Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Infisical – open-source secret management platform

infisical.com

Post reply on HN
Print view View original

41–50 of 59 posts

Re: Show HN: Infisical – open-source secret management platform

#41

Post by Maidul98 »

nodesocket wrote: post #38

Very cool and congrats on the launch. Can you perhaps talk about pros/cons of using your Kubernetes operator vs 1Password Connect[1]? Seems like your operator would require writing some new CRDs where I believe 1Password Connect continues to use the existing kind: Secret. I believe it's possible to self-host Infisical server correct? Thus eliminating the external public requests and dependency on 1Password. [1] https…

Thank you! And for one password you will need to create a kind called `OnePasswordItem` as described here https://github.com/1Password/onepassword-operator. This is similar to the `InfisicalSecret` you need to create with us https://infisical.com/docs/integrations/platforms/kubernetes

Re: Show HN: Infisical – open-source secret management platform

#42

Post by teddyh »

vmatsiiako wrote: post #34
majkinetor wrote: post #33

How is this open source if we have limits with on premise installations?

There is no limits for the usage of any open source feature. There are limits for some enterprise-level features. The fact that there are some features behind the license doesn't make the rest of the codebase less "open source" Read this interesting blog by Sid from GitLab about this: https://opencoreventures.com/blog/2023-07-open-core-is-misun...

So it isn’t all open source, but instead open core.

Re: Show HN: Infisical – open-source secret management platform

#44

Post by yjftsjthsd-h »

mousetree wrote: post #37
iLoveOncall wrote: post #36

And still no tests in your codebase. This is absolutely ridiculous when it has been brought up in every past Show HN that you've done. I really really hope nobody is reckless enough to use a completely untested platform to manage secrets.

There are tests: https://github.com/Infisical/infisical/blob/main/backend/tes... /s

... What did I just read? (But seriously, why would you ever have a file of what looks like at least some sort of tests but literally every line commented out?)

Re: Show HN: Infisical – open-source secret management platform

#45

Post by yjftsjthsd-h »

zie wrote: post #40
vmatsiiako wrote: post #8

Earlier quoted context omitted.

The main goal is to create an all-in-one secret management platform that targets developers and not just platform/security engineers (following the security shift left). Infisical is one platform where you can securely store your secrets, automatically sync them to 3rd party tools, continuously monitor code and prevent secret leaks, etc. We have more exciting features coming very soon. On top of that, we heard over a…

> On top of that, we heard over and over again that HCP Vault is too complicated for developers to set up and maintain. WOW! I'm shocked, it's a single go binary and it has been ridiculously easy (I've been running it in production for years now). I've never tried your product, as I've been happily using vault for a long time now. If I ever have to move off of vault for some reason, I'll give your stuff a try though.…

Er, installing Vault isn't the hard part; using it is. I suspect some of that is just complexity inherent to the problem space, though.

Re: Show HN: Infisical – open-source secret management platform

#46

Post by AOsborn »

teddyh wrote: post #42
vmatsiiako wrote: post #34

Earlier quoted context omitted.

There is no limits for the usage of any open source feature. There are limits for some enterprise-level features. The fact that there are some features behind the license doesn't make the rest of the codebase less "open source" Read this interesting blog by Sid from GitLab about this: https://opencoreventures.com/blog/2023-07-open-core-is-misun...

So it isn’t all open source, but instead open core.

The offering by OP is a fairly common and accepted structure, and this seems like an unwarranted nitpick?

Another org with a similar offering is Elastic, who offer Elasticsearch as a "Free and Open, Distributed, RESTful Search Engine" per the Github repo. No-one is going to be complaining that they don't offer their full platform under an open source license.

Offering a self-hosted version of your core product with an appropriate license is standard fare.

Re: Show HN: Infisical – open-source secret management platform

#47

Post by NobleLie »

yjftsjthsd-h wrote: post #44
mousetree wrote: post #37

Earlier quoted context omitted.

There are tests: https://github.com/Infisical/infisical/blob/main/backend/tes... /s

... What did I just read? (But seriously, why would you ever have a file of what looks like at least some sort of tests but literally every line commented out?)

Because they theoretically worked at some point but now they do not.

Re: Show HN: Infisical – open-source secret management platform

#48

Post by tough »

vmatsiiako wrote: post #17
quickco wrote: post #16

Looks like a great platform, congrats! Have you gotten feedback on the name, Infisical? If a user is at a conference or on an online meeting and they mention your company to another user, they will likely have to spell the name out. Just hearing the name, it would be hard to know how to spell/search for it. It is also not very memorable. A month later if I wanted to recall the name of your company I would likely have…

Yeah, we actually get feedback about this pretty often. At this point (because Infisical is used by many thousands of developers), it might hurt more in terms of recognition, SEO, etc. Some companies do it when they are much more advanced (Fb -> Meta, Square -> Block) but I think it requires a large marketing investment. To make it easier to find us, we have purchased a number of other domains like http://inphysical.…

If you have VC money secret or secrets.com might be worth it

Re: Show HN: Infisical – open-source secret management platform

#49

Post by rmbyrro »

iLoveOncall wrote: post #36

And still no tests in your codebase. This is absolutely ridiculous when it has been brought up in every past Show HN that you've done. I really really hope nobody is reckless enough to use a completely untested platform to manage secrets.

I was wondering whether this project is safe to trust my secrets. Thanks for saving me time.

Besides, a challenge with secrets is hardware. Storing them on ordinary EC2 instances or else is insecure. That's why AWS Secrets, for example, use specialized hardware that are hardened for this use case.

Re: Show HN: Infisical – open-source secret management platform

#50

Post by teddyh »

AOsborn wrote: post #46
teddyh wrote: post #42

Earlier quoted context omitted.

So it isn’t all open source, but instead open core.

The offering by OP is a fairly common and accepted structure, and this seems like an unwarranted nitpick? Another org with a similar offering is Elastic, who offer Elasticsearch as a "Free and Open, Distributed, RESTful Search Engine" per the Github repo. No-one is going to be complaining that they don't offer their full platform under an open source license. Offering a self-hosted version of your core product with a…

If (correctly) calling it “Open Core” was inoffensive, and if “Open Core” is commonly accepted, why would you object to it, calling it an “unwarranted nitpick"?

The fact is that the Open Core model is quite controversial, and people should be made aware that Infisical uses it. But the announcement uses “Open Source” as some of the very first words of the announcement, and “Open Core” is not mentioned even once.

Post reply on HN