Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infisical – open-source HashiCorp Vault alternative

github.com

Post reply on HN
Print view View original

81–90 of 109 posts

Re: Infisical – open-source HashiCorp Vault alternative

#81

Post by vmatsiiako »

iLoveOncall wrote: post #80
vmatsiiako wrote: post #79

Earlier quoted context omitted.

I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack

You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?

Yes, indeed! I understand how it might sound. We have already started doing it and discussed it within our community – in other words, it's not just a plan. Expect it within the next 2 weeks maximum.

Re: Infisical – open-source HashiCorp Vault alternative

#82

Post by [deleted] »

Pet_Ant wrote: post #46
candiddevmike wrote: post #40

Earlier quoted context omitted.

Corporate blog spam doesn't magically make the BSL OSS: https://mariadb.com/bsl11/ > The Business Source License (this document, or the “License”) is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

I would argue (and have previously) that BSL is open source, it's just being held in escrow. So it has been released to open source... just that source hasn't been released to the public. (BSL triggers after a max of 4 years into irrevocable OSS). I think the real issue is that people want more community driven OSS. Stuff that is collaboratively built and not built for a commercial purpose. They want something I thin…

[deleted]

Re: Infisical – open-source HashiCorp Vault alternative

#83

Post by nylonstrung »

Pet_Ant wrote: post #46
candiddevmike wrote: post #40

Earlier quoted context omitted.

Corporate blog spam doesn't magically make the BSL OSS: https://mariadb.com/bsl11/ > The Business Source License (this document, or the “License”) is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

I would argue (and have previously) that BSL is open source, it's just being held in escrow. So it has been released to open source... just that source hasn't been released to the public. (BSL triggers after a max of 4 years into irrevocable OSS). I think the real issue is that people want more community driven OSS. Stuff that is collaboratively built and not built for a commercial purpose. They want something I thin…

That funding still requires corporate patronage, which is overwhelmingly from companies that are monetizing via proprietary software

Where is this community funding supposed to come from? Would OP here really personally donate to a team making a secrets management tool?

It's turtles all the way down

Re: Infisical – open-source HashiCorp Vault alternative

#84

Post by fiddlerwoaroof »

josephcsible wrote: post #30
mirzap wrote: post #15

Earlier quoted context omitted.

What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.

There's nothing wrong with monetization. There's just something wrong with making parts of the code proprietary. There'd be nothing wrong with monetizing by picking a copyleft license and selling exceptions, selling hosting, or selling support, for example.

I tend to trust “side project” OSS software more than OSS software that is some company’s main product. Something like Apache Samza that a company builds for some aspect of its operations and then opens seems to be more trustworthy long-term because the commercial backer doesn’t have to compete with *aaS providers for their main source of revenue. Such projects obviously have their own problems (neglect, deprioritization of features the maker doesn’t need now), but otoh, the maintainers are more likely to accept contributions adding features because they have to think less about market segmentation and such.

Re: Infisical – open-source HashiCorp Vault alternative

#85

Post by throwawaaarrgh »

lopatin wrote: post #49
throwawaaarrgh wrote: post #22

Earlier quoted context omitted.

Open Source is not a business model. It's marketing, for sure, but you can't make money solely by giving away your product. Every single open source company eventually learns this when they have a strong competitor. Eventually you are forced to stop being open source, because no business wants to compete solely on the strength of their service quality. Moreover: a community is antithetical to a corporation's interest…

Open source core, paid premium features + support. It's a valid business model, not sure why it's worthy of eye rolling. For example: Open source database that works on one machine. If you like it and want want to scale up, you can pay for the replication and authorization features with paid support.

The people who will pay for your database are going to pay for it right away. They're not going to "scale up" and then pay for it.

Just ask Docker. There's thousands of companies using Docker Desktop that should be paying for it but aren't. Same for most other Open Source companies with business licenses. Because they set themselves up as an "open source" company, all the villagers revolt when you finally ask to get paid, or stop allowing competitors to steal your lunch. You can survive, but it's very hard, and eventually they die away. (But that's also because most software gets replaced after a decade)

You have to treat your business as a business first and foremost if you want to remain profitable and competitive. You can use Open Source for your business, but you will not survive for long if you're hoping people will pay you just because they can read your code. Eventually reality, and competitors, come knocking.

Re: Infisical – open-source HashiCorp Vault alternative

#86

Post by pxc »

riku_iki wrote: post #55
JeremyNT wrote: post #53

Earlier quoted context omitted.

I mean, sure, but there's no particular reason to believe that Infisical will keep its current licensing if and when when financial times get tough for them. When you rely on OSS products that are developed almost exclusively by companies, you just need to assume that one day there's going to be a rug pull and plan accordingly.

> Infisical will keep its current licensing I think license they chose doesn't allow to change licensing, unless they require 3p contributors to sign some agreement to give up copyright rights like Hashi asked to do. So, we can check right away if infisical asks to sign agreement or not.

Infisical doesn't need a CLA because it's permissively licensed. People who contribute their code under the project's license (MIT) have already agreed that anyone (Infisical or anyone else) can take their code fork it into a proprietary project anyway.

Re: Infisical – open-source HashiCorp Vault alternative

#87

Post by nurple »

mirzap wrote: post #15
throwawaaarrgh wrote: post #10

Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.

What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.

See, the problem is that you have it backwards. OSS's significant "problem" is those attempting to levarage it for funding. If you want funding, don't do open source; you'll make all the precious money that those who have it think it might be worth, and you won't look like a dick when you pull it back because you're not making enough.

If you want to write software, in a community, for the betterment of that everyone, no matter what anyone else does with that software, then release it as open source.

Can you still make a comfortable living writing open source software? Perhaps, but if that's your goal, you're doing it wrong(tm).

Re: Infisical – open-source HashiCorp Vault alternative

#89

Post by dangtony98 »

jgillich wrote: post #71
mirzap wrote: post #27

Earlier quoted context omitted.

Check the pricing page: https://infisical.com/pricing Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)

That's only for the hosted service, no? They have a MIT licensed version

Yeah the pricing on their is only for the hosted service.

Re: Infisical – open-source HashiCorp Vault alternative

#90

Post by dangtony98 »

drdaeman wrote: post #63

So the introduction says it’s “end-to-end encrypted” but all it does is a link to Wikipedia (which is useless). Is there any documentation on the security model? Vault has some at-rest encryption but IIRC explicitly says then don’t have any mitigations against a compromised unsealed node. My understanding is that if someone ever gets a root access to a machine running Vault, the game is over. Which makes me wonder if…

Hey!

Definitely, we have more details on the cryptography in our documentation here: https://infisical.com/docs/security/overview.

Put simply, Infisical operates E2EE by default which means the platform itself can’t decrypt secrets. This is unless you opt out of E2EE (secrets remain encrypted at rest) to use select features like native integrations - this is, however, not necessary to use the platform. In your case, you might wish to run Infisical in E2EE mode for maximum security.

That said, it’s always important for you to keep your instance of Infisical secure that is ideally to not allow bad actors to gain root access to the machine.

Post reply on HN