[{"data":1,"prerenderedAt":528},["ShallowReactive",2],{"project-34055132":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":47,"post_text":49,"what":50,"said":92,"maker_in_thread":239,"shape":250,"grid":254,"attempts":489,"same_week":490,"maker_shows":45,"maker_hidden":520,"reader_version":521,"card":522},"34055132","Infisical","open-source secrets manager","title","Show HN: Infisical – open-source secrets manager","https:\u002F\u002Fgithub.com\u002FInfisical\u002Finfisical","github.com","vmatsiiako",1671472340,2022,232,97,219,2570,9,"notable","infrastructure","secrets management","web_app",[24,25,26,27],"secrets manager","environment variables","end-to-end encryption","self-hosted","curious",0.025,{"positive":31,"neutral":32,"mixed":33,"critical":34},10,23,1,12,46,{"idea":37,"privacy":39,"execution":42,"docs":43,"design":44,"pricing":46},{"positive":38,"critical":33},0,{"positive":40,"critical":41},2,3,{"positive":38,"critical":40},{"positive":38,"critical":38},{"positive":38,"critical":45},4,{"positive":38,"critical":38},[38,38,38,38,38,38,41,41,38,33,33,38,41,41,33,33,45,41,41,41,41,41,48,48,41,33,38,41,41,33,33,48,48,48,48,33,48,33,38,33],5,"Last month, we open-sourced Infisical (https:\u002F\u002Fgithub.com\u002FInfisical\u002Finfisical) - a simple, end-to-end encrypted tool to sync environment variables across your team and infrastructure. You can use it to store environment variables and inject them into your applications locally or into CI\u002FCD and production infrastructure. It can be used with any language\u002Fframework and is platform independent with a super easy setup.\n\nWe know secret managers exist but, in our experience, they’re too complicated, not comprehensive, not user-friendly, or a mix of all three — other nicer ones are closed-source and d",{"problem":51,"audience":57,"pricing":64,"motivation":71,"time_to_build":75,"stack":76,"openness":89,"stage":90,"team_size":91},{"value":52,"source":53,"evidence":54},"Secret managers are too complicated, not comprehensive, or not user-friendly; syncing environment variables and secrets across teams and infrastructure","maker",[55],{"id":56},"post",{"value":58,"source":53,"evidence":59},"Developers and small teams, not only security teams",[60,61],{"id":56},{"id":62,"by":11,"text":63},"34055896","The main goal is to provide similar levels of security at a reduced learning curve. While Hashicorp Vault has a lot of features, I found it to be quite overwhelming... We created…",{"value":65,"source":53,"evidence":66},"Free for individual developers and small teams; license fee for future enterprise features and paid hosted version and support",[67,68],{"id":56},{"id":69,"by":11,"text":70},"34055767","Actually not! Most of the integrations are going to be completely free. Only a few very-enterprise integrations that are not needed for individual developers or small teams will…",{"value":72,"source":53,"evidence":73},"Secret management is too complicated and closed-source tools lack self-hosted options",[74],{"id":56},null,[77,83],{"value":78,"source":53,"evidence":79},"MongoDB",[80],{"id":81,"by":11,"text":82},"34057412","Yes, we're quite familiar with SOC guidelines. We will be including all of Security, Confidentiality, Privacy, Availability, and Processing integrity categories into the SOC 2…",{"value":84,"source":53,"evidence":85},"CLI",[86],{"id":87,"by":11,"text":88},"34058623","No, our CLI is connecting to our backend service which then connects to our database. The backend is not ready to be used by the public as it's not super user-friendly and not…","open_source","beta","company",{"praise":93,"objections":123,"requests":160,"questions":191,"alternatives":215},[94,110,117],{"value":95,"source":96,"evidence":97},"Simpler and easier to use than Vault","commenter",[98,102,106],{"id":99,"by":100,"text":101},"34056037","Alifatisk","Reminds be a bit of Vault but easier, I'll give