17 ms·

Infisical – open-source HashiCorp Vault alternative

284 points by vmatsiiako 3y ago

vmatsiiako 3y ago
HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future. Ultimately, it just means that HashiCorp is not an open source company anymore. One of the biggest benefits of open source is building on top of open source software to create even better software. HashiCorp's move makes it impossible and simply slows down innovation. In fact, in their blog post, they say that they will start referring to their previously-open-source product as "community". Infisical is an open source alternative to HashiCorp Vault. The main difference is that it provides more tools in one platform. Some examples of these are automatic secret scanning and leak prevention, CLI for local development, integrations with services like GitHub Actions, Circle CI, etc. The core of Infisical is available under the MIT license with only very few features being enterprise-licensed – some will say it's not ideal but at least this type of license does not impose legal risks on our users while gives us the ability to monetize the product efficiently and support the open source (MIT-based) part of the product. Over the last year, lots of developers and companies of all sizes (from tiny startups to Fortune 10 companies) have partially or fully switched to Infisical. For them, we now process over 300 million secrets per month. Check out our git repo here: https://github.com/Infisical/infisical https://github.com/Infisical/infisical
- brabel 3y ago
  I don't know anything about this product, but just wanted to say that's a really pretty README page :D
  - dangtony98 3y ago
    Thank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infisical https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)
    - fuddle 3y ago
      FYI I noticed a typo in the readme - "take a look at our webiste"
      - vmatsiiako 3y ago
        Thank you. Fixed!
- JonChesterfield 3y ago
  Regarding the open core and proprietary extensions model. The usual endgame of that is what hashicorp seems to have just done - deprecate the open source part in favour of the part that makes money. This bait&switch is no longer novel. Be open source friendly to leverage the community and then pull the rug is probably taught strategy in VC themed business schools by this point. If you're going to do the same thing in a while anyway, one may as well stay with hashicorp. Is there a reason to believe you will remain viable as an open source product long into the future?
- steeleduncan 3y ago
  This repo seems to have virtually no tests. Is that just the way it is? or do you charge for access to your test suite similar to what SQLite does?
- zie 3y ago
  Maybe I'm missing something, but Infisical ONLY seems to handle shared secrets. Vault handles a lot more, it can for instance create DB users on the fly, with the right permissions that will only live for as long as the vault token does. Vault also has a full CA system in-place, and can rotate secrets, etc. Does this product do things like that? I couldn't find anywhere where it does those things in the docs, though I admit I only scanned them.
dvrp 3y ago
Do you have other near-term next plans besides secret management?
- dangtony98 3y ago
  Definitely. Our plan is to double-down on secret management and branch outwards but incrementally starting with secret scanning to prevent and detect leaked secrets in codebases. Ultimately, we intend each initiative of our roadmap to have synergies with the rest of the platform. You can check out our past and immediate roadmap here: https://www.notion.so/be2d2585a6694e40889b03aef96ea36b?v=5b19a8127d1a4060b54769567a8785fa https://www.notion.so/be2d2585a6694e40889b03aef96ea36b?v=5b1...
  - dvrp 3y ago
    that's a sick roadmap! keep 'em coming :)
    - vmatsiiako 3y ago
      Thank you! If you have any feature suggestions, you're welcome to add those to https://github.com/Infisical/infisical/issues https://github.com/Infisical/infisical/issues
danenania 3y ago
EnvKey (https://www.envkey.com/ https://www.envkey.com/) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder). We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/ https://www.envkey.com/compare/hashicorp-vault/ We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we use native apps and a CLI rather than offering a web UI. End-to-end encryption in a web browser offers minimal security benefit for reasons discussed in this thread: https://news.ycombinator.com/item?id=21838795 https://news.ycombinator.com/item?id=21838795 (the discussion is from 2019 and the original NCCGroup link from 2011 is now dead, but all the same issues still apply). Also, I'm not sure if this has been addressed yet, but it has previously been noted that Infisical was completely lacking in automated tests. EnvKey has an extensive test suite ( core tests here: https://github.com/envkey/envkey/tree/main/public/app/tests https://github.com/envkey/envkey/tree/main/public/app/tests and tests for all our sdks are included in each: https://github.com/envkey/envkey/tree/main/public/sdks https://github.com/envkey/envkey/tree/main/public/sdks).
