3 ms·
HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercia
by vmatsiiako 3y ago
HashiCorp switched Vault from MPL to BSL license yesterday. The terms of how they define "competitive" products are pretty vague, which means that any commercial product that uses Vault under the hood is at risk of violating the terms of the new license. Moreover, even if it's not violating the terms of license now, it doesn't mean that HashiCorp will not change its mind in future.
Ultimately, it just means that HashiCorp is not an open source company anymore. One of the biggest benefits of open source is building on top of open source software to create even better software. HashiCorp's move makes it impossible and simply slows down innovation. In fact, in their blog post, they say that they will start referring to their previously-open-source product as "community".
Infisical is an open source alternative to HashiCorp Vault. The main difference is that it provides more tools in one platform. Some examples of these are automatic secret scanning and leak prevention, CLI for local development, integrations with services like GitHub Actions, Circle CI, etc.
The core of Infisical is available under the MIT license with only very few features being enterprise-licensed – some will say it's not ideal but at least this type of license does not impose legal risks on our users while gives us the ability to monetize the product efficiently and support the open source (MIT-based) part of the product.
Over the last year, lots of developers and companies of all sizes (from tiny startups to Fortune 10 companies) have partially or fully switched to Infisical. For them, we now process over 300 million secrets per month.
Check out our git repo here: https://github.com/Infisical/infisical https://github.com/Infisical/infisical
- brabel 3y agoI don't know anything about this product, but just wanted to say that's a really pretty README page :D
- dangtony98 3y agoThank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infisical https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)
- fuddle 3y agoFYI I noticed a typo in the readme - "take a look at our webiste"
- vmatsiiako 3y agoThank you. Fixed!
- JonChesterfield 3y agoRegarding the open core and proprietary extensions model. The usual endgame of that is what hashicorp seems to have just done - deprecate the open source part in favour of the part that makes money. This bait&switch is no longer novel. Be open source friendly to leverage the community and then pull the rug is probably taught strategy in VC themed business schools by this point. If you're going to do the same thing in a while anyway, one may as well stay with hashicorp. Is there a reason to believe you will remain viable as an open source product long into the future?
- steeleduncan 3y agoThis repo seems to have virtually no tests. Is that just the way it is? or do you charge for access to your test suite similar to what SQLite does?
- zie 3y agoMaybe I'm missing something, but Infisical ONLY seems to handle shared secrets. Vault handles a lot more, it can for instance create DB users on the fly, with the right permissions that will only live for as long as the vault token does. Vault also has a full CA system in-place, and can rotate secrets, etc. Does this product do things like that? I couldn't find anywhere where it does those things in the docs, though I admit I only scanned them.