it a try with Docker!",{"id":103,"by":104,"text":105},"34061212","shrisukhani","This looks great! Vault is such a headache sometimes... Will consider switching",{"id":107,"by":108,"text":109},"34055732","candiddevmike","Obligatory how does this compare to Vault or Conjur?",{"value":111,"source":96,"evidence":112},"Self-hosting option",[113],{"id":114,"by":115,"text":116},"34056417","turtledragonfly","Ahhh, a self-hosting option. I might actually take a look at it! I'm so tired of systems handling highly-confidential information (such as passwords and secrets material) being…",{"value":118,"source":53,"evidence":119},"Generous free plan",[120],{"id":121,"by":11,"text":122},"34056375","Thank you! Besides the CLI and browser UI, we also support a range of integrations (we're still working on this but you can already see some of them in the Integrations section…",[124,135,142,153],{"value":125,"source":96,"evidence":126},"Environment variables are a poor way to pass secrets",[127,131],{"id":128,"by":129,"text":130},"34055914","jbotz","Environment variables are not a good way to pass secrets around. For a list of reasons see this 2017 blog post:…",{"id":132,"by":133,"text":134},"34056199","mberning","I just can’t get over using environment variables for this type of stuff. An attacker can bootstrap a lot just from compromising an ssh login. Platforms like JWS had the right…",{"value":136,"source":96,"evidence":137},"No external security audit yet",[138],{"id":139,"by":140,"text":141},"34056639","thamer","I didn't see any reference to an external security audit on your website, so have you done one and if not are you planning to? All serious products in this space publish these…",{"value":143,"source":96,"evidence":144},"Only MongoDB supported",[145,149],{"id":146,"by":147,"text":148},"34058357","linuxdude314","Almost any other standard database would be a better choice: Postgres, MySQL, even Redis. Most companies avoid using MongoDb and lack the staff needed to administer it properly.…",{"id":150,"by":151,"text":152},"34058906","9dev","Oh, Mongo is a major turnoff. The only sensible data store to support in 2022 and beyond is Postgres, maybe SQLite IMO.",{"value":154,"source":96,"evidence":155},"Flat secret organization without directory structure",[156],{"id":157,"by":158,"text":159},"34057180","NathanFlurry","Congrats on the launch! The first thing that strikes me is the flat organizational structure of secrets. We have at least 45 KV secrets per environment in Vault organized in a…",[161,170,177,184],{"value":162,"source":96,"evidence":163},"Postgres or other database support",[164,165,169],{"id":150,"by":151,"text":152},{"id":166,"by":167,"text":168},"34058944","hardwaresofton","Postgres! But better yet you might want to make sure there is an abstraction layer so people can plug stuff in. It’s a extra work but it only gets harder to do later.",{"id":81,"by":11,"text":82},{"value":171,"source":96,"evidence":172},"API for programmatic secret retrieval",[173],{"id":174,"by":175,"text":176},"34058071","ponytech","Is there an API to programmatically retrieve secrets or is it CLI only? On a previous project I used the HVAC python library to get secrets from Vault and configure a Django…",{"value":178,"source":96,"evidence":179},"Use without the CLI",[180],{"id":181,"by":182,"text":183},"34060014","mariopt","Love this project but, please, give us a way to use it without the CLI. Not really keen on having the CLI on my package.json",{"value":185,"source":96,"evidence":186},"Support for systemd credentials",[187],{"id":188,"by":189,"text":190},"34057600","eliaspro","You might want to look into supporting systemd's credentials interface to cover 95% of non-K8S Linux systems out there with a generic solution. https:\u002F\u002Fsystemd.io\u002FCREDENTIALS\u002F",[192,196,207],{"value":193,"source":96,"evidence":194},"How does it compare to Vault or