- vmatsiiako 3y ago
  In my opinion, "having no opt-outs" is not a benefit. It's by definition having less functionality. Infisical offers native SDKs, API, and CLI too + many other features (such as native integrations, webhooks, dashboard, etc).
  - danenania 3y ago
    There's an inherent tradeoff for sure. In my opinion, I wouldn't say that any added functionality a secrets management service can offer is worth trusting all that service's servers, all its backend dependencies, all its employees and contractors, all its third party sub-processors, etc. with plaintext secrets. I'd also note that we are able to offer all the features you list without requiring users to opt-out of end-to-end encryption.
    - vmatsiiako 3y ago
throwawaaarrgh 3y ago
Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.
- mirzap 3y ago
  What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.
  - vmatsiiako 3y ago
    This is indeed what we are going for. We want to provide a very predictable license that gives most of the features for free for developers while keeping the managerial features paid to make sure that we can support development and maintenance of Infisical.
  - Znafon 3y ago
    > What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? > Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. Sentry is using the BSL, the very same license that HashiCorp has switched to but that change has not been received well.
    - yencabulator 3y ago
      If Sentry used BSL from the beginning, and refrains from calling itself an "open source company", that's just another company doing its thing. It's the bait and switch and bullshit language ("evolving open source") that gets people riled up.
chrisfrantz 3y ago
Congrats to the Infisical team, it's been cool getting to watch them grow from the start. What are some of the biggest challenges you've run into so far?
- dvrp 3y ago
  i’m also interested in this. also how’s it going with loops?
  - chrisfrantz 3y ago
    hey thanks, loops is going well!
- vmatsiiako 3y ago
  Prioritizing feature requests and providing good quality support takes a lot of time and effort... You can check in our Slack (https://infisical.com/slack https://infisical.com/slack) that we try to reply to everyone within a couple minutes. This is definitely the biggest one, but it's worth it IMO!
smartbit 3y ago
Does Infisical support an HSM?
- Maidul98 3y ago
  At the moment we don't offer support for HSM but please make a request for it in our github issues https://github.com/Infisical/infisical/issue https://github.com/Infisical/infisical/issue
- vmatsiiako 3y ago
  We have heard many requests for it recently. If you could create an issue for it on our Git repo, we will make sure to prioritize it!
mirzap 3y ago
I remember trying Infiscal, and I was excited to see how good it is, the feature list in the OSS version, and its ease of use... What cooled me off is this limitation in OSS: "3 Infisical Projects, 3 Environments & 5 Team Members." That's not nice. It's OK to limit SSO access to OSS and stuff like that. But limiting essential features - team members is a no-go.
- vmatsiiako 3y ago
  This is very strange. There is no such limitation. You can create as many projects and environments as you need. You can also add an unlimited number of users
  - dangtony98 3y ago
    Second this, we don’t have any such limitations on OSS that is you can totally self-host Infisical on your own infrastructure and have unlimited users, projects, and environments. I think there may be a mix-up here with Infisical Cloud which is the managed service with subscription tiers.
    - mirzap 3y ago
      OK, that's great to hear. You may consider removing the "Usage & Billing" page from OSS when self-hosting. Because I thought I'd have to upgrade OSS with a business license once I reached the limit.
      - vmatsiiako 3y ago
        Yeah, we should probably do that. I get that it might be confusing
  - mirzap 3y ago
    Check the pricing page: https://infisical.com/pricing https://infisical.com/pricing Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)
lars_francke 3y ago
Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No
- hereonout2 3y ago
  Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.
  - steeleduncan 3y ago
    There appear to be some go tests as well, but again the ratio is not great
- quacker 3y ago
