61–70 of 109 posts
Earlier quoted context omitted.
Thank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)
FYI I noticed a typo in the readme - "take a look at our webiste"
Don't use this untested mess to store your secrets.
Vault has some at-rest encryption but IIRC explicitly says then don’t have any mitigations against a compromised unsealed node. My understanding is that if someone ever gets a root access to a machine running Vault, the game is over. Which makes me wonder ifI can deploy Infiscial to some completely untrusted machine (without any orchestration or networking concerns) and still have some guarantees that all my secrets are safe in some way (cannot be decrypted, cannot be replaced, maybe even cannot be rolled back, etc)?
Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.
Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No
Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.
Earlier quoted context omitted.
> Every single open source company eventually learns this when they have a strong competitor. Many of the open source companies are their own strongest competitor, see HashiCorp.
If they aren't, then someone else will be. That is always worse for them. Either that or they have to go at least semi-proprietary.
TBH my view is that the frustration towards open source companies around changing their licenses is sort of misguided. If there's a bad guy in the room, it's AWS. AWS is very good at commercializing open source -- they make literally billions of dollars doing so: Elasticache (Redis), AWS Managed Elastic, RDS etc. Changing the license becomes one of the only ways to hold them off, and the companies that have done so more proactively have fared much better. I think everyone agrees that in an ideal world this wouldn't have to happen, and indeed it didn't really happen until recently when the AWS thing started to become an issue.
Ultimately, SOMEONE is going to leverage the open source for financial gain. So, the question becomes which would you rather have:
- The company commercializing the open source (which is in almost every successful case includes the original creator(s) as a founder, CEO, or employee) benefit from the projects success, which in turn allows them to make further investment in the project.
- AWS benefit from the projects success and (generally speaking) contribute very little back.
Of course, there are plenty of projects that are NOT venture funded that see great success through purely community development. That's great! I just think commercial open source is beneficial as well, especially for larger more complex projects (databases, etc.) that need the funding. The two are not mutually exclusive.
I am also of the belief that the additional funding (both from revenue and from venture investment) that goes into these projects gives them the ability to hire more people, which in turn makes the software better for everyone.
Disclaimer: I am investor that invests predominantly in commercial open source companies. Previously I was developer who used a lot of open source, which is what led me here.
HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future. Ultimately, it just means that Hash…
I remember trying Infiscal, and I was excited to see how good it is, the feature list in the OSS version, and its ease of use... What cooled me off is this limitation in OSS: "3 Infisical Projects, 3 Environments & 5 Team Members." That's not nice. It's OK to limit SSO access to OSS and stuff like that. But limiting essential features - team members is a no-go.
Personally, I can't wrap my head around people wanting to use Infiscal for better security while *not* using SSO.