5 ms·

Hi, This is concerning. To me it looks like there is a holy war going on with devs who maintain a secrets manager. The last thing I want is instability with th

Hi, This is concerning. To me it looks like there is a holy war going on with devs who maintain a secrets manager. The last thing I want is instability with the tool that holds my passwords and credentials. On the low end of my concern is the annoyance of constantly updating names in yaml files, and on the high end is worry that a rogue dev could deliberately add in a security hole that would compromise my secrets. Is there any assurance this won't happen?

mt42or 3y ago
Just pay for it so.
- aestetix 3y ago
  It's not about money, it's about trust.
  - api 3y ago
    What could Hashicorp have done to preserve trust while maintaining some kind of business model and being able to charge companies monetizing their software?
    - brodock 3y ago
      Outcompete them. Do more, do better, do faster
      - aestetix 3y ago
        But "move fast and break things" is precisely the opposite of what I want for a place where I store my passwords.
      - api 3y ago
        So software makers should give their competitors their software with a liberal free “as in beer” license and then try to compete with them. This isn’t a workable or sustainable model. The companies leveraging free software don’t have to work nearly as hard on software which means they can focus 100% on ops and marketing. And of course they don’t give anything back to the software creators.
        growse 3y ago
        > So software makers should give their competitors their software with a liberal free “as in beer” license and then try to compete with them. This is literally what they did when they released their product code under an OSS license. It was their free choice. > This isn’t a workable or sustainable model. The companies leveraging free software don’t have to work nearly as hard on software which means they can focus 100% on ops and marketing. And of course they don’t give anything back to the software creators The other companies might not need to work so hard, but they also have little to no control. If you can't build a sustainable business on a piece of software when you are the steward of that software, control the product direction and backlog etc., then you're not very good at the business. Or, put another way, if your business success hinges on people not competing when they have access to (and license to use) your source code, when releasing it under an OSS license demonstrates that you're not very good at the business.
        api 3y ago
        > If you can't build a sustainable business on a piece of software when you are the steward of that software, control the product direction and backlog etc., then you're not very good at the business. The elephant in the room here is that software is incredibly expensive. Developing and maintaining a large project requires a large team of high salary software devs. I’d estimate the cost of building, supporting, and maintaining Vault at $3-4M a year bare minimum for the core team and related overhead. It also takes a ton of energy and focus all the way to the top of the organization. The company building and maintaining the software must spend that. Someone just using the software to resell in the cloud or rebranding it can instead put all that money and mental energy into marketing and ops. The company that does not have to maintain the software has a massive advantage. They’re freed from that burden.
        growse 3y ago
        > The elephant in the room here is that software is incredibly expensive. Developing and maintaining a large project requires a large team of high salary software devs. There's plenty of expensive, major open source projects that seem to have figured this out. The fact that Hashicop can't doesn't mean the model is broken, it just means Hashicorp aren't very good at this. > Someone just using the software to resell in the cloud or rebranding it can instead put all that money and mental energy into marketing and ops. It's not that simple. Once again, the "reseller" doesn't have control over the direction of their business. Which means they should always fail, long term, relative to the org that actually spends the money on controlling the development. If you can't compete and outmanoeuvre someone who's simply slapping a label on your software, you probably shouldn't release your software under an OSS license. > The company that does not have to maintain the software has a massive advantage. They’re freed from that burden. I think it's pretty clear that we both take very different views on what maintaining and developing software means. You see it as a massive burden, I see it as an enormous advantage / opportunity.
    - aestetix 3y ago
      So the answer is that I can't trust either Hashicorp or the forks?
      - henriquez 3y ago
        You can only trust code you write and control yourself ultimately. How can you trust your operating system isn’t siphoning your doge coins as we speak?
        orthecreedence 3y ago
        I encrypt my dogecoins with base64 before putting them in Vault so...
        api 3y ago
        Nah bruh rot13 ftw
maronato 3y ago
Hashicorp’s offering won’t be more vulnerable now than before, so use it instead of the fork.
aestetix 3y ago
It's a bit scary how much I am being downvoted for asking what I believe to be a reasonable question. I was expecting someone from the new project to give a quick response with a few points of assurance, and instead I am getting told to go to the very group that downvoters do not trust. This does not make sense to me.
- gabeio 3y ago
  > It's a bit scary how much I am being downvoted for asking what I believe to be a reasonable question. > On the low end of my concern is the annoyance of constantly updating names in yaml files, and on the high end is worry that a rogue dev could deliberately add in a security hole that would compromise my secrets. > Is there any assurance this won't happen? This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assurances you need to pay up.
  - aestetix 3y ago
    > This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assurances you need to pay up. Sure it is. This is what third party security audits exist for. For example: https://www.hashicorp.com/solutions/auditing-and-compliance https://www.hashicorp.com/solutions/auditing-and-compliance This isn't unique to Hashicorp. Any organization which claims to offer secure protection should be willing to share this kind of information. https://docs.securedrop.org/en/stable/what_is_securedrop.html#audits https://docs.securedrop.org/en/stable/what_is_securedrop.htm... https://threatpost.com/openssl-security-audit-ready-to-start/111538/ https://threatpost.com/openssl-security-audit-ready-to-start... The point here is not "we pay more money and get better security." That's the kind of garbage logic the SSL CA cabal used for decades to maintain a monopoly before LetsEncrypt showed up. The question is, what is an indication that, although there is clearly some drama, that I can trust the software with my secrets? Did some of the people come to this new project from the Hashicorp security team? Could it be that the majority of changes in codebase are on the UX/UI, and not the security protocol implementation? There are plenty of ways to publish trust validation without demanding that a potential user spend hours poring through code looking for exploits.

