4 ms·

In my opinion, "having no opt-outs" is not a benefit. It's by definition having less functionality. Infisical offers native SDKs, API, and CLI too + many other

In my opinion, "having no opt-outs" is not a benefit. It's by definition having less functionality. Infisical offers native SDKs, API, and CLI too + many other features (such as native integrations, webhooks, dashboard, etc).

danenania 3y ago
There's an inherent tradeoff for sure. In my opinion, I wouldn't say that any added functionality a secrets management service can offer is worth trusting all that service's servers, all its backend dependencies, all its employees and contractors, all its third party sub-processors, etc. with plaintext secrets. I'd also note that we are able to offer all the features you list without requiring users to opt-out of end-to-end encryption.
- vmatsiiako 3y ago
  Interesting. We work with some of the largest companies out there, and none of them had an issue with this. Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?
  - danenania 3y ago
    "We work with some of the largest companies out there, and none of them had an issue with this." I imagine they'll regret this if you have a security incident. "Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?" We don't have a native integration with Vercel (you didn't list that in your comment, which is what I was referring to). We don't really have a need for one since all that's required to integrate EnvKey with Vercel is setting a single environment variable. That said, if we did decide to build an official Vercel integration, we wouldn't require removing end-to-end encryption to use it.
nine_k 3y ago
In the security domain, you often want fewer features, because every feature is another thing to audit, and another chance to introduce a vulnerability. But, of course, too few features can be just impractical.

danenania 3y ago

There's an inherent tradeoff for sure. In my opinion, I wouldn't say that any added functionality a secrets management service can offer is worth trusting all that service's servers, all its backend dependencies, all its employees and contractors, all its third party sub-processors, etc. with plaintext secrets. I'd also note that we are able to offer all the features you list without requiring users to opt-out of end-to-end encryption.

vmatsiiako 3y ago
Interesting. We work with some of the largest companies out there, and none of them had an issue with this. Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?
- danenania 3y ago
  "We work with some of the largest companies out there, and none of them had an issue with this." I imagine they'll regret this if you have a security incident. "Curious how you are able to create a native integration with, let's say, Vercel without requiring users to opt-out of end-to-end encryption?" We don't have a native integration with Vercel (you didn't list that in your comment, which is what I was referring to). We don't really have a need for one since all that's required to integrate EnvKey with Vercel is setting a single environment variable. That said, if we did decide to build an official Vercel integration, we wouldn't require removing end-to-end encryption to use it.

nine_k 3y ago

In the security domain, you often want fewer features, because every feature is another thing to audit, and another chance to introduce a vulnerability. But, of course, too few features can be just impractical.