Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

151–160 of 171 posts

Re: HashiCorp Boundary

#151

Post by victorhooi »

pliu wrote: post #106
jefferai wrote: post #68

Earlier quoted context omitted.

Generally speaking this is designed for accessing your own systems, not the systems of a third party being consumed as a SaaS. That said, any such provider that allows you to restrict the set of IPs allowed to make calls to the service would operate in a Boundary-friendly mode.

It would be interesting if the networking model for the end targets could also be inverted, so that an agent (or something) on the end target could make an outbound connection to establish a reverse tunnel to the proxy that user connections could then be sent over. The use case I'm thinking of is for IoT or robotics, where you have devices you want to manage being deployed into remote networks that you don't have muc…

Second this!

CloudFlare Access allows this, using the cloudflared daemon, which acts as a reverse proxy. It essentially means the endpoint can be closed off to incoming connections from the internet, and you don't need to maintain various firewall whitelist (and hope they don't go out of sync)

Is something like this on the roadmap for Boundary?

Re: HashiCorp Boundary

#152

Post by 3np »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

From a first look this is really exciting. And cool to see you here on HN! I live your positioning and how you’re first and foremost building FOSS software and tools that you leverage on, as opposed to building a commercial offering that you then release software for. It’s a vital distinction that sets you apart from eg Google.

Let’s say you have an org that’s doing the whole Consul/Nomad/Vault thing, and starting to have their Nomad jobs using Consul Connect (and it’s proxies/gateways for external).. that’s already a proxy sidecar used for all service ports. How does Boundary fit here? Is it put before/after Connect, is the plan to integrate them, or are they supposed to not be used together?

Re: HashiCorp Boundary

#153

Post by ksec »

carlosf wrote: post #137
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Happy Nomad + Consul + Terraform user here. Thanks a lot for the great products, but please give us managed Nomad already. Or even better: a Heroku like app platform. I want to give you money, but I really dislike your companies' enterprise offerings. BTW I believe there's a great opportunity for Hashicorp right now. Cloud providers are good at selling building blocks, but are terrible at selling a vision of how you…

>Or even better: a Heroku like app platform.

So Hashiku? :)

Seriously Heroku seems to have stopped innovating. I wonder how much is Heroku worth now.

Re: HashiCorp Boundary

#154

Post by newman314 »

nielsole wrote: post #113
newman314 wrote: post #98

Earlier quoted context omitted.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

* Teleport https://gravitational.com/teleport/

I believe Teleport is SSH only.

Re: HashiCorp Boundary

#155

Post by clafferty »

This looks awesome, great job! One thing that will slow me down from using this is I've not settled on an ID or Access Management system. Being a small company, we occasionally need to grant system access to contractors or other dev teams. The problem is we don't want to grant the access too wide and specifying fine grained controls takes a lot of time.

Armon mentions Okta and Ping, does anyone have any recommendations in this space that would work for managing a small team with occasional on/off boarding of contractors?

Re: HashiCorp Boundary

#156

Post by xander158 »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

CyberArk PAS: https://www.cyberark.com/products/privileged-account-securit...

Re: HashiCorp Boundary

#157

Post by traceroute66 »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

mitchellh

I'm sorry, but please cut the corporate-speak.

Reality is that your statements are different from your actions.

"similarly to Vault, the major featureset of Boundary will remain free"

Sounds great doesn't it.

Except Hashicorp decide to hide Multi-factor authentication in Vault behind the paywall.

I mean, I'll forgive you putting a lot of the Vault features behind the paywall (e.g. replication).

But for a security product. Putting a core component of 21st century security (MFA) behind the paywall ?

Pretty unforgivable.

Re: HashiCorp Boundary

#158

Post by zokier »

armon wrote: post #37
zokier wrote: post #18

Earlier quoted context omitted.

Some sort of LD_PRELOAD style trickery? Or are they intercepting syscalls? edit: seems nothing that complicated, more like ssh-style tunnel where Boundary has a local listening socket which you need to point the client to. That is if I'm understanding it correctly.

That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.

I started thinking, using network namespaces to intercept traffic from client applications would be pretty neat trick.

Re: HashiCorp Boundary

#159

Post by eeZah7Ux »

fallat wrote: post #44
candiddevmike wrote: post #23

Earlier quoted context omitted.

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered. Is HashiCorp known to do this? All I've heard are good things about HashiCorp from people who use HashiCorp products. Second, it can't be forgotten these are companies. A company exists to create value for itself in some way. It's the natural behavior of any company. However in…

> Is HashiCorp known to do this?

HashiCorp and other companies doing "devops" tools are known for using "open core" and hijacking the spirit of open source in many ways.

Re: HashiCorp Boundary

#160

Post by eeZah7Ux »

kodah wrote: post #75
candiddevmike wrote: post #23

Earlier quoted context omitted.

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

Man, this really represents the rift in Open Source and Corporate development right now. It seems like there are developers who contribute to Open Source because they like the mission, the impact, and the values. In contrast, there are others who contribute to open source because their job requires or mandates it. Then there's people who have a mix of both. All three have wildly different values and historically corp…

> that referring to HashiCorp (and other) projects as "open source" is a half truth

Spot on. Corporate "open source" is often open only in terms of licensing, but not in terms of values.

Many companies use tricks to prevent successful forks and keep tight control over the development process.

Post reply on HN