Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infisical – open-source HashiCorp Vault alternative

github.com

Post reply on HN
Print view View original

91–100 of 109 posts

Re: Infisical – open-source HashiCorp Vault alternative

#91

Post by cuu508 »

Pet_Ant wrote: post #46
candiddevmike wrote: post #40

Earlier quoted context omitted.

Corporate blog spam doesn't magically make the BSL OSS: https://mariadb.com/bsl11/ > The Business Source License (this document, or the “License”) is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

I would argue (and have previously) that BSL is open source, it's just being held in escrow. So it has been released to open source... just that source hasn't been released to the public. (BSL triggers after a max of 4 years into irrevocable OSS). I think the real issue is that people want more community driven OSS. Stuff that is collaboratively built and not built for a commercial purpose. They want something I thin…

One problem with running x-year-old releases of web applications are bugs and vulnerabilities that have been discovered and fixed in those years. Are many people running the 3 year old, now properly OSS versions of Sentry in production?

Using BSL strikes me as trying to have a cake but eat it too: look, we're good open source guys using an open license. Feel free to use our code, but only after it is well beyond its best before date!

Re: Infisical – open-source HashiCorp Vault alternative

#92

Post by ogoldberg »

danenania wrote: post #4

EnvKey ( https://www.envkey.com/ ) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder). We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/ We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we…

Just wanted to say that I'm a long time user of EnvKey and I love it. Highly recommend.

Re: Infisical – open-source HashiCorp Vault alternative

#94

Post by mirzap »

jgillich wrote: post #71
mirzap wrote: post #27

Earlier quoted context omitted.

Check the pricing page: https://infisical.com/pricing Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)

That's only for the hosted service, no? They have a MIT licensed version

Yes, but you can see the Usage & Billing page even on OSS. So, it's a bit confusing seeing "Upgrade" CTAs there.

Re: Infisical – open-source HashiCorp Vault alternative

#95

Post by RadiozRadioz »

vmatsiiako wrote: post #81
iLoveOncall wrote: post #80

Earlier quoted context omitted.

You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?

Yes, indeed! I understand how it might sound. We have already started doing it and discussed it within our community – in other words, it's not just a plan. Expect it within the next 2 weeks maximum.

I would prefer that you didn't set yourself hard time-based deadlines for security features. If this product is going to be around long enough for enterprise to trust it, that you did this in two weeks won't make any difference. Unnecessarily rushing yourself to meet an arbitrary deadline helps nobody and hurts the product. Especially if, as noted by GP, you don't have a good track record.

It's also worth noting that you're doing this in the wrong order. The "We can test it all later, ship! ship! ship!" strategy works fine for trivial apps, not security software.

Re: Infisical – open-source HashiCorp Vault alternative

#96

Post by RadiozRadioz »

vmatsiiako wrote: post #93
revskill wrote: post #88

I tried infsical before, it's bad. It lacks of the most important feature: Auto save your form.

Could you please explain what you mean by auto saving the form?

Presumably they mean having their changes persist without clicking "submit"

Re: Infisical – open-source HashiCorp Vault alternative

#97

Post by 3np »

danenania wrote: post #4

EnvKey ( https://www.envkey.com/ ) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder). We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/ We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we…

A major use-case for Vault is dynamic generation of secrets, like rotating roles in a Postgres DB or acting as CA (issuing/revoking certs) in a PKI infra. Some, like the former, needs to hold secrets for and communicate with external services.

How easy is this to achieve using EnvKey? Only allusion I see on the comparison page is "Easy Integration: Vault=Poor, EnvKey=Strong" but I have a feeling something else was in mind there.

Re: Infisical – open-source HashiCorp Vault alternative

#98

Post by 3np »

rstat1 wrote: post #54

MIT now, but in a few years when the inevitable need to make profit number bigger crops up they'll be doing the same thing. And there will the same backlash by people pretending that the change is some sort of grave slight and make bold claims about how they're switching away because they actually have to pay for stuff now. And the cycle will repeat ad nauseam.

They haven't made contributors sign a CLA so no, they aren't legally in a position to do the same move.

Re: Infisical – open-source HashiCorp Vault alternative

#99

Post by danenania »

3np wrote: post #97
danenania wrote: post #4

EnvKey ( https://www.envkey.com/ ) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder). We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/ We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we…

A major use-case for Vault is dynamic generation of secrets, like rotating roles in a Postgres DB or acting as CA (issuing/revoking certs) in a PKI infra. Some, like the former, needs to hold secrets for and communicate with external services. How easy is this to achieve using EnvKey? Only allusion I see on the comparison page is "Easy Integration: Vault=Poor, EnvKey=Strong" but I have a feeling something else was in…

Yeah, "easy integration" is more speaking to how you get secrets from Vault/EnvKey through to an app.

Dynamic secrets generation isn't built in to EnvKey, but we do offer a CLI that makes it straightforward to generate or rotate credentials/roles as part of your deployment. Rather than baking in this kind of thing, we are more taking a 'give you simple building blocks so you can do anything' approach to automations. For your postgres example, it would look something like this:

  # Set variables for an EnvKey environment that includes postgres admin creds in shell 
  eval $(envkey-source)

  # Use the admin credentials from EnvKey to rotate credentials for app role in Postgres. 
  # You could also create new roles, grant privileges, etc., as needed.
  NEW_PASSWORD=$(openssl rand -base64 32)
  psql -h $DB_HOST -U $DB_ADMIN_USER -d $DATABASE_NAME -c "ALTER ROLE $ROLE_NAME WITH PASSWORD '$NEW_PASSWORD';"

  # Update the credentials in EnvKey for your app.
  envkey set app-name production DB_PASSWORD=$NEW_PASSWORD --commit --json
Meanwhile, if you prefix your app start command like this:

  envkey-source --watch -- ./run-my-app.sh
Your app process will then be automatically restarted after the `envkey set` command with the latest postgres password in its environment. If you're running multiple instances, you could also use rolling restarts to avoid downtime.

  envkey-source --watch --rolling -- ./run-my-app.sh
So it's a bit more work compared to Vault for the postgres use-case, but on the other hand, with EnvKey you get a lot of flexibility to setup these kinds of automations for any service or tool.

For acting as a CA, we have some ideas on how to accomplish this that I think would be both simpler and more secure than Vault's approach, but we haven't gotten to it yet.

Re: Infisical – open-source HashiCorp Vault alternative

#100

Post by riku_iki »

pxc wrote: post #86
riku_iki wrote: post #55

Earlier quoted context omitted.

> Infisical will keep its current licensing I think license they chose doesn't allow to change licensing, unless they require 3p contributors to sign some agreement to give up copyright rights like Hashi asked to do. So, we can check right away if infisical asks to sign agreement or not.

Infisical doesn't need a CLA because it's permissively licensed. People who contribute their code under the project's license (MIT) have already agreed that anyone (Infisical or anyone else) can take their code fork it into a proprietary project anyway .

> that anyone (Infisical or anyone else)

yes, and in case of Hashi, people agreed on CLA granted all rights exclusively to Hashi, not "anyone else"

Post reply on HN