Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

41–50 of 171 posts

Re: HashiCorp Boundary

#41

Post by armon »

A_No_Name_Mouse wrote: post #27
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Is there a simple paper that explains how this works on a technical level? I have a hard time visualizing how a connection to a remote host would be set up if it runs through Boundary. Does "without requiring direct network access" mean Boundary works as a proxy? And how does Boundary enable the connection if the host does not have direct network access?

We don't have a white paper on this yet, but we have a white board video that explains both how it works conceptually as well as at a more technical level of deployment architecture and data flow. https://www.youtube.com/watch?v=tUMe7EsXYBQ&feature=emb_titl...

Re: HashiCorp Boundary

#42

Post by basch »

jolux wrote: post #2

Seems like the BeyondCorp-ish “zero trust” remote access space is heating up. This looks similar in some ways to Cloudflare One which was announced Monday: https://blog.cloudflare.com/introducing-cloudflare-one/

It's already pretty crowded. https://telegra.ph/ZeroTrust-Vendors-04-23

Expect consolidation. That or it becomes a commodity expectation of any other purchase, and not a selling point.

Re: HashiCorp Boundary

#43

Post by basch »

arcticfox wrote: post #39
PaulWaldman wrote: post #35

I want to give a shout out to Tailscale. It relies on Wireguard and has been dead simple to setup and configure. Stability has been great as well.

I am also a big Tailscale fan, is anyone able to do a quick comparison on how Boundary relates?

Tailscale isnt a deny first, allow based on role/condition type product. Tailscale creates the equivalent of a wide open lan (it has other isolation options but that kind of control based on the identity of the person on the network, isnt its intended goal) where everyone connected can see everyone else.

Re: HashiCorp Boundary

#44

Post by fallat »

candiddevmike wrote: post #23
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered.

Is HashiCorp known to do this?

All I've heard are good things about HashiCorp from people who use HashiCorp products.

Second, it can't be forgotten these are companies. A company exists to create value for itself in some way.

It's the natural behavior of any company.

However in my opinion, "open core" design seems to be very very preferable amongst technologists (myself included). Essentially we are paying for additional features which normally we'd wait years from a sole contributor.

Re: HashiCorp Boundary

#45

Post by zellyn »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Looks great! A couple of questions:

Can you view logs of SSH sessions after the fact?

Can you live-view a session?

Can you require a pairing authorization like with https://github.com/square/sudo_pair?

Re: HashiCorp Boundary

#47

Post by time0ut »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Do you think there will be any synergy or potential interaction with consul connect at some point?

Re: HashiCorp Boundary

#48

Post by mitchellh »

zellyn wrote: post #45
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Looks great! A couple of questions: Can you view logs of SSH sessions after the fact? Can you live-view a session? Can you require a pairing authorization like with https://github.com/square/sudo_pair ?

All of the above is on the roadmap.

Our initial focus is on making the connections easy. We have some work to do there still. We'll then move on to more management features like this. They're both super important but from an initial adoption perspective we feel the latter is moot if the former (connections) don't work easily.

Re: HashiCorp Boundary

#49

Post by mitchellh »

time0ut wrote: post #47
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Do you think there will be any synergy or potential interaction with consul connect at some point?

Absolutely, 100%. This is already well discussed internally. :)

Re: HashiCorp Boundary

#50

Post by zellyn »

mitchellh wrote: post #48
zellyn wrote: post #45

Earlier quoted context omitted.

Looks great! A couple of questions: Can you view logs of SSH sessions after the fact? Can you live-view a session? Can you require a pairing authorization like with https://github.com/square/sudo_pair ?

All of the above is on the roadmap. Our initial focus is on making the connections easy. We have some work to do there still. We'll then move on to more management features like this. They're both super important but from an initial adoption perspective we feel the latter is moot if the former (connections) don't work easily.

Makes sense. You should integrate TailScale too, so you don't need to shunt traffic through the boundary nodes
Post reply on HN