6 ms·

Why would someone use this over Vault or SOPS? Your (somewhat condescending) "stuck using FTP instead of Dropbox" is a very poor characterization. I think you

Why would someone use this over Vault or SOPS? Your (somewhat condescending) "stuck using FTP instead of Dropbox" is a very poor characterization. I think you've entered into a very busy space without bringing anything new to the table.

bvallelunga 6y ago
I can see why you might think that at first glance, but I'd encourage you to try out Doppler. No secrets manager offers the flexibility and incredible ease of use that we do. I'm not going to dive into a feature list, because a lot of that is table stakes, but what really sets us apart is our philosophy. We have the explicit goal of making our customers not only more secure but also more productive. Find me a Vault customer that would describe their install as helping them move faster!
- auspex 6y ago
  I think I would focus a bit more on answering why this philosophy makes your product better than the proven secrets managers out there. I’m looking at products and comparing you against the established enterprise proven players. What really sets you apart from a product / use case standpoint.
quaffapint 6y ago
Vault is definitely much more of a beast, but it also does a lot more, such as dynamic credentials. For just storing static secret/env vars this seems like a simpler solution.
- tompic823 6y ago
  Great point about dynamic secrets. This is an area we currently don't address, but it is definitely on our roadmap. There is a segment of the market for which dynamic secrets are an absolute requirement and we fully acknowledge that.
  - shay_ker 6y ago
    Just out of curiosity - what do people use dynamic secrets for? What is a "dynamic" secret anyway?
    - quaffapint 6y ago
      A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.
      - shay_ker 6y ago
        how does that actually work? Vault has the user/password, and then acts as a gateway to the db?
        tecleandor 6y ago
        IIRC, Vault has plugins with GRANT access to your database, and rotates your passwords automatically. So it is able to create new users when access is requested, and to rotate passwords if needed. https://www.vaultproject.io/docs/secrets/databases/mysql-maria https://www.vaultproject.io/docs/secrets/databases/mysql-mar...
        quinndiggity 6y ago
        It looks like this https://www.nomadproject.io/docs/integrations/vault-integration#submitting-a-job-with-a-vault-namespace https://www.nomadproject.io/docs/integrations/vault-integrat... It's incredibly simple, and a breeze to use. ``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = <<EOF {{ with secret "database/creds/production" }} DB_USERNAME={{.Data.username}} DB_PASSWORD={{.Data.password}} {{ end }} EOF } } } } ``` edit: thanks HN formatting
        quinndiggity 6y ago

bvallelunga 6y ago

I can see why you might think that at first glance, but I'd encourage you to try out Doppler. No secrets manager offers the flexibility and incredible ease of use that we do. I'm not going to dive into a feature list, because a lot of that is table stakes, but what really sets us apart is our philosophy. We have the explicit goal of making our customers not only more secure but also more productive. Find me a Vault customer that would describe their install as helping them move faster!

auspex 6y ago
I think I would focus a bit more on answering why this philosophy makes your product better than the proven secrets managers out there. I’m looking at products and comparing you against the established enterprise proven players. What really sets you apart from a product / use case standpoint.

quaffapint 6y ago

Vault is definitely much more of a beast, but it also does a lot more, such as dynamic credentials. For just storing static secret/env vars this seems like a simpler solution.

tompic823 6y ago
Great point about dynamic secrets. This is an area we currently don't address, but it is definitely on our roadmap. There is a segment of the market for which dynamic secrets are an absolute requirement and we fully acknowledge that.
- shay_ker 6y ago
  Just out of curiosity - what do people use dynamic secrets for? What is a "dynamic" secret anyway?
  - quaffapint 6y ago
    A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.
    - shay_ker 6y ago
      how does that actually work? Vault has the user/password, and then acts as a gateway to the db?
      - tecleandor 6y ago
        IIRC, Vault has plugins with GRANT access to your database, and rotates your passwords automatically. So it is able to create new users when access is requested, and to rotate passwords if needed. https://www.vaultproject.io/docs/secrets/databases/mysql-maria https://www.vaultproject.io/docs/secrets/databases/mysql-mar...
      - quinndiggity 6y ago
        It looks like this https://www.nomadproject.io/docs/integrations/vault-integration#submitting-a-job-with-a-vault-namespace https://www.nomadproject.io/docs/integrations/vault-integrat... It's incredibly simple, and a breeze to use. ``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = <<EOF {{ with secret "database/creds/production" }} DB_USERNAME={{.Data.username}} DB_PASSWORD={{.Data.password}} {{ end }} EOF } } } } ``` edit: thanks HN formatting
        quinndiggity 6y ago