Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

51–60 of 171 posts

Re: HashiCorp Boundary

#51

Post by wmf »

fallat wrote: post #44
candiddevmike wrote: post #23

Earlier quoted context omitted.

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered. Is HashiCorp known to do this? All I've heard are good things about HashiCorp from people who use HashiCorp products. Second, it can't be forgotten these are companies. A company exists to create value for itself in some way. It's the natural behavior of any company. However in…

Some people felt burned by Vault where it looked like the free version could be used in production but it couldn't and then the enterprise version is very expensive.

Re: HashiCorp Boundary

#52

Post by cratermoon »

yegle wrote: post #8

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…

I immediately thought of BeyondCorp as well, and I have only read the papers about it. At my employer, which isn't even that large, we have on-prem hardware running VMs and k8s, some stuff in AWS, some stuff in Azure, and employees all over the world with various devices coming in through a VPN.

The old distinction of "internal network" and "external network" doesn't make much sense.

Re: HashiCorp Boundary

#53

Post by A_No_Name_Mouse »

armon wrote: post #41
A_No_Name_Mouse wrote: post #27

Earlier quoted context omitted.

Is there a simple paper that explains how this works on a technical level? I have a hard time visualizing how a connection to a remote host would be set up if it runs through Boundary. Does "without requiring direct network access" mean Boundary works as a proxy? And how does Boundary enable the connection if the host does not have direct network access?

We don't have a white paper on this yet, but we have a white board video that explains both how it works conceptually as well as at a more technical level of deployment architecture and data flow. https://www.youtube.com/watch?v=tUMe7EsXYBQ&feature=emb_titl...

Wonderful video, really clear!

Re: HashiCorp Boundary

#54

Post by parliament32 »

armon wrote: post #37
zokier wrote: post #18

Earlier quoted context omitted.

Some sort of LD_PRELOAD style trickery? Or are they intercepting syscalls? edit: seems nothing that complicated, more like ssh-style tunnel where Boundary has a local listening socket which you need to point the client to. That is if I'm understanding it correctly.

That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.

So does it intercept all connections on that port (from the client app) and pass them along? Or do I need to reconfigure my client application to talk to localhost:whatever? Your only example is that curl using a hostname, it's not really clear.

Re: HashiCorp Boundary

#55

Post by cratermoon »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Over in another thread this was compared to Google's BeyondCorp. Can you comment and compare/contrast Boundary with the concepts of BeyondCorp?

Re: HashiCorp Boundary

#56

Post by Diederich »

wmf wrote: post #51
fallat wrote: post #44

Earlier quoted context omitted.

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered. Is HashiCorp known to do this? All I've heard are good things about HashiCorp from people who use HashiCorp products. Second, it can't be forgotten these are companies. A company exists to create value for itself in some way. It's the natural behavior of any company. However in…

Some people felt burned by Vault where it looked like the free version could be used in production but it couldn't and then the enterprise version is very expensive.

Why can't the free version of Vault be used in production?

Re: HashiCorp Boundary

#57

Post by armon »

parliament32 wrote: post #54
armon wrote: post #37

Earlier quoted context omitted.

That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.

So does it intercept all connections on that port (from the client app) and pass them along? Or do I need to reconfigure my client application to talk to localhost:whatever? Your only example is that curl using a hostname, it's not really clear.

You would point the application at the local port. It operates very similarly to SSH port forwarding. No fancy magic to intercept all traffic.

Re: HashiCorp Boundary

#58

Post by A_No_Name_Mouse »

jefferai wrote: post #33
A_No_Name_Mouse wrote: post #27

Earlier quoted context omitted.

Is there a simple paper that explains how this works on a technical level? I have a hard time visualizing how a connection to a remote host would be set up if it runs through Boundary. Does "without requiring direct network access" mean Boundary works as a proxy? And how does Boundary enable the connection if the host does not have direct network access?

By "direct network access" we mean between the client and the end host. The Boundary worker node (which proxies traffic) would need to be able to make a network connection to the end host, and the client in turn would need to be able to make a network connection to the worker node. This indirection provides a way to keep your public and private (or even private and private) networks distinct to remove "being on the s…

I can see how that works for an internal network. How does this work for SaaS solutions that would normally be directly on the internet? Would they have to be "shielded" to be on a private network and somehow be "Boundary enabled"?

And could this be done in a way that is completely transparent to the user (without them having to start a connection to the worker first, and then make a connection to the desired service)?

Re: HashiCorp Boundary

#59

Post by gen220 »

wmf wrote: post #51
fallat wrote: post #44

Earlier quoted context omitted.

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered. Is HashiCorp known to do this? All I've heard are good things about HashiCorp from people who use HashiCorp products. Second, it can't be forgotten these are companies. A company exists to create value for itself in some way. It's the natural behavior of any company. However in…

Some people felt burned by Vault where it looked like the free version could be used in production but it couldn't and then the enterprise version is very expensive.

> it looks like the free version can be used in production

I think you might be confusing vault with another product?

We self-host vault in production, and it doesn't cost us a dime.

(other than the engineers we pay internally to operate it, of course)

Re: HashiCorp Boundary

#60

Post by jolux »

basch wrote: post #42
jolux wrote: post #2

Seems like the BeyondCorp-ish “zero trust” remote access space is heating up. This looks similar in some ways to Cloudflare One which was announced Monday: https://blog.cloudflare.com/introducing-cloudflare-one/

It's already pretty crowded. https://telegra.ph/ZeroTrust-Vendors-04-23 Expect consolidation. That or it becomes a commodity expectation of any other purchase, and not a selling point.

I’m expecting both. Probably a standard AWS/IAM feature eventually.
Post reply on HN