Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp IPO today

hashicorp.com

Post reply on HN
Print view View original

131–140 of 206 posts

Re: HashiCorp IPO today

#131

Post by notreallyserio »

jen20 wrote: post #119
cyberpunk wrote: post #93

Earlier quoted context omitted.

Having used vault quite a lot, I'm not really sold on it. Do you see any value in this tool? I've done the whole sidecar mess, middle of the night three keys unlock like we're arming a nuclear weapon and everything, and most of the time it's just been a total faff and imo security theatre vs actual security. End of the day, the secrets are being written to a .properties file or /proc/ /env somewhere anyway and can be…

If you don’t need the Shamir part of Vault, create fewer key shares. If you integrate properly throughout the stack (i.e “not being negligent”) then secrets will not hit properties files, rotation will happen correctly, and you will be able to audit everything. You can also do this using a native secret management system if you’re in a a public cloud, but Vault is, for the most part, just better.

What do you suggest? That is, what is proper? I haven't found a good example showing how to use it without environment variables, files*, or http interfaces with shared secrets, but it has been a while since I dug in and I could have missed something obvious.

edited to add "files"

Re: HashiCorp IPO today

#132

Post by ascendantlogic »

altdataseller wrote: post #11

Don’t understand why anyone would need their cloud products. Who needs Terraform or Nomad or Vault as a service?

Large companies will always pay huge amounts of $$$ for support. They can't be telling engineers "Go google some stuff" if critical components go down.

Re: HashiCorp IPO today

#133

Post by slig »

ggregoire wrote: post #130
driverdan wrote: post #111

Earlier quoted context omitted.

Who needs RDS? You can host your own database instance. Who needs VPSes? Just run bare metal. Who needs S3? Host your own files.

> Who needs S3? Host your own files. You joking but I read this comment way too often on HN.

Just host Ceph in a RPi cluster inside your closet.

Re: HashiCorp IPO today

#134

Post by verdverm »

dan_quixote wrote: post #104
cyberpunk wrote: post #85

Earlier quoted context omitted.

I don't know a single person who prefers HCL over literally anything else, but still, it's a happy day for them so I won't air my entitled little complaints and instead say: thank you hashicorp! You made life as a cloud infra beard better for a while, and I wish you all success going onwards.

I've come full circle on this and actually like HCL now. It's so limiting that there's often only one (or a few at most) way to feasibly do something. This is kinda painful when your team is small, but becomes a net-positive in a larger team.

cue export --out json | tf apply

This is now my preferred method

Re: HashiCorp IPO today

#135

Post by dilyevsky »

notreallyserio wrote: post #131
jen20 wrote: post #119

Earlier quoted context omitted.

If you don’t need the Shamir part of Vault, create fewer key shares. If you integrate properly throughout the stack (i.e “not being negligent”) then secrets will not hit properties files, rotation will happen correctly, and you will be able to audit everything. You can also do this using a native secret management system if you’re in a a public cloud, but Vault is, for the most part, just better.

What do you suggest? That is, what is proper? I haven't found a good example showing how to use it without environment variables, files*, or http interfaces with shared secrets, but it has been a while since I dug in and I could have missed something obvious. edited to add "files"

Obviously if your app is compromised all its secrets are too. Hopefully one doesn’t pull the entire secrets backend to a single app and has audit logs to assess the actual impact and what else needs to be rotated. Also Vault is not just about kv secrets, there’s also pki, ssh and more

Re: HashiCorp IPO today

#136

Post by dilyevsky »

cyberpunk wrote: post #93
Suchos wrote: post #26

Earlier quoted context omitted.

At my company, they don't want to deploy OSS Vault on prem. Apparently we need the enterprise edition, because it is easier for our operations team.

Having used vault quite a lot, I'm not really sold on it. Do you see any value in this tool? I've done the whole sidecar mess, middle of the night three keys unlock like we're arming a nuclear weapon and everything, and most of the time it's just been a total faff and imo security theatre vs actual security. End of the day, the secrets are being written to a .properties file or /proc/ /env somewhere anyway and can be…

Set to autouseal with a transit or cloud (or hms if you pay them $$$) and you don’t need to use sss unless to recover root token (or if somebody leaves)

Re: HashiCorp IPO today

#137

Post by dilyevsky »

notreallyserio wrote: post #110
cyberpunk wrote: post #93

Earlier quoted context omitted.

Having used vault quite a lot, I'm not really sold on it. Do you see any value in this tool? I've done the whole sidecar mess, middle of the night three keys unlock like we're arming a nuclear weapon and everything, and most of the time it's just been a total faff and imo security theatre vs actual security. End of the day, the secrets are being written to a .properties file or /proc/ /env somewhere anyway and can be…

I have been curious about this, too. I think I'd want something like vault to issue OTPs that can be exchanged for secrets over a socket to a sidecar, where the OTP is made available as an environment variable set by the orchestrator (eg k8s). If the token is used twice, lock it all down. If it's read but not confirmed to have been received by the service (through some method... dunno), lock it down. Thanks for comin…

You can use kubernetes auth in k8s which exchanges you a short lived token for your k8s service acc jwt

Re: HashiCorp IPO today

#138

Post by dilyevsky »

ghaff wrote: post #113
jordanbeiber wrote: post #72

Earlier quoted context omitted.

I really would like to challenge this. There’s many times no need, but busywork have to feed busywork.

If you're at a large company, the only thing worse than dealing with processes is dealing with the chaos you have in the absence of processes with everyone running around doing their own thing. (Obviously there can be bad process as well.)

Those aren’t really related everyone can be running around doing their own thing (but slower) with a process - that’s usually a sign of leadership vacuum not absence of the process.

Re: HashiCorp IPO today

#139

Post by chii »

ggregoire wrote: post #130
driverdan wrote: post #111

Earlier quoted context omitted.

Who needs RDS? You can host your own database instance. Who needs VPSes? Just run bare metal. Who needs S3? Host your own files.

> Who needs S3? Host your own files. You joking but I read this comment way too often on HN.

it's because those who say this underestimate the work required to make any of those services robust and scalable at a click of a button. All they see is the high cost vs the imagined simple implementation.

Re: HashiCorp IPO today

#140

Post by alfalfasprout »

ggregoire wrote: post #130
driverdan wrote: post #111

Earlier quoted context omitted.

Who needs RDS? You can host your own database instance. Who needs VPSes? Just run bare metal. Who needs S3? Host your own files.

> Who needs S3? Host your own files. You joking but I read this comment way too often on HN.

If the typical HN reader had their way everyone would roll their own versions of AWS services and rewrite their codebases in Rust.
Post reply on HN