search

socallinuxexpo / SCALE-Planning

SCALE Planning
http://www.socallinuxexpo.org
15 stars 3 forks source link

Budget for Secrets Management #253

Open jaymzh opened 1 year ago

jaymzh commented 1 year ago

We sorely need real secrets management. Today secrets are:

They get forgotten/lost/reset/broken a lot.

Here's a first-pass list of stuff we should be managing in a password manager:

The Infra team has a strong preference for Bitwarden. It's open-source, making it a good fit for SCALE's principals. It's had several security audits. If we decide we want to one day, we can even run our own server (though I don't see any need to, at least for now). It supports every platform and all major browsers, including Linux and Android, and even has a CLI interface.

Alternatives include 1Password and LastPass (with LastPass being the last choice).

This was originally requested (non-urgently) on 8/10/22 on the Chairs mailing list. @irabinovitch requested a list of use-cases which was provided on 8/11 and is reproduced above. However, as we approach SCALE 20X, we'll need time to move stuff into whatever solution, get groups and shared folders all setup with the right permissions, figure out how to manage the whole thing and get the various teams on board.

genebean commented 4 months ago

Are there next steps on this people can help with?

irabinovitch commented 4 months ago

If you can convince one of the vendors to donate services, we can consider it. Otherwise we'd need to cut spend somewhere else like staff hotel rooms.

genebean commented 4 months ago

How many users would be needed in a paid version? Alternatively, how would you feel about someone like myself hosting the self hosted version of Bitwarden?

irabinovitch commented 4 months ago

No idea how many users. I've not gotten a clear answer there. I'm not opposed to hosting a free self-hosted version, but id guess we want some of the non-free features.

jaymzh commented 4 months ago

There are no non-free features. It's all opensource!

Yeah hosting would be great. Lets assume 50+ users (but < 100), which was the target I gave Ilan last year - that covers all chairs and primary tech folks with room to spare.

As a bitwarden user, I considered hosting it myself as well, but I barely have time to keep our other infra updated.

I know the VP of eng at 1Password and can hit him up to see if they'd donate. Ilan only got back to me on the budget shortage recently, so I haven't acted on either yet. I'd prefer to start there so we're running one less thing.

genebean commented 4 months ago

Looks like we can get 1Password for free because of what SCALE is. I'll look at getting this going.

https://github.com/1Password/1password-teams-open-source

jaymzh commented 4 months ago

Brilliant!

irabinovitch commented 4 months ago

They previously declined us but happy to have you try.

On Fri, Mar 8, 2024, 9:18 PM Gene Liverman @.***> wrote:

Looks like we can get 1Password for free because of what SCALE is. I'll look at getting this going.

https://github.com/1Password/1password-teams-open-source

— Reply to this email directly, view it on GitHub https://github.com/socallinuxexpo/SCALE-Planning/issues/253#issuecomment-1986695692, or unsubscribe https://github.com/notifications/unsubscribe-auth/AACGW5UXINHRGEW25WKECZTYXJWQNAVCNFSM6AAAAAAS77MXZOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBWGY4TKNRZGI . You are receiving this because you were mentioned.Message ID: @.***>

jaymzh commented 4 months ago

They previously declined us but happy to have you try.

Through that process? Lame.

@genebean - why don't I hit up Pedro. He's actually the CTO, not the VPofEng. I bet he can make this all just go away.

@irabinovitch - if you have some reference to when we got rejected, that'd be helpful

genebean commented 4 months ago

Nice. I just started it a few minutes ago... is it worth finishing this path first?

jaymzh commented 4 months ago

If we already went through it, and especially if @irabinovitch has any sort of reference/email/date/something, it's probably worth me chatting with pedro first. Just my take

genebean commented 4 months ago

Sure thing. Can I shoot you an invite to the org I just created? I can use the email in your GitHub profile or I'm guessing your linuxfests one is your name at that domain. Edit: I'm guessing @phil in scale slack is you too and that has an email associated with it

jaymzh commented 4 months ago

I signed up. Would you mind making me an admin of the org?

genebean commented 4 months ago

You both are owners & admins now

jaymzh commented 4 months ago

Thanks. Pedro say us being denied was probably a mistake and he'll look into it.

genebean commented 4 months ago

That is great news!

irabinovitch commented 4 months ago

FYI. Sales reps calling to ask when we plan to convert to paying customers.

genebean commented 4 months ago

I got an email too

jaymzh commented 4 months ago

ignore them for now. I'm working with Pedro, we'll be setup today or tomorrow

jaymzh commented 4 months ago

So best anyone can tell @irabinovitch never actually applied. They can't find any reference to Ilan, SCALE, socallinuxexpo, etc. anywhere. I dug through all the PRs as well and found nothing.

I've filed one here at Pedro's request: https://github.com/1Password/1password-teams-open-source/pull/909

It should get sorted soon.

irabinovitch commented 4 months ago

I did indeed apply and spoke with someone who told me we didn't qualify. I did not file a PR. If you really want it I can track down their name and email.

On Mon, Mar 11, 2024, 6:20 PM Phil Dibowitz @.***> wrote:

So best anyone can tell @irabinovitch https://github.com/irabinovitch never actually applied. They can't find any reference to Ilan, SCALE, socallinuxexpo, etc. anywhere. I dug through all the PRs as well and found nothing.

I've filed one here at Pedro's request: 1Password/1password-teams-open-source#909 https://github.com/1Password/1password-teams-open-source/pull/909

It should get sorted soon.

— Reply to this email directly, view it on GitHub https://github.com/socallinuxexpo/SCALE-Planning/issues/253#issuecomment-1989734384, or unsubscribe https://github.com/notifications/unsubscribe-auth/AACGW5U2IHRG5MNWEQF45ALYXZRAPAVCNFSM6AAAAAAS77MXZOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBZG4ZTIMZYGQ . You are receiving this because you were mentioned.Message ID: @.***>

jaymzh commented 4 months ago

It's fine, they were just trying to find the thing to associate it with. As I said I opened a new one, so we're all good.

jaymzh commented 4 months ago

OK we've been approved. You should stop getting mails.

However, @irabinovitch - Pedro would really like to track down what happened and asked me to follow up and provide any information on who you spoke to, when, what their reasons were so they can make sure that all teams are aligned on policy internally.

Thanks

irabinovitch commented 4 months ago

Glad to hear we were approved. Feel free to connect us with email and Ill share what I have avaialble.

jaymzh commented 4 months ago

done