mt42or 3y ago

Just pay for it so.

aestetix 3y ago
It's not about money, it's about trust.
- api 3y ago
  What could Hashicorp have done to preserve trust while maintaining some kind of business model and being able to charge companies monetizing their software?
  - brodock 3y ago
    Outcompete them. Do more, do better, do faster
    - aestetix 3y ago
      But "move fast and break things" is precisely the opposite of what I want for a place where I store my passwords.
    - api 3y ago
      So software makers should give their competitors their software with a liberal free “as in beer” license and then try to compete with them. This isn’t a workable or sustainable model. The companies leveraging free software don’t have to work nearly as hard on software which means they can focus 100% on ops and marketing. And of course they don’t give anything back to the software creators.
      - growse 3y ago
        > So software makers should give their competitors their software with a liberal free “as in beer” license and then try to compete with them. This is literally what they did when they released their product code under an OSS license. It was their free choice. > This isn’t a workable or sustainable model. The companies leveraging free software don’t have to work nearly as hard on software which means they can focus 100% on ops and marketing. And of course they don’t give anything back to the software creators The other companies might not need to work so hard, but they also have little to no control. If you can't build a sustainable business on a piece of software when you are the steward of that software, control the product direction and backlog etc., then you're not very good at the business. Or, put another way, if your business success hinges on people not competing when they have access to (and license to use) your source code, when releasing it under an OSS license demonstrates that you're not very good at the business.
        api 3y ago
        > If you can't build a sustainable business on a piece of software when you are the steward of that software, control the product direction and backlog etc., then you're not very good at the business. The elephant in the room here is that software is incredibly expensive. Developing and maintaining a large project requires a large team of high salary software devs. I’d estimate the cost of building, supporting, and maintaining Vault at $3-4M a year bare minimum for the core team and related overhead. It also takes a ton of energy and focus all the way to the top of the organization. The company building and maintaining the software must spend that. Someone just using the software to resell in the cloud or rebranding it can instead put all that money and mental energy into marketing and ops. The company that does not have to maintain the software has a massive advantage. They’re freed from that burden.
        growse 3y ago
        > The elephant in the room here is that software is incredibly expensive. Developing and maintaining a large project requires a large team of high salary software devs. There's plenty of expensive, major open source projects that seem to have figured this out. The fact that Hashicop can't doesn't mean the model is broken, it just means Hashicorp aren't very good at this. > Someone just using the software to resell in the cloud or rebranding it can instead put all that money and mental energy into marketing and ops. It's not that simple. Once again, the "reseller" doesn't have control over the direction of their business. Which means they should always fail, long term, relative to the org that actually spends the money on controlling the development. If you can't compete and outmanoeuvre someone who's simply slapping a label on your software, you probably shouldn't release your software under an OSS license. > The company that does not have to maintain the software has a massive advantage. They’re freed from that burden. I think it's pretty clear that we both take very different views on what maintaining and developing software means. You see it as a massive burden, I see it as an enormous advantage / opportunity.
  - aestetix 3y ago
    So the answer is that I can't trust either Hashicorp or the forks?
    - henriquez 3y ago
      You can only trust code you write and control yourself ultimately. How can you trust your operating system isn’t siphoning your doge coins as we speak?
      - orthecreedence 3y ago
        I encrypt my dogecoins with base64 before putting them in Vault so...
        api 3y ago
        Nah bruh rot13 ftw

maronato 3y ago

Hashicorp’s offering won’t be more vulnerable now than before, so use it instead of the fork.

aestetix 3y ago

It's a bit scary how much I am being downvoted for asking what I believe to be a reasonable question. I was expecting someone from the new project to give a quick response with a few points of assurance, and instead I am getting told to go to the very group that downvoters do not trust. This does not make sense to me.

gabeio 3y ago
> It's a bit scary how much I am being downvoted for asking what I believe to be a reasonable question. > On the low end of my concern is the annoyance of constantly updating names in yaml files, and on the high end is worry that a rogue dev could deliberately add in a security hole that would compromise my secrets. > Is there any assurance this won't happen? This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assurances you need to pay up.
- aestetix 3y ago
  > This isn’t really a reasonable request. You can do any of this yourself as well, so your assurances are your own. If you want someone else to own those assurances you need to pay up. Sure it is. This is what third party security audits exist for. For example: https://www.hashicorp.com/solutions/auditing-and-compliance https://www.hashicorp.com/solutions/auditing-and-compliance This isn't unique to Hashicorp. Any organization which claims to offer secure protection should be willing to share this kind of information. https://docs.securedrop.org/en/stable/what_is_securedrop.html#audits https://docs.securedrop.org/en/stable/what_is_securedrop.htm... https://threatpost.com/openssl-security-audit-ready-to-start/111538/ https://threatpost.com/openssl-security-audit-ready-to-start... The point here is not "we pay more money and get better security." That's the kind of garbage logic the SSL CA cabal used for decades to maintain a monopoly before LetsEncrypt showed up. The question is, what is an indication that, although there is clearly some drama, that I can trust the software with my secrets? Did some of the people come to this new project from the Hashicorp security team? Could it be that the majority of changes in codebase are on the UX/UI, and not the security protocol implementation? There are plenty of ways to publish trust validation without demanding that a potential user spend hours poring through code looking for exploits.