Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Infisical – open-source secret management platform

infisical.com

Post reply on HN
Print view View original

51–59 of 59 posts

Re: Show HN: Infisical – open-source secret management platform

#51

Post by SilentNuke »

rmbyrro wrote: post #49
iLoveOncall wrote: post #36

And still no tests in your codebase. This is absolutely ridiculous when it has been brought up in every past Show HN that you've done. I really really hope nobody is reckless enough to use a completely untested platform to manage secrets.

I was wondering whether this project is safe to trust my secrets. Thanks for saving me time. Besides, a challenge with secrets is hardware. Storing them on ordinary EC2 instances or else is insecure. That's why AWS Secrets, for example, use specialized hardware that are hardened for this use case.

> That's why AWS Secrets, for example, use specialized hardware that are hardened for this use case.

I'm curious what your source is for this claim. I presume when you say AWS Secrets that you're referring to AWS Secrets Manager?

Re: Show HN: Infisical – open-source secret management platform

#52

Post by zie »

yjftsjthsd-h wrote: post #45
zie wrote: post #40

Earlier quoted context omitted.

> On top of that, we heard over and over again that HCP Vault is too complicated for developers to set up and maintain. WOW! I'm shocked, it's a single go binary and it has been ridiculously easy (I've been running it in production for years now). I've never tried your product, as I've been happily using vault for a long time now. If I ever have to move off of vault for some reason, I'll give your stuff a try though.…

Er, installing Vault isn't the hard part; using it is. I suspect some of that is just complexity inherent to the problem space, though.

I guess? I mean sure the problem space can be a bit complicated, but I never had trouble using it either. Nobody @ $WORK has had issues either. shrugs

Re: Show HN: Infisical – open-source secret management platform

#53

Post by iLoveOncall »

NobleLie wrote: post #47
yjftsjthsd-h wrote: post #44

Earlier quoted context omitted.

... What did I just read? (But seriously, why would you ever have a file of what looks like at least some sort of tests but literally every line commented out?)

Because they theoretically worked at some point but now they do not.

You are obviously right but the question is still valid. They are using git and a deleted file is a one command away, so why keep the file but fully commented?

IMO this highlights further bad engineering culture.

Re: Show HN: Infisical – open-source secret management platform

#54

Post by majkinetor »

vmatsiiako wrote: post #34
majkinetor wrote: post #33

How is this open source if we have limits with on premise installations?

There is no limits for the usage of any open source feature. There are limits for some enterprise-level features. The fact that there are some features behind the license doesn't make the rest of the codebase less "open source" Read this interesting blog by Sid from GitLab about this: https://opencoreventures.com/blog/2023-07-open-core-is-misun...

So is there a 5 user limit with on premise installation or not? The site seems to say so, and your comment just makes it more confusing.

Re: Show HN: Infisical – open-source secret management platform

#55

Post by AOsborn »

teddyh wrote: post #50
AOsborn wrote: post #46

Earlier quoted context omitted.

The offering by OP is a fairly common and accepted structure, and this seems like an unwarranted nitpick? Another org with a similar offering is Elastic, who offer Elasticsearch as a "Free and Open, Distributed, RESTful Search Engine" per the Github repo. No-one is going to be complaining that they don't offer their full platform under an open source license. Offering a self-hosted version of your core product with a…

If (correctly) calling it “Open Core” was inoffensive, and if “Open Core” is commonly accepted, why would you object to it, calling it an “unwarranted nitpick"? The fact is that the Open Core model is quite controversial, and people should be made aware that Infisical uses it. But the announcement uses “Open Source” as some of the very first words of the announcement, and “Open Core” is not mentioned even once.

Because very few people use the term open core unless they are trying to be a pedant or nitpick, and your comment (and the grandparent) come off as trying to detract from the thread with a strawman.

The original post even explicitly explains what part of the offering is MIT licensed and what is commercial. So what is your point arguing semantics about open core?

Re: Show HN: Infisical – open-source secret management platform

#57

Post by vmatsiiako »

majkinetor wrote: post #54
vmatsiiako wrote: post #34

Earlier quoted context omitted.

There is no limits for the usage of any open source feature. There are limits for some enterprise-level features. The fact that there are some features behind the license doesn't make the rest of the codebase less "open source" Read this interesting blog by Sid from GitLab about this: https://opencoreventures.com/blog/2023-07-open-core-is-misun...

So is there a 5 user limit with on premise installation or not? The site seems to say so, and your comment just makes it more confusing.

There is not. This is only the limitation of the cloud version

Re: Show HN: Infisical – open-source secret management platform

#58

Post by mikecoles »

AOsborn wrote: post #55
teddyh wrote: post #50

Earlier quoted context omitted.

If (correctly) calling it “Open Core” was inoffensive, and if “Open Core” is commonly accepted, why would you object to it, calling it an “unwarranted nitpick"? The fact is that the Open Core model is quite controversial, and people should be made aware that Infisical uses it. But the announcement uses “Open Source” as some of the very first words of the announcement, and “Open Core” is not mentioned even once.

Because very few people use the term open core unless they are trying to be a pedant or nitpick, and your comment (and the grandparent) come off as trying to detract from the thread with a strawman. The original post even explicitly explains what part of the offering is MIT licensed and what is commercial. So what is your point arguing semantics about open core?

Nope. Open core vs open source is a big difference.

Re: Show HN: Infisical – open-source secret management platform

#59

Post by teddyh »

AOsborn wrote: post #55
teddyh wrote: post #50

Earlier quoted context omitted.

If (correctly) calling it “Open Core” was inoffensive, and if “Open Core” is commonly accepted, why would you object to it, calling it an “unwarranted nitpick"? The fact is that the Open Core model is quite controversial, and people should be made aware that Infisical uses it. But the announcement uses “Open Source” as some of the very first words of the announcement, and “Open Core” is not mentioned even once.

Because very few people use the term open core unless they are trying to be a pedant or nitpick, and your comment (and the grandparent) come off as trying to detract from the thread with a strawman. The original post even explicitly explains what part of the offering is MIT licensed and what is commercial. So what is your point arguing semantics about open core?

People using Open Core don’t often use the term, since many of them are sleazebags who try to avoid using the term to try to hide the fact that they are using it, often prominently using the “Open Source” moniker, with various bad excuses when they are called out.
Post reply on HN