Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#41

Post by JoBrad »

vmatsiiako wrote: post #23
ianpurton wrote: post #11

Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…

Thank you for pointing this out! Happy to take a look and discuss what you're building! I agree with some of these tips, but I think it's best to report them privately to team@infisical.com. We can then see with our team if these points are correct. Otherwise, this goes against responsible practices of security notifications and sounds more like an ad for your project.

I took it as establishing credentials. They didn’t compare your project to their’s, and they offered helpful alternatives.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#43

Post by vmatsiiako »

corywatilo wrote: post #42
log101 wrote: post #38

Not related but who or what tool designs these "startup pages"? I need it for my own work.

Some of it was sourced from posthog.com

Indeed! Especially the idea for the Slider part. We love PostHog

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#45

Post by dangtony98 »

ensignavenger wrote: post #35
vmatsiiako wrote: post #30

Earlier quoted context omitted.

Would you say GitLab didn't manage to keep it right over the period of many years? I agree that it's very hard but that's also why we talk to our community and wee what they say about what features they need. I really happy hope that we can create a great open product for small teams and individuals over a long term too.

Actually, Gitlab used to be my go-to example of "Open Core done right", but now they have so many closed source features mixed in with open source features it is hard to use the open source product at all. I am either looking for a smaller product with fewer features anyway, or a product with more features (like maybe Gitlab tries to be) and the ones I want are the ones Gitlab happens to keep proprietary! Ultimately,…

I definitely share the concerns/thoughts around open core and keeping too many features closed source here; it's a very difficult thing for companies to figure out what the right balance is for public/closed-source features. There's never a correct balance that satisfies everyone but the best we can do is deliberate which features would be more individual/team-oriented and which would be more enterprise-oriented to be charged.

In terms of Infisical, this is honestly something we're still figuring out as we're mapping out our roadmap ahead — We try to get feedback from our community in thinking about this since we all contribute to the codebase (also do feel free to suggest what you think would be appropriate).

And yea thanks for the suggestion regarding product comparisons with competitors. We have that on the TODO list in addition to other tasks all related to enriching product information like providing more granular product pricing breakdowns!

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#46

Post by vmatsiiako »

s1k3s wrote: post #44

> All content that resides under any "ee/" directory of this repository, if such directories exists, are licensed under the license defined in "ee/LICENSE". Man I really hate how the term "Open Source" is used nowadays.

We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT.

ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, advanced access controls). This helps us get the financial means to also maintain the free ope-source product better.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#48

Post by vmatsiiako »

hekike wrote: post #47

This is awesome! So no more pbpaste | base64 | pbcopy with Kubernetes secrets? I won't miss base64 and yamls.

Indeed! You should check out out docs for Kubernetes here: https://infisical.com/docs/integrations/platforms/kubernetes

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#49

Post by mynameisvlad »

vmatsiiako wrote: post #14
candiddevmike wrote: post #10

Earlier quoted context omitted.

If being open source is such a big differentiator, why do you not reference it on your pricing page at all? https://infisical.com/pricing I really wish companies would stop using open source as a growth hack.

It is actually mentioned on the pricing page! (in one of the FAQ questions)

I wouldn’t exactly consider a mention in passing on a “What is Infisical” to be exactly headlining the fact that it’s open source.
Post reply on HN