vault

What advantages over say, smallstep/certificates, letsencrypt/boulder, django-ca, square/certstrap, or hashicorp/vault (and e.g. OpenWRT's luci-app-acme ACMEv2 GUI) does Anchor offer? https://github.com/topics/acme applications/luci-app-acme/htdocs/luci-static/resources/view/acme.js: https://github.com/openwrt/luci/blob/master/applications/luc... https://openwrt.org/docs/guide-user/services/tls/acmesh https://developer.hashicorp.com/vault/tutorials/secrets-mana... https://github.com/hashicorp/vault : > Refer to Build Certificate Authority (CA) in Vault with an offline Root for an example of using a root CA external to Vault.

If anyone does start an open Vault fork, I'd be interested in contributing as I get time. Edit to add: https://github.com/hashicorp/vault/graphs/contributors?from=...

The author of this tool basically took the Shamir code from Hashicorp Vault, which is pretty mainstream. If you're looking for a solid implementation, I would start there[0]. I wouldn't use the Shamir code from this repo, as it's an old version of the vault code using field arithmetic that doesn't run in constant time. [0]: https://github.com/hashicorp/vault/blob/main/shamir/shamir.g...

Vault is under the BSL now too: https://github.com/hashicorp/vault/blob/main/LICENSE

Out of curiosity, what do you mean by this? cross-cluster? they already have HA: https://github.com/hashicorp/vault/blob/v1.14.1/website/cont... while digging up that link, I also saw one named replication: https://github.com/hashicorp/vault/blob/v1.14.1/website/cont...

https://github.com/hashicorp/vault/blob/main/LICENSE#L8-L11 Clearly states that you can use it in a production setup.

Maybe we'll see the whole team at [Axiom](https://github.com/hashicorp/vault/blob/0b12cdcfd17278d7cca2...) riding around in Maseratis.

> edit, 2015, ouch: > https://github.com/hashicorp/vault/commits?author=andrewstua... Not sure what you're getting at with your edit. I'll try to assume positive intent. I maintain quite a few projects as well, also pretty small. Code to me means a great deal more than a small amount of money. The money is nothing compared to what I've made in my career thanks almost entirely to the code that exists publicly and my ability to run and modify it as needed to learn. I am glad to get code because it tells me something is useful enough for someone else to bother, which to me is what giving back is all about.

with all due respect, unless "giving back" means giving them money, its probably not worth what you think its worth. I maintain some small projects, and most of the people "giving back" contribute such a tiny amount of code that its almost not worth mentioning. that might not be your situation, but I know as a maintainer, in most cases I would much prefer a monetary contribution than a pull request. edit, 2015, ouch: https://github.com/hashicorp/vault/commits?author=andrewstua...

Also, "What if their dependencies adopted the same attitude?" Like https://github.com/hashicorp/vault/blob/main/go.mod#L25

Hey this is cool! Thanks for sharing your hard work. I have been living this for the past few years building an automation product[0] and services company to lower the barrier of entry and have tested many of these methodologies. We’ve also written many different runbooks/playbooks for complicated workflows. I’d like to share a couple experiences/opinions: Netconf and vendor apis are lovely when available and working well. Many devices don’t support this and falling back to SSH (sometimes even telnet) is a must for automation. Imo, you could add value to your book by touching on Ktbyer's Netmiko/Paramiko[1] as well as their nuances (timeouts, dealing with interactive prompts, etc). AAA is a big component of automation too. Having something in place to handle authn/authz (radius/tacacs) enables consistency for access across vendors. This a

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-... I'm bringing this up because the circleCI blogpost says that the attacker did memory-dump encryption keys from a running process. See https://circleci.com/blog/jan-4-2023-incident-report/ So even if they were using hashicorp/vault, the attacker could probably still have been able to mem-dump vault's process.

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-...