  At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests. I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.
- vmatsiiako 3y ago
  I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack https://infisical.com/slack
  - iLoveOncall 3y ago
    You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?
    - 3y ago
pluto_modadic 3y ago
I wish secret manager services were obsoleted by OIDC and HSMs. If everything negotiated via keypass & beyondprod style workload identification and... we never save passwords for DBs or web hooks ever again. ...it's annoying that a kubernetes-like complex system exists and it doesn't have to. And now they have a SaaS version for small numbers of secrets....
sergiotapia 3y ago
There has to be a middle ground where yes you can use this to your hearts content for free, but don't package and sell this to undercut our own hosted offering. It's pretty shitty what happened with mongodb and aws. Morally it always felt wrong.
ckwalsh 3y ago
Any plans for OIDC support?
- vmatsiiako 3y ago
  Yes, this has been requested quite a bit recently. Could you please comment in this issue: https://github.com/Infisical/infisical/issues/442 https://github.com/Infisical/infisical/issues/442 We will make sure to prioritize the OIDC support depending on how many people ask for it
rstat1 3y ago
MIT now, but in a few years when the inevitable need to make profit number bigger crops up they'll be doing the same thing. And there will the same backlash by people pretending that the change is some sort of grave slight and make bold claims about how they're switching away because they actually have to pay for stuff now. And the cycle will repeat ad nauseam.
- 3np 3y ago
  They haven't made contributors sign a CLA so no, they aren't legally in a position to do the same move.
iLoveOncall 3y ago
And still world-class testing: https://github.com/Infisical/infisical/blob/main/backend/tests/integration-tests/routes/v2/secrets.test.ts https://github.com/Infisical/infisical/blob/main/backend/tes... Don't use this untested mess to store your secrets.
drdaeman 3y ago
So the introduction says it’s “end-to-end encrypted” but all it does is a link to Wikipedia (which is useless). Is there any documentation on the security model? Vault has some at-rest encryption but IIRC explicitly says then don’t have any mitigations against a compromised unsealed node. My understanding is that if someone ever gets a root access to a machine running Vault, the game is over. Which makes me wonder ifI can deploy Infiscial to some completely untrusted machine (without any orchestration or networking concerns) and still have some guarantees that all my secrets are safe in some way (cannot be decrypted, cannot be replaced, maybe even cannot be rolled back, etc)?
- dangtony98 3y ago
  Hey! Definitely, we have more details on the cryptography in our documentation here: https://infisical.com/docs/security/overview https://infisical.com/docs/security/overview. Put simply, Infisical operates E2EE by default which means the platform itself can’t decrypt secrets. This is unless you opt out of E2EE (secrets remain encrypted at rest) to use select features like native integrations - this is, however, not necessary to use the platform. In your case, you might wish to run Infisical in E2EE mode for maximum security. That said, it’s always important for you to keep your instance of Infisical secure that is ideally to not allow bad actors to gain root access to the machine.
Jishin 3y ago
Another option, for companies that want to go full security over automations and kubernetes, is CyberArk Conjur. Its OpenSource is quite limited in features, but the Enterprise version is very complete.
ksajadi 3y ago
Infisical 3rd party integrations are one of the best things about it. They just work without having to deal with plugins or crazy configurations. Kudos to the team.
az2023 3y ago
[dead]
- lolinder 3y ago
  As a rule, plugging your own stuff on HN is actually acceptable, but it needs to be clearly labeled as a plug and you should do it under your own account. Doing it like this—throwaway account plugging a service with no disclosures of any kind—looks really suspicious.
- az2023 3y ago
  Yes, I work for Fortanix. I have added my email in my account. Please let me know if anything else is needed. I could not update my comment... Otherwise, I am happy to update my original comment as well.
revskill 3y ago
I tried infsical before, it's bad. It lacks of the most important feature: Auto save your form.
- vmatsiiako 3y ago
  Could you please explain what you mean by auto saving the form?
  - RadiozRadioz 3y ago
    Presumably they mean having their changes persist without clicking "submit"
  - revskill 3y ago
    I got angry once i lost all my input when i navigate away as i didn't remember i saved the form or not.

