HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
cyberark
slosilo
Ruby2015–2017
cyberark / slosilo

slosilo

A Ruby interface to standard cryptographic primitives

Security & Privacy
Explore on GitHubRead Hacker News discussions
2Distinct people
4Mentions
0Explicit recommenders
19GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A Ruby interface to standard cryptographic primitives

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month4 dated mentions

Observed mentions: 2015-01-02 17:58:38 UTC to 2017-03-14 16:35:13 UTC.

012015-01-01 00:00:00 UTC to 2015-02-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJan 20152015-02-01 00:00:00 UTC to 2015-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-03-01 00:00:00 UTC to 2015-04-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-04-01 00:00:00 UTC to 2015-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-05-01 00:00:00 UTC to 2015-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-06-01 00:00:00 UTC to 2015-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-07-01 00:00:00 UTC to 2015-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-08-01 00:00:00 UTC to 2015-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-09-01 00:00:00 UTC to 2015-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-10-01 00:00:00 UTC to 2015-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-11-01 00:00:00 UTC to 2015-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-12-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-01-01 00:00:00 UTC to 2016-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-02-01 00:00:00 UTC to 2016-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsFeb 20162016-03-01 00:00:00 UTC to 2016-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-04-01 00:00:00 UTC to 2016-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-05-01 00:00:00 UTC to 2016-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-06-01 00:00:00 UTC to 2016-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-07-01 00:00:00 UTC to 2016-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-08-01 00:00:00 UTC to 2016-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-09-01 00:00:00 UTC to 2016-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-10-01 00:00:00 UTC to 2016-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-11-01 00:00:00 UTC to 2016-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-12-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-01-01 00:00:00 UTC to 2017-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-02-01 00:00:00 UTC to 2017-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-03-01 00:00:00 UTC to 2017-04-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMar 2017

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Jan 20152015-01-01 00:00:00 UTC2015-02-01 00:00:00 UTC101
Feb 20152015-02-01 00:00:00 UTC2015-03-01 00:00:00 UTC000
Mar 20152015-03-01 00:00:00 UTC2015-04-01 00:00:00 UTC101
Apr 20152015-04-01 00:00:00 UTC2015-05-01 00:00:00 UTC101
May 20152015-05-01 00:00:00 UTC2015-06-01 00:00:00 UTC000
Jun 20152015-06-01 00:00:00 UTC2015-07-01 00:00:00 UTC000
Jul 20152015-07-01 00:00:00 UTC2015-08-01 00:00:00 UTC000
Aug 20152015-08-01 00:00:00 UTC2015-09-01 00:00:00 UTC000
Sep 20152015-09-01 00:00:00 UTC2015-10-01 00:00:00 UTC000
Oct 20152015-10-01 00:00:00 UTC2015-11-01 00:00:00 UTC000
Nov 20152015-11-01 00:00:00 UTC2015-12-01 00:00:00 UTC000
Dec 20152015-12-01 00:00:00 UTC2016-01-01 00:00:00 UTC000
Jan 20162016-01-01 00:00:00 UTC2016-02-01 00:00:00 UTC000
Feb 20162016-02-01 00:00:00 UTC2016-03-01 00:00:00 UTC000
Mar 20162016-03-01 00:00:00 UTC2016-04-01 00:00:00 UTC000
Apr 20162016-04-01 00:00:00 UTC2016-05-01 00:00:00 UTC000
May 20162016-05-01 00:00:00 UTC2016-06-01 00:00:00 UTC000
Jun 20162016-06-01 00:00:00 UTC2016-07-01 00:00:00 UTC000
Jul 20162016-07-01 00:00:00 UTC2016-08-01 00:00:00 UTC000
Aug 20162016-08-01 00:00:00 UTC2016-09-01 00:00:00 UTC000
Sep 20162016-09-01 00:00:00 UTC2016-10-01 00:00:00 UTC000
Oct 20162016-10-01 00:00:00 UTC2016-11-01 00:00:00 UTC000
Nov 20162016-11-01 00:00:00 UTC2016-12-01 00:00:00 UTC000
Dec 20162016-12-01 00:00:00 UTC2017-01-01 00:00:00 UTC000
Jan 20172017-01-01 00:00:00 UTC2017-02-01 00:00:00 UTC000
Feb 20172017-02-01 00:00:00 UTC2017-03-01 00:00:00 UTC000
Mar 20172017-03-01 00:00:00 UTC2017-04-01 00:00:00 UTC101

