Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 150 posts

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#101

Post by quinndiggity »

DanBC wrote: post #99
quinndiggity wrote: post #97

Going off how any comment questioning their poor behaviour is being downvoted and even intentionally hiding some comments now, this being a ycombinator alumni project, and any meaningful discussion about the project itself being shut down in preference of their own developers' posting meaningless "i luv how perfect you made it and it beats everything"... Yeah, this project has gross all over it now, and really should…

Please reread what moderator Dang said to you 3 hours ago.

If ycombinator and their mods are more concerned with the promotion of one of their own investments, over discussion of its merits and feedback from the people who _would_ be the ones adopting and promoting it in their own companies if it indeed lived up to its own marketing, then I invite a ban for trying to keep hackernews honest and driven by community discussion, over a place for them to advertise, self promote, pat themselves on the back, and pad their wallets.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#102

Post by nyrulez »

Landing page does not address the elephant in the room: security and trust. I can't imagine mentioning in our security policy/audit that we store secrets with a third party and Doppler doesn't seem to be talking about this aspect, just ease of use. But this isn't a photo sharing app.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#103

Post by Bedon292 »

Looks really interesting, and potentially useful. I looked around, but didn't see much about a few things, which are probably not standard use cases:

Do you have thoughts about using this on other systems. Bare metal, VMWare, or maybe even a cloud service without the use of their secret manager? I know it may seem odd, but those are cases where I would think this would be even more useful.

How about the use of client certificates for user authentication. Or maybe kerberos tokens for server authentication.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#104

Post by tompic823 »

nyrulez wrote: post #102

Landing page does not address the elephant in the room: security and trust. I can't imagine mentioning in our security policy/audit that we store secrets with a third party and Doppler doesn't seem to be talking about this aspect, just ease of use. But this isn't a photo sharing app.

Thanks for pointing this out, you're absolutely right. I'm linking to our Security page[0] and our security docs[1] below, but we'll definitely be updating our marketing site to place more of an emphasis on this. I hope the rest of this post and our comments here illustrate that trust and security are things we think a lot about, despite our oversight with the landing page.

[0] https://doppler.com/security

[1] https://docs.doppler.com/docs/security-fact-sheet

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#105

Post by tompic823 »

Bedon292 wrote: post #103

Looks really interesting, and potentially useful. I looked around, but didn't see much about a few things, which are probably not standard use cases: Do you have thoughts about using this on other systems. Bare metal, VMWare, or maybe even a cloud service without the use of their secret manager? I know it may seem odd, but those are cases where I would think this would be even more useful. How about the use of client…

We fully support using Doppler on bare metal servers, VMs, and just about any other cloud service via our CLI [0]. This would be identical to how you'd access your secrets locally when developing. You'd wrap your command with our CLI so that your secrets are injected into the process's environment (e.g. `npm start` becomes `doppler run -- npm start`).

Client certificates are an interesting use case that we'd be open to, but admittedly the request hasn't come up a whole bunch yet from our customers. Same with Kerberos tokens- this would definitely be used in the Enterprise space, which is an offering we're still in the early stages of. Other forms of identity-based auth would fall into this category as well.

[0] https://github.com/DopplerHQ/cli

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#106

Post by rat9988 »

quinndiggity wrote: post #89

Thank you for acknowledging the need for trust, self-hosting + auditability. However, please stop trying to contrast yourself with these analogies. Owncloud and Nextcloud both have hosted OR on-prem versions https://owncloud.com/pricing/ https://nextcloud.com/providers/

He compared it to Dropbox...

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#107

Post by quinndiggity »

rat9988 wrote: post #106
quinndiggity wrote: post #89

Thank you for acknowledging the need for trust, self-hosting + auditability. However, please stop trying to contrast yourself with these analogies. Owncloud and Nextcloud both have hosted OR on-prem versions https://owncloud.com/pricing/ https://nextcloud.com/providers/

He compared it to Dropbox...

"An analogy: there are open source versions of Dropbox for users that don't trust Dropbox with their files (NextCloud, ownCloud, etc.), however this comes with the friction of having to host your own solution. We are more like Dropbox, where we want to create a solution that is incredibly easy to install, manage, and work with."

NextCloud: self-host OR pay for a managed option (this means someone runs it for you.) ownCloud: self-host OR pay for a managed option (this means someone runs it for you.)

He compared it to Dropbox, Nextcloud, and ownCloud.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#108

Post by quinndiggity »

rat9988 wrote: post #106
quinndiggity wrote: post #89

Thank you for acknowledging the need for trust, self-hosting + auditability. However, please stop trying to contrast yourself with these analogies. Owncloud and Nextcloud both have hosted OR on-prem versions https://owncloud.com/pricing/ https://nextcloud.com/providers/

He compared it to Dropbox...

In case that wasn't straight forward -

"NextCloud, ownCloud, etc. ... comes with the friction of having to host your own solution"

NextCloud and ownCloud don't require you to host your own solution, however you can if you want, which is important.

"We are more like Dropbox, ... incredibly easy to install, manage, and work with"

Nextcloud and ownCloud are incredibly easy to install, manage, and work with.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#110

Post by blago »

neximo64 wrote: post #86

You have to give Doppler your secrets which is absolutely crazy. Is there a self hosted version? How does it fair against Vault? Vault is self hosted and open source. Does everyone in this thread know the founder or something? No one is asking these and they're in my view the absolutely most important questions.

Is it so much different from giving someone all of your source code, data, and conversations?
Post reply on HN