284 points by vmatsiiako 3y ago

HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future. Ultimately, it just means that HashiCorp is not an open source company anymore. One of the biggest benefits of open source is building on top of open source software to create even better software. HashiCorp's move makes it impossible and simply slows down innovation. In fact, in their blog post, they say that they will start referring to their previously-open-source product as "community". Infisical is an open source alternative to HashiCorp Vault. The main difference is that it provides more tools in one platform. Some examples of these are automatic secret scanning and leak prevention, CLI for local development, integrations with services like GitHub Actions, Circle CI, etc. The core of Infisical is available under the MIT license with only very few features being enterprise-licensed – some will say it's not ideal but at least this type of license does not impose legal risks on our users while gives us the ability to monetize the product efficiently and support the open source (MIT-based) part of the product. Over the last year, lots of developers and companies of all sizes (from tiny startups to Fortune 10 companies) have partially or fully switched to Infisical. For them, we now process over 300 million secrets per month. Check out our git repo here: https://github.com/Infisical/infisical https://github.com/Infisical/infisical

brabel 3y ago
I don't know anything about this product, but just wanted to say that's a really pretty README page :D
- dangtony98 3y ago
  Thank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infisical https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)
  - fuddle 3y ago
    FYI I noticed a typo in the readme - "take a look at our webiste"
    - vmatsiiako 3y ago
      Thank you. Fixed!
JonChesterfield 3y ago
Regarding the open core and proprietary extensions model. The usual endgame of that is what hashicorp seems to have just done - deprecate the open source part in favour of the part that makes money. This bait&switch is no longer novel. Be open source friendly to leverage the community and then pull the rug is probably taught strategy in VC themed business schools by this point. If you're going to do the same thing in a while anyway, one may as well stay with hashicorp. Is there a reason to believe you will remain viable as an open source product long into the future?
steeleduncan 3y ago
This repo seems to have virtually no tests. Is that just the way it is? or do you charge for access to your test suite similar to what SQLite does?
zie 3y ago
Maybe I'm missing something, but Infisical ONLY seems to handle shared secrets. Vault handles a lot more, it can for instance create DB users on the fly, with the right permissions that will only live for as long as the vault token does. Vault also has a full CA system in-place, and can rotate secrets, etc. Does this product do things like that? I couldn't find anywhere where it does those things in the docs, though I admit I only scanned them.

dvrp 3y ago

Do you have other near-term next plans besides secret management?

dangtony98 3y ago
Definitely. Our plan is to double-down on secret management and branch outwards but incrementally starting with secret scanning to prevent and detect leaked secrets in codebases. Ultimately, we intend each initiative of our roadmap to have synergies with the rest of the platform. You can check out our past and immediate roadmap here: https://www.notion.so/be2d2585a6694e40889b03aef96ea36b?v=5b19a8127d1a4060b54769567a8785fa https://www.notion.so/be2d2585a6694e40889b03aef96ea36b?v=5b1...
- dvrp 3y ago
  that's a sick roadmap! keep 'em coming :)
  - vmatsiiako 3y ago
    Thank you! If you have any feature suggestions, you're welcome to add those to https://github.com/Infisical/infisical/issues https://github.com/Infisical/infisical/issues

danenania 3y ago

EnvKey (https://www.envkey.com/ https://www.envkey.com/) is another OSS alternative to Vault with a bit more focus on security (disclaimer: I'm the founder). We have a comparison with Vault here: https://www.envkey.com/compare/hashicorp-vault/ https://www.envkey.com/compare/hashicorp-vault/ We'll probably write up a comparison with Infisical soon as well but I'd say the main thing is that our end-to-end encryption has no opt-outs (as Infisical does for many of its integrations), and we use native apps and a CLI rather than offering a web UI. End-to-end encryption in a web browser offers minimal security benefit for reasons discussed in this thread: https://news.ycombinator.com/item?id=21838795 https://news.ycombinator.com/item?id=21838795 (the discussion is from 2019 and the original NCCGroup link from 2011 is now dead, but all the same issues still apply). Also, I'm not sure if this has been addressed yet, but it has previously been noted that Infisical was completely lacking in automated tests. EnvKey has an extensive test suite ( core tests here: https://github.com/envkey/envkey/tree/main/public/app/tests https://github.com/envkey/envkey/tree/main/public/app/tests and tests for all our sdks are included in each: https://github.com/envkey/envkey/tree/main/public/sdks https://github.com/envkey/envkey/tree/main/public/sdks).

vmatsiiako 3y ago
In my opinion, "having no opt-outs" is not a benefit. It's by definition having less functionality. Infisical offers native SDKs, API, and CLI too + many other features (such as native integrations, webhooks, dashboard, etc).
- danenania 3y ago
  There's an inherent tradeoff for sure. In my opinion, I wouldn't say that any added functionality a secrets management service can offer is worth trusting all that service's servers, all its backend dependencies, all its employees and contractors, all its third party sub-processors, etc. with plaintext secrets. I'd also note that we are able to offer all the features you list without requiring users to opt-out of end-to-end encryption.
  - vmatsiiako 3y ago

throwawaaarrgh 3y ago

Backed by another corporation trying to monetize it. This will go well. This repo available under the MIT expat license, with the exception of the ee directory which will contain premium enterprise features requiring a Infisical license. I just sprained my eye sockets from rolling my eyes too hard.

