Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

71–80 of 171 posts

Re: HashiCorp Boundary

#71

Post by sytse »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

This is awesome, thanks for making this. Boundary seems like the missing open source building block to achieve Zero Trust.

Zero Trust means authenticating per application instead of per network. For more context see https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-t...

Proxying connections as Boundary does seems like the most elegant solution to achieve this in a way that doesn't require modifying the application.

Re: HashiCorp Boundary

#72

Post by mike-cardwell »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;)

E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially if Boundary is backed by Consul.

Re: HashiCorp Boundary

#73

Post by mrweasel »

mike-cardwell wrote: post #72
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…

Maybe you’re not using Terraform. I suspect that your problem is an insufficient usage of HCL.

Re: HashiCorp Boundary

#74

Post by fishnchips »

candiddevmike wrote: post #23
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

I think it's not a fair thing to say. HashiCorp's projects are using MPL 2.0, and please correct me if I'm wrong (IANAL!) it would allow you to create an open source fork of say consul, call it OpenConsul and continue development there. That this hasn't happened yet (or if it did, it never gained any traction) is a testament to HashiCorp being a responsible custodian of its projects and their respective communities.

Re: HashiCorp Boundary

#75

Post by kodah »

candiddevmike wrote: post #23
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

Man, this really represents the rift in Open Source and Corporate development right now. It seems like there are developers who contribute to Open Source because they like the mission, the impact, and the values. In contrast, there are others who contribute to open source because their job requires or mandates it. Then there's people who have a mix of both.

All three have wildly different values and historically corporations aren't very good at listening to anyone that isn't waving a check. They use reasoning like "priorities" to close source formerly open source projects, bend project values to reflect their own values, and wedge projects with funding in exchange for representation or control. Corporate controlled and born projects are often used as marketing or for good PR, a cursory browsing of a company's Twitter page will show how they utilize it for this type of end.

I don't really read Mitchell's speak as corporate or double speak, but I do think that referring to HashiCorp (and other) projects as "open source" is a half truth. The line that I draw here is that I don't think Mitchell is lying, rather, I think that open source is now an umbrella term that means very little and really terms like open core, free and open source software, etc are more concise. We owe that outcome to inviting our corporate friends into the fold of open source with not enough restrictions, tracking, and accountability but there's a piece of me that feels this outcome was largely intentional because it's become a means to an end as I described above. These could just be feelings but the situation is common enough that it's relatable.

I'd encourage corporations to be more transparent in their verbiage, their investments, and their representation in these projects so that it doesn't continue to confuse people who participate in and enjoy the "free" side of open source. When I look at an open source project I'd love to know if a majority of the maintainers or funding comes from a corporation. If those things are true, then as someone who highly believes in the ideals of free software I may want to stay far away from people who are susceptible to corporate influence and values. On the other hand, that increased transparency may help clear the air and prevent issues from being perceived as non-transparent or outright misrepresentation.

Re: HashiCorp Boundary

#76

Post by faitswulff »

> With Boundary, access is based on the trusted identity of the user, rather than their network location. The user connects and authenticates to Boundary, then based on their assigned roles they can connect to available hosts, services, or cloud resources.

Is this the main idea behind BeyondCorp and CloudFlare One, as well? If so this is the clearest explanation I've seen of it.

Re: HashiCorp Boundary

#77

Post by atonse »

wmf wrote: post #51
fallat wrote: post #44

Earlier quoted context omitted.

It's understandable the issue brought up, but the history of the company we are talking about (and not just generalize!) must be considered. Is HashiCorp known to do this? All I've heard are good things about HashiCorp from people who use HashiCorp products. Second, it can't be forgotten these are companies. A company exists to create value for itself in some way. It's the natural behavior of any company. However in…

Some people felt burned by Vault where it looked like the free version could be used in production but it couldn't and then the enterprise version is very expensive.

Err what? Vault can absolutely be used in production for free. If you want the enterprise features, then you pay.

Re: HashiCorp Boundary

#78

Post by ETHisso2017 »

mrweasel wrote: post #73
mike-cardwell wrote: post #72

Earlier quoted context omitted.

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…

Maybe you’re not using Terraform. I suspect that your problem is an insufficient usage of HCL.

All hail Hashi-stack!

Re: HashiCorp Boundary

#79

Post by res0nat0r »

windexh8er wrote: post #15
yegle wrote: post #8

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…

Also looks very much like Gravitational Teleport [0], which has been amazing to use. Teleport has a lot of advantages over Boundary right now based on it's architecture. But Hashi does a good job of iterating quickly, so I'd guess as with most of their products, it evolves quickly. [0] https://gravitational.com/teleport/ Disclaimer: I have no affiliation with any of these companies.

Also similar to Cloudflare One which was just announced: https://blog.cloudflare.com/introducing-cloudflare-one/

I think moving away from VPN's is gaining more adoption and a good thing overall.

Re: HashiCorp Boundary

#80

Post by rodgerd »

This looks wonderful. I spend a lot of time and energy trying to keep people from breaking modern infra with 1980s IP-based security models, and this could be another tool in the arsenal to help with that.
Post reply on HN