Conjur?",[195],{"id":107,"by":108,"text":109},{"value":197,"source":96,"evidence":198},"Is it secure by default and what is the architecture?",[199,203],{"id":200,"by":201,"text":202},"34055974","gregwebs","This looks great! But after looking through the docs and Github, I don't know what the architecture is beyond there is a CLI and a browser UI that interact with some sort of…",{"id":204,"by":205,"text":206},"34057222","IncRnd","Thank you. I wasn't asking if the product could do that through integrations but whether it operates insecurely by default.",{"value":208,"source":96,"evidence":209},"Does it run a security audit or SOC 2?",[210,211],{"id":139,"by":140,"text":141},{"id":212,"by":213,"text":214},"34057201","bearzdev","Has anyone on staff been through a soc audit? Which trust criteria will be used? Does the app support data stores other than mongo?",[216,221,228,232],{"value":217,"source":96,"evidence":218},"HashiCorp Vault",[219,220],{"id":139,"by":140,"text":141},{"id":107,"by":108,"text":109},{"value":222,"source":96,"evidence":223},"Doppler",[224],{"id":225,"by":226,"text":227},"34056538","mousetree","Is this like an open-source version of Doppler? Love Doppler.",{"value":229,"source":96,"evidence":230},"Conjur",[231],{"id":107,"by":108,"text":109},{"value":233,"source":96,"evidence":234},"vaultwarden, gopass, SOPS, dotenv",[235],{"id":236,"by":237,"text":238},"34059980","encryptluks2","There is vaultwarden, gopass, Vault, SOPS, Conjur, dotenv, etc.",{"comments":32,"answered":31,"key":240},[241,244,247],{"id":242,"text":243},"34057114","This is always a very heated discussion topic :) We started developing Infisical for the majority of people using environment variables right now. We actually have some plans for…",{"id":245,"text":246},"34057812","Thank you! We will take a look!",{"id":248,"text":249},"34058709","Thank you! This is our plan indeed! Environment variables are still by far the most popular approach for storing secrets - and we are trying to create a better (more secure)…",{"commenters":251,"max_depth":252,"maker_replies":32,"first_comment_mins":252,"lifespan_hours":253},49,8,192,[255,257,259,263,266,270,273,275,277,279,281,284,287,290,292,294,296,299,302,306,309,311,314,317,320,323,325,328,330,333,334,337,338,339,341,344,348,349,352,354,355,357,359,362,364,366,367,368,371,373,374,376,378,380,383,387,389,391,393,397,401,404,406,409,411,415,417,419,421,423,425,427,429,432,434,436,439,441,442,444,448,450,451,453,455,459,461,465,466,470,472,473,475,477,479,483,486],[128,38,38,256,129,38],"commenter\u002Fcritical\u002Fidea",[258,38,38,256,201,38],"34056145",[260,38,38,261,262,38],"34056183","commenter\u002Fneutral\u002Fidea","idealmedtech",[264,38,38,261,265,38],"34056328","sofixa",[267,38,38,268,269,38],"34056542","commenter\u002Fneutral\u002Fnone","simonw",[271,38,38,268,272,38],"34056964","alexeldeib",[274,38,38,261,262,38],"34058207",[276,38,38,261,205,38],"34063287",[278,38,38,268,262,38],"34066675",[280,38,38,268,205,38],"34067739",[282,38,38,261,283,38],"34056743","syoc",[285,38,38,256,286,38],"34056811","dakiol",[288,38,38,261,289,38],"34057856","jacobsenscott",[242,38,38,291,11,33],"maker\u002Fneutral\u002Fidea",[188,38,41,293,189,38],"project\u002Fneutral\u002Fidea",[245,38,38,295,11,33],"maker\u002Fpositive\u002Fnone",[297,38,38,256,298,38],"34062793","POPOSYS",[300,38,38,261,301,38],"34063407","segudev",[303,38,41,304,305,38],"34057217","project\u002Fneutral\u002Fprivacy","wryun",[307,38,38,261,308,38],"34058460","klabb3",[248,38,38,310,11,33],"maker\u002Fpositive\u002Fidea",[312,38,38,256,313,38],"34062623","Terretta",[315,38,38,261,316,38],"34061490","3np",[318,38,33,319,237,38],"34059389","project\u002Fcritical\u002Fidea",[321,38,38,322,11,33],"34059433","maker\u002Fneutral\u002Fnone",[236,38,33,324,237,38],"project\u002Fcritical\u002Fnone",[326,38,38,327,11,33],"34065293","project\u002Fpositive\u002Fidea",[329,38,38,