mirzap 3y ago
What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. I also don't have anything against "enterprise features" for which you need a license, while most features are available in OSS version.
- vmatsiiako 3y ago
  This is indeed what we are going for. We want to provide a very predictable license that gives most of the features for free for developers while keeping the managerial features paid to make sure that we can support development and maintenance of Infisical.
- Znafon 3y ago
  > What's wrong with monetization? You understand that OSS's significant problem is a lack of funding, where authors don't want or don't know how to monetize their product? > Sentry looks like a good model for OSS, and it's proof that you can make a living from OSS. Sentry is using the BSL, the very same license that HashiCorp has switched to but that change has not been received well.
  - yencabulator 3y ago
    If Sentry used BSL from the beginning, and refrains from calling itself an "open source company", that's just another company doing its thing. It's the bait and switch and bullshit language ("evolving open source") that gets people riled up.

chrisfrantz 3y ago

Congrats to the Infisical team, it's been cool getting to watch them grow from the start. What are some of the biggest challenges you've run into so far?

dvrp 3y ago
i’m also interested in this. also how’s it going with loops?
- chrisfrantz 3y ago
  hey thanks, loops is going well!
vmatsiiako 3y ago
Prioritizing feature requests and providing good quality support takes a lot of time and effort... You can check in our Slack (https://infisical.com/slack https://infisical.com/slack) that we try to reply to everyone within a couple minutes. This is definitely the biggest one, but it's worth it IMO!

smartbit 3y ago

Does Infisical support an HSM?

Maidul98 3y ago
At the moment we don't offer support for HSM but please make a request for it in our github issues https://github.com/Infisical/infisical/issue https://github.com/Infisical/infisical/issue
vmatsiiako 3y ago
We have heard many requests for it recently. If you could create an issue for it on our Git repo, we will make sure to prioritize it!

mirzap 3y ago

I remember trying Infiscal, and I was excited to see how good it is, the feature list in the OSS version, and its ease of use... What cooled me off is this limitation in OSS: "3 Infisical Projects, 3 Environments & 5 Team Members." That's not nice. It's OK to limit SSO access to OSS and stuff like that. But limiting essential features - team members is a no-go.

vmatsiiako 3y ago
This is very strange. There is no such limitation. You can create as many projects and environments as you need. You can also add an unlimited number of users
- dangtony98 3y ago
  Second this, we don’t have any such limitations on OSS that is you can totally self-host Infisical on your own infrastructure and have unlimited users, projects, and environments. I think there may be a mix-up here with Infisical Cloud which is the managed service with subscription tiers.
  - mirzap 3y ago
    OK, that's great to hear. You may consider removing the "Usage & Billing" page from OSS when self-hosting. Because I thought I'd have to upgrade OSS with a business license once I reached the limit.
    - vmatsiiako 3y ago
      Yeah, we should probably do that. I get that it might be confusing
- mirzap 3y ago
  Check the pricing page: https://infisical.com/pricing https://infisical.com/pricing Yeah, I've noticed that the app is not enforcing that limit ATM, but the limit was clearly visible in the dashboard when I tried it a couple of months ago (OSS, docker)

lars_francke 3y ago

Last time I saw this mentioned here a few weeks ago someone mentioned that the whole code has no tests. Is that (still) true? If so: No

hereonout2 3y ago
Was interested so had a look and it appears to be the case. I found a directory backend/src with 27K lines of typescript, and backend/tests with 303 lines.
- steeleduncan 3y ago
  There appear to be some go tests as well, but again the ratio is not great
quacker 3y ago
At this time (4h after posting) they've responded to almost every other question/comment except this one, so they've seen this question and chosen not to respond, which means the answer is bad - no tests. I like the idea of a Vault alternative, but I won't use a security product in production that is not automatically tested for vulnerabilities and regressions.
vmatsiiako 3y ago
I must admit that the test coverage is still lower than we would want it to be. Currently, we are in the process of adding tests, and the test coverage will only keep increasing over the next few weeks. You can learn more about this in our community Slack: https://infisical.com/slack https://infisical.com/slack
- iLoveOncall 3y ago
  You said the same 5 months ago: https://news.ycombinator.com/item?id=34956592 https://news.ycombinator.com/item?id=34956592 Any reason to believe this to be true this time around?
  - 3y ago

