I would guess that my family is a "small team",…

Would you say GitLab didn't manage to keep it right over the period of many years? I agree that it's very hard but that's also why we talk to our community and wee what they say about what features they need. I really happy hope that we can create a great open product for small teams and individuals over a long term too.

Actually, Gitlab used to be my go-to example of "Open Core done right", but now they have so many closed source features mixed in with open source features it is hard to use the open source product at all. I am either looking for a smaller product with fewer features anyway, or a product with more features (like maybe Gitlab tries to be) and the ones I want are the ones Gitlab happens to keep proprietary!

Ultimately, small teams often have the same challenges large teams have. I wish you great luck!

PS

At some point you might want to do product comparisons on you site- one of you competitors, Hashicorp does a pretty good job of outlining the similarities and differences as they see it with similiar options, I would suggest following their example. Even if Hashicorp ultimately adds a comparison with your product, having your own perspective is very helpful in making a quick comparison.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#37

Post by vmatsiiako »

warp wrote: post #15

I thought there were a bunch of dead links on the page, but looking closer it's actually the "Star us on GitHub" banner extending some invisible element to the bottom of the page and blocking certain elements from being clicked on. (Firefox 111 on mac).

Just fixed this! Thank you!

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#39

Post by vmatsiiako »

log101 wrote: post #38

Not related but who or what tool designs these "startup pages"? I need it for my own work.

I designed it actually :)

Happy to help if you have any questions! It's a combination of Next.js + Tailwind + Figma. Oh, and we also use Framer Motion for animations on the landing page.

I also get a lot of inspiration on Dribbble.com

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#40

Post by dangtony98 »

debarshri wrote: post #34
vmatsiiako wrote: post #7

Earlier quoted context omitted.

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

Open source is a distribution strategy. Dont forget cyberark, thycotic et al in the enterprise space. They have super strong sales motion in the JP Morgans of the world.

Open source is a lot to unpack haha — There's a ton there but yea I think giving the ability for people to self-host the solution is a really important in our mission to increase access to secret management tools to all developers.

Infisical is already pretty easy to self-host but we want it to be even easier — Likely by introducing a 1-click deploy to Heroku/Digital Ocean for folks that need that.

And yea ack with the enterprise space solutions you mentioned. We've a long way to go as a secret manager but I have hopes that one day we'll get to a world-class product that's as good and better!

Post reply on HN