[{"data":1,"prerenderedAt":404},["ShallowReactive",2],{"project-30855879":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":44,"post_text":46,"what":47,"said":96,"maker_in_thread":182,"shape":195,"grid":200,"attempts":367,"same_week":368,"maker_shows":45,"maker_hidden":396,"reader_version":397,"card":398},"30855879","EnvKey 2.0","End-To-End Encrypted Environments (now open source)","title","Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)","https:\u002F\u002Fv2.envkey.com\u002F","v2.envkey.com","danenania",1648651370,2022,225,65,235,2570,10,"notable","infrastructure","secrets management","cli",[24,25,26,27],"secrets manager","environment variables","end-to-end encryption","config management","curious",-0.159,{"positive":31,"neutral":32,"mixed":33,"critical":18},2,17,4,33,{"docs":36,"idea":39,"privacy":40,"execution":42,"pricing":43},{"positive":37,"critical":38},0,1,{"positive":37,"critical":37},{"positive":38,"critical":41},3,{"positive":38,"critical":41},{"positive":37,"critical":41},[41,41,37,41,37,37,41,38,37,38,38,45,38,37,41,37,45,41,41,41,41,38,38,38,37,37,41,41,41,41,41,41,38,38,37,41,41,37,38,41],5,"Hey HN,\n\nI'm so happy to finally show you all this release after years of hard work. I posted the first version of EnvKey to HN back in 2017 (https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=15330757), then went through YC in W18 (https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=16569534).\n\nEnvKey is an end-to-end encrypted configuration and secrets manager. It protects your organization's API keys, encryption keys, credentials, and other secrets, and makes it easy to run servers, scripts, tests, and everything else with the latest config. It also helps you avoid duplication in your configuration, react to environmen",{"problem":48,"audience":54,"pricing":62,"motivation":66,"time_to_build":75,"stack":76,"openness":93,"stage":94,"team_size":95},{"value":49,"source":50,"evidence":51},"Managing secrets and environment config across servers, scripts and tests securely","maker",[52],{"id":53},"post",{"value":55,"source":50,"evidence":56},"Developers and organizations handling API keys and credentials",[57,58],{"id":53},{"id":59,"by":60,"text":61},"30858748","kafkaIncarnate","Initially, I was pretty thoroughly perplexed by what this actually did since all I did was click the original link and didn't even see this post text. I figured it out through…",{"value":63,"source":50,"evidence":64},"Free Cloud tier up to 20 user devices and 40 server keys; paid Cloud and Enterprise Self-Hosted tiers",[65],{"id":53},{"value":67,"source":50,"evidence":68},"Wanted a more secure secrets manager where the host never sees plaintext secrets",[69,72],{"id":70,"by":11,"text":71},"30857069","Yes, EnvKey uses client-side end-to-end encryption and never sends secrets to the host server in plaintext (whether it's self-hosted or you use EnvKey Cloud). So there would be…",{"id":73,"by":11,"text":74},"30858479","If the host server is compromised, attackers still will not be able to access secrets. Vault attempts to mitigate this with its 'seal' functionality, but in practice if an…",null,[77,83,87],{"value":78,"source":50,"evidence":79},"Go (envkey-source CLI)",[80],{"id":81,"by":11,"text":82},"30858381","The process management code lives here: https:\u002F\u002Fgithub.com\u002Fenvkey\u002Fenvkey\u002Fblob\u002Fmain\u002Fpublic\u002Fsdks\u002Fenvkey-source\u002Fcmd\u002Fexec.go Basically, on unix systems, the command you pass in to…",{"value":84,"source":50,"evidence":85},"NaCl crypto library",[86],{"id":53},{"value":88,"source":50,"evidence":89},"AWS Aurora and Fargate (self-hosted)",[90],{"id":91,"by":11,"text":92},"30858002","Thanks for your feedback. Enterprise Self-Hosted runs in an AWS account that you control. It uses AWS Aurora and Fargate, along with a handful of other AWS supporting services.