Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

91–100 of 171 posts

Re: HashiCorp Boundary

#92

Post by lifty »

philsnow wrote: post #66
basch wrote: post #43

Earlier quoted context omitted.

Tailscale isnt a deny first, allow based on role/condition type product. Tailscale creates the equivalent of a wide open lan (it has other isolation options but that kind of control based on the identity of the person on the network, isnt its intended goal) where everyone connected can see everyone else.

From what little I know of both, Tailscale provides L2 access into a network that you might not otherwise have access and once you're in you can get anywhere from there, but Boundary hands out individual, already-connected TCP sockets directly to services running on endpoints. If you're looking for something like a VPN and you're just going to SSH over it, either would probably work for you, but while Boundary can al…

Tailscale is based on wireguard, so only does L3.

Re: HashiCorp Boundary

#93

Post by lifty »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Hey Mitchell, congrats on the new announcements, great stuff! Out of curiosity, how are you building and operate HCP? Are you running it on top of Kubernetes or Nomad, or you're doing some other custom stuff?

Re: HashiCorp Boundary

#94

Post by mitchellh »

lifty wrote: post #93
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Hey Mitchell, congrats on the new announcements, great stuff! Out of curiosity, how are you building and operate HCP? Are you running it on top of Kubernetes or Nomad, or you're doing some other custom stuff?

    - Full HashiCorp stack (Nomad, Consul, Vault, Terraform)
    - Cadence (https://temporal.io/)
    - Microservice architecture over gRPC and Consul Connect
    - All services written in Go
    - Customer clusters are created/managed by programmatically running Terraform using just-in-time cloud credentials from Vault
    - All internal TLS certs for customer clusters dynamically created using Vault
    - All external TLS certs for customer clusters dynamically created using LetsEncrypt via Terraform
    - Frontend is Ember

Re: HashiCorp Boundary

#96

Post by jcims »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Thinking of this as a means for privileged access management, would it be possible for Boundary to gather artifacts (e.g. keystroke logs and/or screen shots) from the session?

This might trigger some folks but have you explored any options for delivering some or all of the Boundary infrastructure through serverless/faas?

Re: HashiCorp Boundary

#97

Post by pferde »

luminousbit wrote: post #62

Personally I’ve been a big fan of strongDM ( https://www.strongdm.com/ ). Lightyears ahead of teleport or any of the other solutions out there. Built for great auditing and zero trust. Best of all it’s multi-protocol. So you can do SSH, SQL, K8s, HTTP all with one access system. Had it in prod for almost two years. Gonna be a long time before hashicorp or anyone else can catch up with the level of depth.

StrongDM does indeed look interesting. Can it be completely self-hosted? I am asking because some of the architecture docs mentioned "app.strongdm.com" as a necessary element, which has a webpage behind a (customer?) login. This is an external dependency that is not acceptable for my use case.

I haven't found a conclusive answer in their documentation yet.

Re: HashiCorp Boundary

#98

Post by newman314 »

NovemberWhiskey wrote: post #88
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know.

* Azure App Proxy

* Google IAP

* Amazon WorkLink

* Cloudflare Access

* Zscaler Private Access

* Duo Beyond

* Hashicorp Beyond

Re: HashiCorp Boundary

#99

Post by teknopaul »

This is great, I hope where I work never implementes it :) Getting access to everything in "one hop" is mighty convenient. Especially now that one hop involves 2fa and finding my phone down the back of the sofa while production has a sev one.

Re: HashiCorp Boundary

#100

Post by jaquers »

NovemberWhiskey wrote: post #88
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

https://smallstep.com/

One example. I have been testing smallstep, which puts IDP around ssh (with group management), and also includes a dynamic host catalog (hosts run an agent that phones home to your identity provider).

However, I am very excited about Boundary as it seems to be a much more comprehensive solution.

Post reply on HN