Hacker News Reader

Oh, ha, I glazed over that paragraph! But yeah, it was totally Hashicorp I was thinking about; this sort of reliability-thoroughly-optional thing shoots through a lot of their tools and keeps me pretty far away from any of the ones that might touch live environments. (Packer and Vagrant are fine.)

View on HN

Which one of their tools are we talking about here? Terraform?

blog-post author here: all of them written in Golang which use SSH.

Packer, Terraform, Vault, all of them.

Using a bastion host in your configurations doesn't help if you invoke the tooling on your laptop, since the connection to the bastion host is done with the SSH package, again with no host-key verification.

And Vault is supposed to be a super secure root of trust. Hmm...

Damn, I was planning on using Vault eventually. This attitude towards security gives me pause about put all my secrets into it. Is there any alternatives?

I posted the exact affected software (and how) here: https://news.ycombinator.com/item?id=14122973 I go into detail so I'd rather not repeat it here :)

Reply on news.ycombinator.com