dangtony98

14 ms·

61.
The IBM-HashiCorp coupling could be more complicated than it seems(techcrunch.com)
3 points by dangtony98 2y ago|0 comments
62.
by dangtony98 2y ago
You should look into Infisical: https://github.com/Infisical/infisical Disclaimer: I’m one of the founders.
63.
Microsoft employees exposed internal passwords in security lapse(techcrunch.com)
13 points by dangtony98 3y ago|0 comments
64.
AI data security startup Cyera confirms $300M raise at a $1.4B valuation(techcrunch.com)
1 points by dangtony98 3y ago|0 comments
65.
PartyKit Is Joining Cloudflare(blog.partykit.io)
2 points by dangtony98 3y ago|0 comments
66.
How to use stacked PRs to unblock your entire team(graphite.dev)
3 points by dangtony98 3y ago|0 comments
67.
by dangtony98 3y ago
The nature of the use-case evolved and, at one point, the MongoDB + Mongoose ORM combination was in fact optimal judging from various aspects including tooling familiarity with most to the primary use-case being the managed cloud service. A
68.
by dangtony98 3y ago
I'm actually very bullish on MongoDB. While the article and significant sentiment in threads suggest a push off MongoDB toward PostgreSQL, I do think MongoDB has its own place in the stack and that it won't be obsoleted. I've
69.
by dangtony98 3y ago
Author of the article here! The article itself does not "complain the product is bad" but some other comments in this thread would certainly suggest so. Instead, the article says that the use-case evolved, states reasons for why M
70.
by dangtony98 3y ago
Highly resonate with this article, especially the point on zero friction makes me think of "minimizing time to the aha moment." You lose users for each barrier, hoop, and hurdle that they have to jump through. Great read!
71.
AT&T won't say how its customers' data spilled online(techcrunch.com)
4 points by dangtony98 3y ago|1 comments
72.
by dangtony98 3y ago
Hey! Definitely, we have more details on the cryptography in our documentation here: https://infisical.com/docs/security/overview . Put simply, Infisical operates E2EE by default which means the platform itself can
73.
by dangtony98 3y ago
Yeah the pricing on their is only for the hosted service.
74.
by dangtony98 3y ago
Second this, we don’t have any such limitations on OSS that is you can totally self-host Infisical on your own infrastructure and have unlimited users, projects, and environments. I think there may be a mix-up here with Infisical Cloud whic
75.
by dangtony98 3y ago
Thank you! Check out this demo as well: https://www.youtube.com/watch?v=PK23097-25I&ab_channel=Infis... We put a lot of work into engineering but also the design and messaging of the platform to developers as well :)
76.
by dangtony98 3y ago
Definitely. Our plan is to double-down on secret management and branch outwards but incrementally starting with secret scanning to prevent and detect leaked secrets in codebases. Ultimately, we intend each initiative of our roadmap to have
77.
by dangtony98 3y ago
First off, I want to point out that browser-based services and applications can be made secure; we should keep this one clear, especially for readers here, because otherwise it would invalidate most if not all services that exist accessible
78.
by dangtony98 3y ago
Definitely tricky to validate. Most tools out there offer multiple methods of excluding certain data-points whether it be by adding a comment by it to indicate intentionality, a file containing specs to exclude like values or matching patte
79.
by dangtony98 3y ago
I wouldn't undermine and characterize it as fig leaf personally. I think this would raise a natural question on my end which is how do you evaluate the security of platforms like 1Password, Bitwarden, Vault, all of which also offer bro
80.
Ask HN: How does your company do secret management? AWS/GCP/Vault/CyberArk?
2 points by dangtony98 4y ago|0 comments
81.
by dangtony98 4y ago
Mhm I'll definitely look over SSO and talk to the team about including it in the lower plans as it would definitely be useful for smaller teams as well.
82.
by dangtony98 4y ago
Just added it to my bookmarks — Will be checking it out thanks! I wonder how this compares to Snyk, also in the area of securing against supply chain attacks.
83.
by dangtony98 4y ago
Big fans of WorkOS! Happy to be talking with your team about SSO options for Infisical :) We built out all our OAuth2 integrations with other platforms (different from SSO but something relatable), so we have an idea of how much work it is
84.
by dangtony98 4y ago
Getting certified is unfortunately not an overnight task … SOC2 alone will likely take months and that’s not yet factoring in the security audit as well. As much as we’d like to have it done ASAP, a lot of it is dependent on the length of t
85.
by dangtony98 4y ago
Thanks! We're both in the same domain, open-source, and E2EE. Right off the bat, I'd say there are a few key observable differences: - Infisical is open-source more-or-less from the get go and, as a testament to that, we've g
86.
by dangtony98 4y ago
Thanks so much for this comment - very valuable insights. RE security: 100% agree with everything you said. This is at the end of the day a security product. Even though we're very early, we've put a ton of thought into the securi
87.
by dangtony98 4y ago
Down to jam on your use-case! The CLI "wrap command" is the main way of using Infisical at the moment and works for injecting secrets for local development as well as embedding into your Docker images if you use that; it definitel
88.
by dangtony98 4y ago
Surprisingly, audit logging has been deceivingly complex for us. There are many types of events (part of logs) triggered throughout the platform carrying different payloads/formats (e.g. events related to secrets, users, etc.). The var
89.
by dangtony98 4y ago
We're preparing to do a SOC2 with Vanta first followed by a security audit with some firm like Trail of Bits next. We're fortifying the codebase every day and would expect this process to be complete in the next 2 quarters.
90.
by dangtony98 4y ago
There are 3 different locations in the GitHub repo regarding the security policy: a SECURITY.md file containing instructions to report security vulnerabilities to team@infisical.com — this is employed in other open core repos like Strapi, P

More ›