…","open_source","launched","unknown",{"praise":97,"objections":108,"requests":127,"questions":146,"alternatives":166},[98,104],{"value":99,"source":100,"evidence":101},"Client-side end-to-end encryption that does not trust the host server","commenter",[102,103],{"id":70,"by":11,"text":71},{"id":73,"by":11,"text":74},{"value":105,"source":50,"evidence":106},"Developer-friendly CLI with watch and reload features",[107],{"id":53},[109,113,120],{"value":110,"source":100,"evidence":111},"Docs tone and 'don't README' framing felt off-putting and unclear",[112],{"id":59,"by":60,"text":61},{"value":114,"source":100,"evidence":115},"Pricing page unclear and full of buzzwords",[116],{"id":117,"by":118,"text":119},"30857793","zmxz","How is this tool different to Hashicorp's Vault? Also, if I'm using \"Enterprise Self Hosted\", which means I am doing the hosting myself - am I not responsible for all the…",{"value":121,"source":100,"evidence":122},"v1 to v2 accounts are not compatible, forcing migration",[123],{"id":124,"by":125,"text":126},"30864449","psanchez","I'm a happy EnvKey customer since the end of 2018. After me and my team tried different solutions in the past (back in 2017 and 2018) to manage secrets on our infrastructure (we…",[128,132,139],{"value":129,"source":100,"evidence":130},"Clearer pricing page",[131],{"id":117,"by":118,"text":119},{"value":133,"source":100,"evidence":134},"Terraform integration guide",[135],{"id":136,"by":137,"text":138},"30857053","mattste","How does this compare to Doppler[1]? Is there a way to handle the configuration in Terraform? [1] https:\u002F\u002Fwww.doppler.com\u002F",{"value":140,"source":100,"evidence":141},"SOC or ISO27001 certification",[142],{"id":143,"by":144,"text":145},"30857510","NAR8789","Any plans for SOC or ISO27001 certification?",[147,152,159],{"value":148,"source":100,"evidence":149},"How does it compare to Doppler and HashiCorp Vault",[150,151],{"id":136,"by":137,"text":138},{"id":117,"by":118,"text":119},{"value":153,"source":100,"evidence":154},"How is the web of trust implemented versus PKI",[155],{"id":156,"by":157,"text":158},"30865455","MattPalmer1086","From what I can see, public keys are checked by examining a signature chain which must terminate in the TrustedRoot. This sounds more like a traditional PKI than a web of trust.…",{"value":160,"source":100,"evidence":161},"Protection against cold boot or RAM dumps on client machines",[162],{"id":163,"by":164,"text":165},"30857143","koolba","Except for a cold boot style attack right? https:\u002F\u002Fen.m.wikipedia.org\u002Fwiki\u002FCold_boot_attack I’m assuming the client side code isn’t keeping the secrets in some kind of TPM right?…",[167,171,175],{"value":168,"source":100,"evidence":169},"HashiCorp Vault",[170],{"id":117,"by":118,"text":119},{"value":172,"source":100,"evidence":173},"Doppler",[174],{"id":136,"by":137,"text":138},{"value":176,"source":100,"evidence":177},"ansible-vault",[178],{"id":179,"by":180,"text":181},"30858535","weinzierl","Is it a replacement for ansible-vault too? What are the advantages of a solution involving a server?",{"comments":183,"answered":184,"key":185},25,18,[186,189,192],{"id":187,"text":188},"30858898","Thanks for your feedback! I'm sorry that the intro in the docs rubbed you the wrong way. I wanted to make sure people realize that it's not a complicated tool that requires a lot…",{"id":190,"text":191},"30859195","Thanks! You're absolutely right that if you had that impression, others likely would as well, and there's not much to gain from it--the same information can be conveyed in a more…",{"id":193,"text":194},"30857271","I've met the Doppler founders and greatly respect them (even played some poker with them!). Doppler has great design and UX. That said, I'd say the key difference is that