Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infisical – open-source HashiCorp Vault alternative

github.com

Post reply on HN
Print view View original

41–50 of 109 posts

Re: Infisical – open-source HashiCorp Vault alternative

#41

Post by josephcsible »

nine_k wrote: post #39
josephcsible wrote: post #30

Earlier quoted context omitted.

There's nothing wrong with monetization. There's just something wrong with making parts of the code proprietary. There'd be nothing wrong with monetizing by picking a copyleft license and selling exceptions, selling hosting, or selling support, for example.

Dual licensing (copyleft + commercial) has been a thing for a long time. Open Core is also a thing, and I think it's better than BSL because at least the core part is truly open.

I have nothing against dual licensing, but that's not what "enterprise features" are.

As for Open Core, there is one case in which I think that's fine: when none of the proprietary parts would be useful at all in an otherwise 100% FOSS environment. For example, if Linux support were FOSS but all the Windows- and macOS-specific code were proprietary, or if a plugin to talk to Bugzilla were FOSS but a plugin to talk to JIRA were proprietary, I wouldn't see a problem.

Re: Infisical – open-source HashiCorp Vault alternative

#42

Post by danenania »

vmatsiiako wrote: post #36
danenania wrote: post #33

Earlier quoted context omitted.

There's an inherent tradeoff for sure. In my opinion, I wouldn't say that any added functionality a secrets management service can offer is worth trusting all that service's servers, all its backend dependencies, all its employees and contractors, all its third party sub-processors, etc. with plaintext secrets. I'd also note that we are able to offer all the features you list without requiring users to opt-out of end…

Interesting. We work with some of the largest companies out there, and none of them had an issue with this. Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?

"We work with some of the largest companies out there, and none of them had an issue with this."

I imagine they'll regret this if you have a security incident.

"Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?"

We don't have a native integration with Vercel (you didn't list that in your comment, which is what I was referring to). We don't really have a need for one since all that's required to integrate EnvKey with Vercel is setting a single environment variable. That said, if we did decide to build an official Vercel integration, we wouldn't require removing end-to-end encryption to use it.

Re: Infisical – open-source HashiCorp Vault alternative

#43

Post by vmatsiiako »

josephcsible wrote: post #38
vmatsiiako wrote: post #31

Earlier quoted context omitted.

Curious why you think it's the wrong way to do it?

Because then you're making and monetizing a proprietary product rather than actually monetizing FOSS.

I'm not sure if I understand your point.

OSS != FOSS

https://opencoreventures.com/blog/2023-07-open-core-is-misun...

Re: Infisical – open-source HashiCorp Vault alternative

#44

Post by pluto_modadic »

I wish secret manager services were obsoleted by OIDC and HSMs. If everything negotiated via keypass & beyondprod style workload identification and... we never save passwords for DBs or web hooks ever again.

...it's annoying that a kubernetes-like complex system exists and it doesn't have to. And now they have a SaaS version for small numbers of secrets....

Re: Infisical – open-source HashiCorp Vault alternative

#45

Post by josephcsible »

vmatsiiako wrote: post #43
josephcsible wrote: post #38

Earlier quoted context omitted.

Because then you're making and monetizing a proprietary product rather than actually monetizing FOSS.

I'm not sure if I understand your point. OSS != FOSS https://opencoreventures.com/blog/2023-07-open-core-is-misun...

> OSS != FOSS

While this statement is technically true, I don't think it has any relevance to the topic at hand. While there are some relatively obscure licenses that are OSS but not FOSS (e.g., the Sybase Open Watcom Public License), isn't everything under discussion here either both free and open source, or neither free nor open source? In particular, the "core" of Open Core is both, but the extras are neither.

Re: Infisical – open-source HashiCorp Vault alternative

#46

Post by Pet_Ant »

candiddevmike wrote: post #40
vmatsiiako wrote: post #37

Earlier quoted context omitted.

This is what Sentry says: https://open.sentry.io/

Corporate blog spam doesn't magically make the BSL OSS: https://mariadb.com/bsl11/ > The Business Source License (this document, or the “License”) is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

I would argue (and have previously) that BSL is open source, it's just being held in escrow. So it has been released to open source... just that source hasn't been released to the public. (BSL triggers after a max of 4 years into irrevocable OSS).

I think the real issue is that people want more community driven OSS. Stuff that is collaboratively built and not built for a commercial purpose. They want something I think along the lines of KDE where there are paid people to work on it, but it's also contributed to by a community and there isn't someone constantly trying to a make a buck off of it.

Re: Infisical – open-source HashiCorp Vault alternative

#47

Post by advaitruia »

throwawaaarrgh wrote: post #22
mirzap wrote: post #15

Earlier quoted context omitted.

What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.

Open Source is not a business model. It's marketing, for sure, but you can't make money solely by giving away your product. Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality. Moreover: a community is antithetical to a corporation's interest…

More often than not, making money and making good software are complimentary outcomes. Its difficult to do the former without the latter.

Infisical is an open core business model. While there is a proprietary crust, the core is truly open source.

Disclaimer: I run an open core venture

Re: Infisical – open-source HashiCorp Vault alternative

#49

Post by lopatin »

throwawaaarrgh wrote: post #22
mirzap wrote: post #15

Earlier quoted context omitted.

What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.

Open Source is not a business model. It's marketing, for sure, but you can't make money solely by giving away your product. Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality. Moreover: a community is antithetical to a corporation's interest…

Open source core, paid premium features + support. It's a valid business model, not sure why it's worthy of eye rolling.

For example: Open source database that works on one machine. If you like it and want want to scale up, you can pay for the replication and authorization features with paid support.

Post reply on HN