Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

Post by xs83 » Mon, Feb 27, 2023, 9:25 PM UTC

Post by vmatsiiako » Mon, Feb 27, 2023, 9:30 PM UTC

xs83 wrote: post #91

I don't see Terraform in your docs? Is it hidden away somewhere or not fully supported?

Post by plasma » Mon, Feb 27, 2023, 9:54 PM UTC

dangtony98 wrote: post #75

jedberg wrote: post #72

Hey there, I wanted to offer you some unsolicited advice. You're building a security product, so you have an uphill battle ahead of you. There is a reason security engineers get paid more than any other engineer, and why security companies can charge more -- because security is fraught with peril and just a single mistake can ruin your company/career. You need to show that you are extremely competent at security -- m…

Thanks so much for this comment - very valuable insights. RE security: 100% agree with everything you said. This is at the end of the day a security product. Even though we're very early, we've put a ton of thought into the security and especially the cryptography behind our product (e.g. we decided E2EE since the start) and intend on maximizing security posture in the coming months and years ahead — earning trust wi…

Post by ianpurton » Mon, Feb 27, 2023, 10:08 PM UTC

chromatin wrote: post #96

ianpurton wrote: post #11

Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak A few tips. 1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible. 2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down. 3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain a…

Feedback on Cloak: The javascript for the sign-up form doesn't activate the password-strength meter unless ther are keypresses in the primary (not verify) password box. This means when using Firefox auto-suggest strong password, we have to go type and then remove characters from the box to proceed.

Post by nicce » Mon, Feb 27, 2023, 10:13 PM UTC

mynameisvlad wrote: post #52

ensignavenger wrote: post #35

Earlier quoted context omitted.

Actually, Gitlab used to be my go-to example of "Open Core done right", but now they have so many closed source features mixed in with open source features it is hard to use the open source product at all. I am either looking for a smaller product with fewer features anyway, or a product with more features (like maybe Gitlab tries to be) and the ones I want are the ones Gitlab happens to keep proprietary! Ultimately,…

I will definitely echo everything said here. Gitlab used to be an amazing example of doing it right but nowadays looking at their release notes, they sprinkle in one or two free features while the vast majority are locked away. They do sometimes give the peasants access to the features months or years later, but the majority of features are still locked away.