Show HN: Secs-man, a secrets manager you can (not) rely on (github.com)
23 points by Fran314 5 hours ago
This is a tool to manage encrypted local backups of secrets. The core idea is that it aims to be usable without depending on it, meaning that even if the software disappeared from the face of Earth tomorrow, your data would still be recoverable.
It also integrates nicely with NixOS (which is what I use, though it does not require NixOS to be used).
I have summed up a bit of explanation and some answers to reasonable questions in a blog post: https://baldino.dev/blog/secs-man/
bglusman an hour ago
This is an interesting motivation for the project... I kind of get it, but, have you looked at fnox[0][1]? Curious how you'd compare/contrast goals with that if so, I think I prefer that as its not coupled to a single encryption tool (age) but supports age as well as multiple cloud or local options behind one unified interface... I think it can even mix multiple stores together? but I may be missing something/didn't read thoroughly yet...maybe there's a reason fnox doesn't work as well with Nix? fnox was discussed here previously[2]
[0]https://github.com/jdx/mise/discussions/6779 [1]https://github.com/jdx/fnox [2]https://news.ycombinator.com/item?id=45722931
lolpython 3 hours ago
It reads to me as "sex man" but aside from that, looks useful!
Fran314 3 hours ago
As pointed out by the other user, yes it is intentional, I always like a silly name
Also, thank you for the comment! I use it on a weekly basis and it has integrated very nicely with my setup
mrhottakes 3 hours ago
The name is great, we should bring whimsy back to software
srean 2 hours ago
And in these neck of the woods man is a short for manual. Funny name.
soiltype 3 hours ago
I have to assume that's intentional, lol
Fran314 3 hours ago
Yes, that was intentional. Originally it was just called "secrets-manager", I decided to shorten it only because it was (not really) too long to type, and a friend of mine had the realization that you can abbreviate it to something that sounds funny!
philipallstar 44 minutes ago
This project is screaming for a pronunciation guide.
bhuvanbk007 3 hours ago
So is this like a encrypt tool where we pass an external key to encrypt and we can use other apps to decrypt since key is not embedded in the tool? Or am I understanding it wrong?
Fran314 3 hours ago
That is true, but it's not specifically what makes it unique. Most encryption tool (like https://github.com/FiloSottile/age which is what secs-man uses under the hood) do not usually bake in the encryption key, rather they expect you to generate it and provide it.
This is true for secs-man too: when you export it prompts with "Enter passphrase:" and you enter the passphrase (I am considering extending it to read the passphrase from a file or from an environment variable, or piped in from stdin, but I'm still not sure what to think of if from a security standing point and I they don't fit my current use so I don't have it in the current TODO)
What makes it unique is that it can be completely emulated by hand (even though it might be a bit tedious) from just a terminal with bash and age installed. This is explained a bit better in the blog post or in the "philosophy section" of the README, but the main point is that (in my opinion) you should NEVER find yourself vendor-locked-in for any data, in particular for secrets. However, you will always need tools for managing them. My tool is designed to be usable and avoid vendor-lock-in, meaning that even if you lose access to the tool you are not locked out of your tools!
I have probably phrased it better in the linked blog post, I invite you to read it if you're still curious. I'm here for any other question!
rirze 2 hours ago
Sincerely, I don't get the motivation for this. It feels like `age` is pulling most of the work I care about. `age` is the only tool here encrypting and decrypting secrets, are you managing the orchestration of secrets with your tool?
Fran314 2 hours ago
axus 2 hours ago
I confused your username with jeanp413
Fran314 2 hours ago
By the looks of it, someone way more skilled than me!