268,237,38],"34076138",[331,38,38,261,332,38],"34061111","benatkin",[139,33,41,304,140,38],[335,33,38,336,11,33],"34056795","maker\u002Fneutral\u002Fprivacy",[212,33,41,304,213,38],[81,33,38,336,11,33],[146,33,33,340,147,38],"project\u002Fcritical\u002Fexecution",[342,33,38,268,343,38],"34059170","Aeolun",[345,33,38,346,347,38],"34151384","commenter\u002Fneutral\u002Fexecution","jd_mongodb",[150,33,33,340,151,38],[350,33,41,351,316,38],"34061463","project\u002Fneutral\u002Fexecution",[353,33,41,351,213,38],"34067437",[166,33,41,351,167,38],[114,40,48,356,115,38],"project\u002Fpositive\u002Fprivacy",[358,40,38,322,11,33],"34056461",[360,40,41,304,361,38],"34057171","eyakubovich",[363,40,41,304,115,38],"34057863",[365,40,38,336,11,33],"34057967",[200,41,41,293,201,38],[121,41,38,291,11,33],[369,41,41,370,201,38],"34056663","project\u002Fneutral\u002Fnone",[372,41,38,322,11,33],"34056737",[174,45,41,351,175,38],[375,45,38,322,11,33],"34058158",[377,45,41,351,147,38],"34058391",[87,45,38,379,11,33],"maker\u002Fneutral\u002Fexecution",[381,45,48,382,175,38],"34064299","project\u002Fpositive\u002Fnone",[384,45,41,385,386,38],"34059777","maker\u002Fneutral\u002Fdocs","tony-infisical",[181,45,41,388,182,38],"project\u002Fneutral\u002Fdesign",[390,45,48,295,386,38],"34060197",[392,48,48,295,386,38],"34055254",[394,48,41,395,396,38],"34056421","project\u002Fneutral\u002Fpricing","eranation",[398,48,41,399,400,38],"34057624","maker\u002Fneutral\u002Fpricing","maidul",[132,402,33,403,133,38],6,"project\u002Fcritical\u002Fdesign",[405,402,33,403,147,38],"34058565",[157,407,41,408,158,38],7,"project\u002Fmixed\u002Fdesign",[410,407,38,322,11,33],"34057255",[412,407,38,413,414,38],"34057284","other\u002Fneutral\u002Fnone","DrBenCarson",[416,407,38,413,158,38],"34059169",[418,252,41,293,205,38],"34056736",[420,252,38,293,11,33],"34056752",[422,252,41,370,205,38],"34056802",[424,252,41,370,400,38],"34056896",[204,252,33,426,205,38],"project\u002Fcritical\u002Fprivacy",[428,252,38,336,11,33],"34058409",[430,252,33,431,298,38],"34063000","maker\u002Fcritical\u002Fprivacy",[433,252,33,426,147,38],"34058533",[435,252,38,413,298,38],"34063011",[437,18,48,382,438,38],"34060707","TommyDANGerous",[440,18,48,382,386,38],"34060929",[225,31,41,293,226,38],[443,31,38,356,11,33],"34056628",[445,446,48,356,447,38],"34059124",11,"stuaxo",[449,446,38,322,11,33],"34059199",[103,34,48,382,104,38],[99,452,48,382,100,38],13,[454,452,38,385,11,33],"34056057",[456,457,33,403,458,38],"34058078",14,"olekenneth",[460,457,38,322,11,33],"34058105",[462,463,41,395,464,38],"34055628",15,"vorpalhex",[69,463,38,399,11,33],[467,468,48,382,469,38],"34067061",16,"yardenst",[107,471,41,293,108,38],17,[62,471,38,293,11,33],[474,471,33,403,147,38],"34058754",[476,471,38,322,11,33],"34059362",[478,471,38,268,386,38],"34059753",[480,481,33,324,482,38],"34056162",18,"goodpoint",[484,481,38,268,485,38],"34056351","ahofmann",[487,481,38,413,488,38],"34056383","dang",[],[491,496,501,506,510,515],{"id":492,"name":493,"points":494,"category":495},"34066824","Obsidian Canvas",1380,"productivity",{"id":497,"name":498,"points":499,"category":500},"34083366","Portable Secret",1290,"security_privacy",{"id":502,"name":503,"points":504,"category":505},"34035628","I made an Ethernet transceiver from logic gates",460,"hardware",{"id":507,"name":508,"points":509,"category":495},"34006202","Readwise Reader",326,{"id":511,"name":512,"points":513,"category":514},"34067109","paid link to",316,"web_saas",{"id":516,"name":517,"points":518,"category":519},"34015953","Forma",291,"languages",false,"v2",{"id":523,"name":5,"line":6,"ai":520,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":524,"top":18,"kw":525,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":526,"url":9,"mix":527,"praise":95,"objection":125,"sub":21},34055132,0.03,[24,25,26,27],"0000003301103311433333553103311555515101",[31,32,33,34],1793991056810]