Live data from Hacker News

Infisical – open-source HashiCorp Vault alternative

github.com

71–80 of 109 posts

Re: Infisical – open-source HashiCorp Vault alternative

#71
post #27

Earlier quoted context omitted.

This is very strange. There is no such limitation. You can create as many projects and environments as you need. You can also add an unlimited number of users

Check the pricing page: https://infisical.com/pricing Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)

That's only for the hosted service, no? They have a MIT licensed version

Re: Infisical – open-source HashiCorp Vault alternative

#72
post #29

Earlier quoted context omitted.

Second this, we don’t have any such limitations on OSS that is you can totally self-host Infisical on your own infrastructure and have unlimited users, projects, and environments. I think there may be a mix-up here with Infisical Cloud which is the managed service with subscription tiers.

OK, that's great to hear. You may consider removing the "Usage & Billing" page from OSS when self-hosting. Because I thought I'd have to upgrade OSS with a business license once I reached the limit.

Yeah, we should probably do that. I get that it might be confusing

Re: Infisical – open-source HashiCorp Vault alternative

#74

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests.

I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.

Re: Infisical – open-source HashiCorp Vault alternative

#75
post #49

Earlier quoted context omitted.

Open Source is not a business model. It's marketing, for sure, but you can't make money solely by giving away your product. Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality. Moreover: a community is antithetical to a corporation's interest…

Open source core, paid premium features + support. It's a valid business model, not sure why it's worthy of eye rolling. For example: Open source database that works on one machine. If you like it and want want to scale up, you can pay for the replication and authorization features with paid support.

> Open source core, paid premium features + support. It's a valid business model

I’m a pretty rusted on Odoo developer, this has been their business model for years and it’s worked thus far, even when facing off with the likes of the SAP and Dynamics of the world.

Re: Infisical – open-source HashiCorp Vault alternative

#77

HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future. Ultimately, it just means that Hash…

Maybe I'm missing something, but Infisical ONLY seems to handle shared secrets. Vault handles a lot more, it can for instance create DB users on the fly, with the right permissions that will only live for as long as the vault token does. Vault also has a full CA system in-place, and can rotate secrets, etc.

Does this product do things like that? I couldn't find anywhere where it does those things in the docs, though I admit I only scanned them.

Re: Infisical – open-source HashiCorp Vault alternative

#78
post #76

[dead]

As a rule, plugging your own stuff on HN is actually acceptable, but it needs to be clearly labeled as a plug and you should do it under your own account. Doing it like this—throwaway account plugging a service with no disclosures of any kind—looks really suspicious.

Re: Infisical – open-source HashiCorp Vault alternative

#79

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

I must admit that the test coverage is still lower than we would want it to be.

Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack

Re: Infisical – open-source HashiCorp Vault alternative

#80

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack

You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592

Any reason to believe this to be true this time around?

Post reply on HN