Live data from Hacker News

Infisical – open-source HashiCorp Vault alternative

github.com

51–60 of 109 posts

Re: Infisical – open-source HashiCorp Vault alternative

#51
post #50

Any plans for OIDC support?

Yes, this has been requested quite a bit recently. Could you please comment in this issue: https://github.com/Infisical/infisical/issues/442

We will make sure to prioritize the OIDC support depending on how many people ask for it

Re: Infisical – open-source HashiCorp Vault alternative

#52

Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.

> Backed by another corporation trying to monetize it. This will go well.

This is a good point. Open source software by definition must be made by monks that have taken a vow of asceticism. I won’t use any OSS made by anyone that eg drives a car or has been to a dentist.

Re: Infisical – open-source HashiCorp Vault alternative

#53

Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.

I think OSS core + proprietary components (which can be replaced by OSS alternatives) is much less evil business model than what Hashi did: forced contributors to give up copyright and then locked everything under business license. There are many examples of such approach: Spark/Databricks, Cassandra/Datastax.

I mean, sure, but there's no particular reason to believe that Infisical will keep its current licensing if and when when financial times get tough for them.

When you rely on OSS products that are developed almost exclusively by companies, you just need to assume that one day there's going to be a rug pull and plan accordingly.

Re: Infisical – open-source HashiCorp Vault alternative

#54
MIT now, but in a few years when the inevitable need to make profit number bigger crops up they'll be doing the same thing.

And there will the same backlash by people pretending that the change is some sort of grave slight and make bold claims about how they're switching away because they actually have to pay for stuff now.

And the cycle will repeat ad nauseam.

Re: Infisical – open-source HashiCorp Vault alternative

#55

Earlier quoted context omitted.

I think OSS core + proprietary components (which can be replaced by OSS alternatives) is much less evil business model than what Hashi did: forced contributors to give up copyright and then locked everything under business license. There are many examples of such approach: Spark/Databricks, Cassandra/Datastax.

I mean, sure, but there's no particular reason to believe that Infisical will keep its current licensing if and when when financial times get tough for them. When you rely on OSS products that are developed almost exclusively by companies, you just need to assume that one day there's going to be a rug pull and plan accordingly.

> Infisical will keep its current licensing

I think license they chose doesn't allow to change licensing, unless they require 3p contributors to sign some agreement to give up copyright rights like Hashi asked to do.

So, we can check right away if infisical asks to sign agreement or not.

Re: Infisical – open-source HashiCorp Vault alternative

#56

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.

Re: Infisical – open-source HashiCorp Vault alternative

#57

Earlier quoted context omitted.

I mean, sure, but there's no particular reason to believe that Infisical will keep its current licensing if and when when financial times get tough for them. When you rely on OSS products that are developed almost exclusively by companies, you just need to assume that one day there's going to be a rug pull and plan accordingly.

> Infisical will keep its current licensing I think license they chose doesn't allow to change licensing, unless they require 3p contributors to sign some agreement to give up copyright rights like Hashi asked to do. So, we can check right away if infisical asks to sign agreement or not.

We have not asked any contributors to sign a CLA agreement.

Re: Infisical – open-source HashiCorp Vault alternative

#58

Earlier quoted context omitted.

Open Source is not a business model. It's marketing, for sure, but you can't make money solely by giving away your product. Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality. Moreover: a community is antithetical to a corporation's interest…

> Every single open source company eventually learns this when they have a strong competitor. Many of the open source companies are their own strongest competitor, see HashiCorp.

If they aren't, then someone else will be. That is always worse for them.

Either that or they have to go at least semi-proprietary.

Re: Infisical – open-source HashiCorp Vault alternative

#59

Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.

The problem, though, isn't the mere concept of trying to monetize open source work. It's the fine line between balancing profitability and openness vs deception and exploitation. Open source with community governance is clearly better at upholding ideals, but honestly, other models can work, too. As I see it today, the CLA is a major issue: it can be seen as insurance against existential threats for open source projects, but it's being used to make pulling the FOSS rug legal 99% of the time its ever exercised, it seems.

Only solution I can see is to stigmatize the CLA.

Re: Infisical – open-source HashiCorp Vault alternative

#60
post #6

Earlier quoted context omitted.

I don't know anything about this product, but just wanted to say that's a really pretty README page :D

Thank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)

FYI I noticed a typo in the readme - "take a look at our webiste"
Post reply on HN