4 ms·

Show HN: Knox, Secrets as a Service

19 points by fabien-h 6y ago

fabien-h 6y ago
Look mama, I made this ! Knox is a SaaS (Secrets as a Service) that helps you manage your keys, secrets, and configurations.
gkapur 6y ago
Is this related to Pinterest's knox open source project? Also, how do you think about this in the landscape as there are lots of secret management solutions (including Hashicorp Vault, etc.)
- fabien-h 6y ago
  You are right, there are many secrets management services and they are good. But I address a specific need: be up and running in minutes. For solutions like the self-hosted version of Hashi Corp Vault (and Pinterest Knox apparently), you need to install it on a server, run it yourself, maintain the thing... This is work, I'm doing it for you. This is time, I'm spending it for you. This is money, you are saving a lot here. Managed solutions work too, but they are all an order of magnitude too complex, too expensive or both. There are more than 200 topics complex enough in Hashi Corp Vault to deserve a complete tutorial on their website https://learn.hashicorp.com/vault https://learn.hashicorp.com/vault. And this is not even the full documentation. If we want to make proper secrets management mainstream in small projects, it needs to be much more simple. With Knox, you have one view per project and you need a couple of minutes to learn everything there is to know. It does less, but you probably don't need more.
- fabien-h 6y ago
  Oh, I did not see the Pinterest project before. Not related. Thank you for pointing this :)
SkyLinx 6y ago
Why would I trust a random person with my secrets?
- fabien-h 6y ago
  The trust issue is real and that question is always valid. Like "hey, maybe there is a guy at hotmail that reads my emails and will do something bad with their content". But when you put your secrets in a single database for convenience, if there is a problem, you know where it comes from. And your secrets manager would suffer the consequences. That said, a optionnal simple zero-knowledge approach is very possible. You would have an encryption key that you enter locally and in your CI / server and you would never send your actual secrets, but an encrypted version of them. Is it something that would help you trust the service ?

19 points by fabien-h 6y ago

Look mama, I made this ! Knox is a SaaS (Secrets as a Service) that helps you manage your keys, secrets, and configurations.

gkapur 6y ago

Is this related to Pinterest's knox open source project? Also, how do you think about this in the landscape as there are lots of secret management solutions (including Hashicorp Vault, etc.)

fabien-h 6y ago
You are right, there are many secrets management services and they are good. But I address a specific need: be up and running in minutes. For solutions like the self-hosted version of Hashi Corp Vault (and Pinterest Knox apparently), you need to install it on a server, run it yourself, maintain the thing... This is work, I'm doing it for you. This is time, I'm spending it for you. This is money, you are saving a lot here. Managed solutions work too, but they are all an order of magnitude too complex, too expensive or both. There are more than 200 topics complex enough in Hashi Corp Vault to deserve a complete tutorial on their website https://learn.hashicorp.com/vault https://learn.hashicorp.com/vault. And this is not even the full documentation. If we want to make proper secrets management mainstream in small projects, it needs to be much more simple. With Knox, you have one view per project and you need a couple of minutes to learn everything there is to know. It does less, but you probably don't need more.
fabien-h 6y ago
Oh, I did not see the Pinterest project before. Not related. Thank you for pointing this :)

SkyLinx 6y ago

Why would I trust a random person with my secrets?

fabien-h 6y ago
The trust issue is real and that question is always valid. Like "hey, maybe there is a guy at hotmail that reads my emails and will do something bad with their content". But when you put your secrets in a single database for convenience, if there is a problem, you know where it comes from. And your secrets manager would suffer the consequences. That said, a optionnal simple zero-knowledge approach is very possible. You would have an encryption key that you enter locally and in your CI / server and you would never send your actual secrets, but an encrypted version of them. Is it something that would help you trust the service ?