Congrats to the Infisical Team! I was a first-time open source contributor thanks to this project and definitely could not have done that without the patience and guidance from the team.
Keep up the great work!
Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
111–120 of 124 posts
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#112Congrats to the Infisical Team! I was a first-time open source contributor thanks to this project and definitely could not have done that without the patience and guidance from the team. Keep up the great work!
Thank you so much! It wouldn’t have been possible without your contribution :)
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#113> All content that resides under any "ee/" directory of this repository, if such directories exists, are licensed under the license defined in "ee/LICENSE". Man I really hate how the term "Open Source" is used nowadays.
We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT. ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, adv…
I'm not a fan of monorepos in general (though I admit tool support them better in many cases*) but making people download proprietary code makes them worse.
* Especially GitHub. Very opinionated in favor of monorepos.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#114Earlier quoted context omitted.
Ack. Thanks for the points. Un-packing a few things: 3. Definitely — We're working to cut our dependencies in the coming months. Most existing dependencies (the backend at least - I focus more on this area) we stick to those widely used and those essential to the platform; there're also certain dependencies directly linked to integrations with third-party platforms (e.g. AWS, Octokit - GitHub, etc.). 4. We'll definit…
Check out https://socket.dev/ Been super impressed by their approach to identifying and securing codebases against supply chain attacks (and I believe they have a special deal for open source repos too!)
Just added it to my bookmarks — Will be checking it out thanks!
I wonder how this compares to Snyk, also in the area of securing against supply chain attacks.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#115Earlier quoted context omitted.
Thanks so much for this comment - very valuable insights. RE security: 100% agree with everything you said. This is at the end of the day a security product. Even though we're very early, we've put a ton of thought into the security and especially the cryptography behind our product (e.g. we decided E2EE since the start) and intend on maximizing security posture in the coming months and years ahead — earning trust wi…
+1 to providing SSO to smaller plans, hard requirement for me. I manage small teams and it would be a requirement for us, and if pricing for a few users is $14/month, normally enterprise is higher than that and an annual commitment, but you wouldn’t be able to get much budget out of me at this moment due to team size, but there is some there. When choosing tools like this, I pick ones I can grow with so I don’t need…
Mhm I'll definitely look over SSO and talk to the team about including it in the lower plans as it would definitely be useful for smaller teams as well.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#116Earlier quoted context omitted.
Audit logging and SSO is pretty basic functionality that requires very little (many people would argue no ) additional effort or cost to maintain on the development side.
Surprisingly, audit logging has been deceivingly complex for us. There are many types of events (part of logs) triggered throughout the platform carrying different payloads/formats (e.g. events related to secrets, users, etc.). The variation in such events is increasing with the complexity of the product not to mention costs required to handle accumulating events. Last month, we served 14.2M+ secrets alone through th…
I know we (WorkOS) have already chatted with you about SSO, but reading this comment I'm realizing we should really also chat about Audit Logs too.
We recently built an entire product to make it insanely easy to offer enterprise-grade audit logs to your customers. Plus it includes strongly-typed event payload schemas and log streaming to 3rd-party SIEM vendors. Super fast to integrated with pay-as-you-go pricing based on volume. Vercel and others are using this.
I think we have a shared Slack channel set up with Infisical so feel free to DM me there. You can also email me direct: mg@workos.com. (Same goes for anyone else on HN needing this stuff. :))
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#117Earlier quoted context omitted.
We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT. ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, adv…
Audit logging and SSO is pretty basic functionality that requires very little (many people would argue no ) additional effort or cost to maintain on the development side.
The cost to maintain and develop SSO has nothing to do with why it's priced the way it is (very few things in our industry are priced strictly according to cost). SSO costs extra because it's one of the most effective market segmentation tools: the people that require SSO in order to use things are generally (though not exclusively) price-insensitive.
This upsets people, but the larger companies that pay the SSO premium are subsidizing the smaller companies who don't care. I'd rather not pay an SSO tax either, but I'm even less excited about using tools from companies that are going to vanish because they're not generating revenue.
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#118Earlier quoted context omitted.
We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT. ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, adv…
https://sso.tax/
In other words: this product is employing a pricing strategy that is overwhelmingly common in our industry (because it works).
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#119Hey there, I wanted to offer you some unsolicited advice. You're building a security product, so you have an uphill battle ahead of you. There is a reason security engineers get paid more than any other engineer, and why security companies can charge more -- because security is fraught with peril and just a single mistake can ruin your company/career. You need to show that you are extremely competent at security -- m…
> There is a reason security engineers get paid more than any other engineer
dubious claim
Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
#120Minor bug: after execution of `infisical init` the resulting `.infisical.json` is executable on macOS:
black:worker egor$ ls -l .infisical.json -rwxr-xr-x 1 egor staff 122 Feb 28 11:19 .infisical.json*
(While minor, it's still a glaringly obvious thing, I wonder how could that have been missed by your devs)