pluto_modadic 3y ago

I wish secret manager services were obsoleted by OIDC and HSMs. If everything negotiated via keypass & beyondprod style workload identification and... we never save passwords for DBs or web hooks ever again. ...it's annoying that a kubernetes-like complex system exists and it doesn't have to. And now they have a SaaS version for small numbers of secrets....

sergiotapia 3y ago

There has to be a middle ground where yes you can use this to your hearts content for free, but don't package and sell this to undercut our own hosted offering. It's pretty shitty what happened with mongodb and aws. Morally it always felt wrong.

ckwalsh 3y ago

Any plans for OIDC support?

vmatsiiako 3y ago
Yes, this has been requested quite a bit recently. Could you please comment in this issue: https://github.com/Infisical/infisical/issues/442 https://github.com/Infisical/infisical/issues/442 We will make sure to prioritize the OIDC support depending on how many people ask for it

rstat1 3y ago

MIT now, but in a few years when the inevitable need to make profit number bigger crops up they'll be doing the same thing. And there will the same backlash by people pretending that the change is some sort of grave slight and make bold claims about how they're switching away because they actually have to pay for stuff now. And the cycle will repeat ad nauseam.

3np 3y ago
They haven't made contributors sign a CLA so no, they aren't legally in a position to do the same move.

iLoveOncall 3y ago

And still world-class testing: https://github.com/Infisical/infisical/blob/main/backend/tests/integration-tests/routes/v2/secrets.test.ts https://github.com/Infisical/infisical/blob/main/backend/tes... Don't use this untested mess to store your secrets.

drdaeman 3y ago

So the introduction says it’s “end-to-end encrypted” but all it does is a link to Wikipedia (which is useless). Is there any documentation on the security model? Vault has some at-rest encryption but IIRC explicitly says then don’t have any mitigations against a compromised unsealed node. My understanding is that if someone ever gets a root access to a machine running Vault, the game is over. Which makes me wonder ifI can deploy Infiscial to some completely untrusted machine (without any orchestration or networking concerns) and still have some guarantees that all my secrets are safe in some way (cannot be decrypted, cannot be replaced, maybe even cannot be rolled back, etc)?

dangtony98 3y ago
Hey! Definitely, we have more details on the cryptography in our documentation here: https://infisical.com/docs/security/overview https://infisical.com/docs/security/overview. Put simply, Infisical operates E2EE by default which means the platform itself can’t decrypt secrets. This is unless you opt out of E2EE (secrets remain encrypted at rest) to use select features like native integrations - this is, however, not necessary to use the platform. In your case, you might wish to run Infisical in E2EE mode for maximum security. That said, it’s always important for you to keep your instance of Infisical secure that is ideally to not allow bad actors to gain root access to the machine.

Jishin 3y ago

Another option, for companies that want to go full security over automations and kubernetes, is CyberArk Conjur. Its OpenSource is quite limited in features, but the Enterprise version is very complete.

ksajadi 3y ago

Infisical 3rd party integrations are one of the best things about it. They just work without having to deal with plugins or crazy configurations. Kudos to the team.

az2023 3y ago

[dead]

lolinder 3y ago
As a rule, plugging your own stuff on HN is actually acceptable, but it needs to be clearly labeled as a plug and you should do it under your own account. Doing it like this—throwaway account plugging a service with no disclosures of any kind—looks really suspicious.
az2023 3y ago
Yes, I work for Fortanix. I have added my email in my account. Please let me know if anything else is needed. I could not update my comment... Otherwise, I am happy to update my original comment as well.

revskill 3y ago

I tried infsical before, it's bad. It lacks of the most important feature: Auto save your form.

vmatsiiako 3y ago
Could you please explain what you mean by auto saving the form?
- RadiozRadioz 3y ago
  Presumably they mean having their changes persist without clicking "submit"
- revskill 3y ago
  I got angry once i lost all my input when i navigate away as i didn't remember i saved the form or not.