EnvKey…",{"commenters":196,"max_depth":197,"maker_replies":183,"first_comment_mins":198,"lifespan_hours":199},27,9,38,64,[201,203,205,207,208,210,212,216,220,223,227,231,233,237,240,242,243,245,248,250,253,255,257,260,261,264,266,269,271,274,276,279,282,286,288,290,292,294,296,298,301,303,305,307,309,311,315,317,320,323,324,326,329,332,335,337,339,341,345,347,352,354,358,361,365],[59,37,41,202,60,37],"project\u002Fmixed\u002Fdocs",[187,37,37,204,11,38],"maker\u002Fneutral\u002Fdocs",[206,37,41,204,60,37],"30859151",[190,37,37,204,11,38],[136,38,41,209,137,37],"project\u002Fneutral\u002Fidea",[193,38,37,211,11,38],"project\u002Fpositive\u002Fprivacy",[213,38,37,214,215,37],"30858337","commenter\u002Fpositive\u002Fprivacy","ocdtrekkie",[217,38,37,218,219,37],"30858543","commenter\u002Fneutral\u002Fprivacy","ryukafalz",[221,38,37,218,222,37],"30858890","tompic823",[224,38,41,225,226,37],"30863503","project\u002Fneutral\u002Fprivacy","prakis",[228,31,41,229,230,37],"30857060","project\u002Fneutral\u002Fexecution","gmfawcett",[232,31,37,229,11,38],"30857122",[234,31,38,235,236,37],"30857571","project\u002Fcritical\u002Fexecution","KMag",[238,31,37,239,11,38],"30857632","maker\u002Fneutral\u002Fexecution",[241,31,38,235,236,37],"30857961",[81,31,37,229,11,38],[244,31,38,235,230,37],"30858713",[246,31,37,247,11,38],"30858950","maker\u002Fpositive\u002Fexecution",[249,31,45,247,230,37],"30860629",[251,31,41,229,252,37],"30861802","sciurus",[117,41,38,254,118,37],"project\u002Fcritical\u002Fpricing",[91,41,37,256,11,38],"maker\u002Fneutral\u002Fprivacy",[258,41,41,225,259,37],"30858406","998wwwww",[73,41,37,256,11,38],[262,41,37,263,118,37],"30860656","commenter\u002Fcritical\u002Fprivacy",[265,41,37,218,11,38],"30860880",[267,41,45,211,268,37],"30862726","gclawes",[143,33,41,270,144,37],"project\u002Fneutral\u002Fnone",[272,33,37,273,11,38],"30857745","maker\u002Fneutral\u002Fnone",[275,33,41,270,144,37],"30857979",[277,45,41,209,278,37],"30856395","plasma",[280,45,37,281,11,38],"30856578","maker\u002Fneutral\u002Fidea",[283,284,41,225,285,37],"30857001",6,"itake",[70,284,37,287,11,38],"maker\u002Fpositive\u002Fprivacy",[163,284,38,289,164,37],"project\u002Fcritical\u002Fprivacy",[291,284,37,256,11,38],"30857463",[293,284,38,289,285,37],"30857554",[295,284,37,256,11,38],"30857690",[297,284,38,289,285,37],"30857865",[299,284,37,218,300,37],"30857936","nicoburns",[302,284,37,218,285,37],"30860345",[304,284,37,256,11,38],"30858131",[306,284,41,225,285,37],"30857492",[156,308,41,225,157,37],7,[310,308,37,256,11,38],"30869247",[312,313,41,225,314,37],"30858808",8,"yowmamasita",[316,313,37,256,11,38],"30858850",[318,197,41,209,319,37],"30859016","stuaxo",[321,197,37,322,300,37],"30859463","other\u002Fneutral\u002Fnone",[179,18,41,209,180,37],[325,18,37,281,11,38],"30858722",[124,327,41,328,125,37],11,"project\u002Fmixed\u002Fpricing",[330,327,38,254,331,37],"30868720","drcongo",[333,327,37,334,11,38],"30869915","maker\u002Fneutral\u002Fpricing",[336,327,38,254,331,37],"30876434",[338,327,37,334,11,38],"30876625",[340,327,41,328,125,37],"30886366",[342,343,41,225,344,37],"30857817",12,"tener",[346,343,37,256,11,38],"30858190",[348,349,41,350,351,37],"30862864",13,"project\u002Fneutral\u002Fdocs","BOOSTERHIDROGEN",[353,349,37,204,11,38],"30863930",[355,356,38,357,285,37],"30857511",14,"project\u002Fcritical\u002Fdocs",[359,356,37,360,11,38],"30857569","maker\u002Fpositive\u002Fdocs",[362,363,41,202,364,37],"30856567",15,"triumphantomato",[366,363,37,360,11,38],"30856605",[],[369,374,378,383,388,392],{"id":370,"name":371,"points":372,"category":373},"30824357","Networks from Scratch",792,"learning_science",{"id":375,"name":376,"points":377,"category":373},"30787290","Bionic Reading",410,{"id":379,"name":380,"points":381,"category":382},"30844149","Blog Surf",389,"productivity",{"id":384,"name":385,"points":386,"category":387},"30811648","pianos",297,"consumer_social",{"id":389,"name":390,"points":391,"category":20},"30830749","Caddy-SSH",280,{"id":393,"name":394,"points":395,"category":373},"30836647","Visualize SQL Queries",259,false,"v2",{"id":399,"name":5,"line":6,"ai":396,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":400,"top":18,"kw":401,"maker":11,"domain":10,"tier":19,"attempts":37,"strip":402,"url":9,"mix":403,"praise":99,"objection":110,"sub":21},30855879,-0.16,[24,25,26,27],"3303003101151030533331110033333311033013",[31,32,33,18],1794036618703]