3 ms·
Hey, CEO of EnvKey here. Congrats on the launch! Adding a few points to your points: - The server portion of our v1 was closed source, but all client-side code
by danenania 4y ago
Hey, CEO of EnvKey here. Congrats on the launch! Adding a few points to your points:
- The server portion of our v1 was closed source, but all client-side code has been open source all along. Now we're fully open source, as you say.
- Syncing to other platforms can be useful, but apart from breaking end-to-end encryption, it more or less guarantees that you're going to end up with consistency bugs. This is just the nature of failure modes in distributed systems. EnvKey's single source of truth architecture ensures consistency. Config and secrets are always pulled from EnvKey rather than being duplicated across platforms. Also, since all that is needed to integrate with any platform is to set a single environment variable, custom-built integrations are rarely needed (we do have a light-weight one for Heroku, but that's it).
- Browser-based is good for UX and convenience, but it nullifies most of the security benefits of end-to-end encryption. Browser-based end-to-end encryption doesn't protect against attackers or insider threats.
I'd also add that we care a lot about UI and UX as well, but we see our goal as making the best UI and UX that is possible while offering real, uncompromising end-to-end encryption. This does require some UX tradeoffs, but in our view, given the sensitivity the data involved, they are worth it.