What Hacker News says

4 sources
kgilpin·Mar 14, 2017
If you are interested in a Ruby library for signing and verifying a token containing a simple payload, take a look at our Slosilo library: https://github.com/conjurinc/slosilo#signing We use this library to store a signed username. Nothing more than that, just a username in a signed, expiring token. No `alg` field or any other options. The Slosilo code has been subjected to a professional crytographic audit, so it's safe for you to use. Unfortunately, without an NDA, we can't show you the audit report, that's just how these things work. The only audit finding was a recommendation that we switch to `AES-256-GCM`, which we did in Slosilo 2.0, November 2014.
In JSON Web Tokens should be avoided
kgilpin·Apr 29, 2015
It's pretty amazing to see how many new secrets tools for DevOps and cloud have suddenly materialized in the last few weeks. At Conjur, we have been in production in this space for almost two years. If you're wondering how to stack up these different tools against each other, here are a few facts about our solution: * At Conjur, we care deeply about three things : (1) the overall user experience for developers, operations, and security personnel (2) the security of our code (3) high availability * Conjur implements full-featured role-based access control for both "carbon" (people) and "silicon" (VMs, servers, containers, and other code) * Conjur solves not just secrets management, but also SSH access management and software-defined firewall (granular access control for microservices) * The Conjur core services are not open source, but our
Read the rest
cryptography is (https://github.com/conjurinc/slosilo), as are many of our client libraries and connectors (for example: https://github.com/conjurinc/api-ruby, https://github.com/conjur-cookbooks/conjur). And Conjur cryptography has been audited by a respected 3rd party. * Conjur features packaged integrations with Chef (https://supermarket.chef.io/cookbooks/conjur), Puppet (https://forge.puppetlabs.com/conjur/conjur), Docker (http://developer.conjur.net/product_demo/secrets.html), Heroku (https://github.com/conjurinc/heroku-buildpack-conjur), AWS and more. New integrations are easy to build using the Conjur HTTPS and LDAPS APIs (http://developer.conjur.net/reference/services) We have also gone to great lengths to make it easy to try Conjur yourself, with automatically provisioned, self-service demo appliances featuring the Conjur server and client, Docker and Git: https://demo-factory-conjur.herokuapp.com/request/secrets https://demo-factory-conjur.herokuapp.com/request/ssh
In Vault – A tool for managing secrets
dustinrcollins·Mar 28, 2015
We have been audited by a 3rd party and incorporated all of their suggestions in the latest 4.4 release. http://blog.conjur.net/conjur-4-4-released One of their stipulations for the audit was that we don't use it for promotional purposes so I guess a NDA is required to discuss details. The tech we use for encryption of secrets is definitely open source here: https://github.com/conjurinc/slosilo Conjur isn't built on in-house cryptographic software - it uses trusted open-source tools - OpenSSL, PAM and so on. Most of our work is open-source https://github.com/conjurinc https://github.com/conjur-cookbooks
In Security of Infrastructure Secrets
kgilpin·Jan 2, 2015
Regarding the API key, from an operational perspective it's an improvement. The reason is it creates a separation of duties between management of the API key (responsibility of opsec), and the application credentials (responsibility of the broader ops team and in some cases the developers themselves). There is no way for the application credentials to be accidentally leaked or mis-deployed, because the policies created by opsec are always enforced. In addition, the security team can make decisions about the management of the API key, such as: * It can be kept off physical media (e.g.in /dev/shm) * The process(es) by which the API keys are created and placed on the machines can be carefully managed * A dedicated reaper/deprovisioner process can be used to retire (de-authorize) API keys once they go out of service. Regarding the virtual app
Read the rest
liance: * Is it a black box? Essentially yes, although there are specific maintenance scripts on the machine (e.g. backup / restore) that you may occasionally run. For normal operation, only ports 443 and 636 (LDAPS) are open. * How do I back it up? A standby master and read-only followers can be used to keep live copies of the database. A backup script can be used to capture full GPG-encrypted backups. A restore script will restore a backup onto a new appliance. * How do I upgrade it? You create a standby master and followers of the new upgraded version of the appliance, and connect them to your current master. Once the standby master and followers are current with the data stream, they are promoted via DNS and serve the subsequent requests. * How do I check the integrity of the secrets database? We have written an open-source Ruby interface to OpenSSL called Slosilo (https://github.com/conjurinc/slosilo) and subjected this library to a professional crypto audit. On the advice of the auditors, Slosilo encryption employs message authentication (cipher mode AES-256-GCM) which ensures the integrity of the secrets. Nevertheless, the Conjur appliances must obviously be afforded the highest level of protection. Unlike a multi-master system, Conjur's read-only "followers" contain only read-only copies of the secrets. So compromise of a follower cannot be used to modify secrets or authorization policies, or to confuse a master election scheme.
In Environment Variables Considered Harmful for Your Secrets

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.