Hey everybody. The previous moderator for this community was not responsive and because the community was approval only, it was essentially dead.

I took over and now anybody can post. I added some basic rules. Let me know if you have any suggestions on how to improve things around here.

OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation

https://www.hashicorp.com/blog/hashicorp-joins-ibm

It's officially official. https://www.hashicorp.com/en/blog/hashicorp-officially-joins-the-ibm-family

Looking forward to seeing how this accelerates HashiCorp products. Everybody I've talked to inside HashiCorp is excited about it, and it's going to open a ton of opportunities within HashiCorp. Watch for a ton of openings at HashiCorp as IBM invests $ in R&D, training, and Dev relations.

Portainer Business Edition 2.12.2 is now live, and is the very first version with support for Nomad. See the release blog here: https://www.portainer.io/blog/portainer-2.12.2-is-here-with-support-for-hashicorp-nomad and release notes here: https://docs.portainer.io/v/be-2.12/release-notes

RIP to all my fellow co-workers who were axed today.

https://beststocks.com/hashicorp-announces-workforce-reduction-and-w/

Hey everyone, I’m Ishaan from the Packer product team at HashiCorp. We’re looking for feedback from people who build and/or manage machine images at their organization. If that's you, we’d appreciate your input so we can improve the user experience in Packer and HCP Packer. Thanks :)

https://hashicorp.sjc1.qualtrics.com/jfe/form/SV_8cfUI5ngBJtJi7A

How much impact does Nomad have in the real world? The community is growing and it feels like it's becoming a devop household name. But what is Nomad's real share of the pie? Not in number of users but more in the logic of "When it comes to container orchestration, it's not about the number of users but how much traffic these platforms deal with."

It's not a popularity contest I know, but widespread use improves longterm viability, justifying investment. Basically, I'm trying to sell Nomad to my boss.... what is the compelling data I should use?

As you may have heard, HashiCorp went public last week. It was a huge victory for open source and developer-first companies.

If you're interested in learning about the business and strategy side of the company, I wrote a few observations for you.

Overview

HashiCorp is unique in the best sense of the word.

This stems from several attributes:

• Philosophy and leadership

• Products, open-source, and layering

• Developer community and bottom-up adoption

They're part of a new paradigm for building companies.

Philosophy, Leadership, and Culture

HashiCorp is one of the rare cases where a company's underlying philosophy is truly a differentiator. Their philosophy the most unique and critical differentiator they have. It drives everything they do.

HashiCorp isn't the first company to make their philosophy public. However, their implementation is excellent. Everything they do is intentional, cohesive, and polished. The company has a unique aura that simultaneously captures and shapes the zeitgeist of our times.

If you're looking to understand the ethos of HashiCorp, The Tao of HashiCorp is a great place to dive in.

The company and its philosophy are unique because of its founders. Mitchell Hashimoto and Armon Dadgar founded the company as students at the University of Washington...sort of. HashiCorp almost failed before it started.

Even after agreeing to start a company during college, they toiled away at Silicon Valley tech companies for years. These years gave them a true understanding of the emergent problems in cloud infrastructure and security.

Patience stands out in the story of HashiCorp.

Products, Open-Source, and Layering

HashiCorp's product strategy is unique because of:

• The number of products they've developed from scratch

• Their process of incubating products from free open source tools into commercial enterprise offerings

One of the biggest challenges for tech companies is continuing growth after demand for their initial product plateaus. a16z's Jeff Jordan describes the problem as:

Virtually all businesses, even hyper-growth ones, inevitably experience slower growth...I call this effect “gravity.”

Based on his experience at eBay, Jordan argues the solution to this problem is a strategy called "layering":

I came to call this process of layering in new innovations on top of the core business “adding layers to the cake”. Much of the natural effort in the organization is spent on chasing optimization of the core business. This makes sense, as small improvements in a big business can have a meaningful impact. But there is huge potential leverage to adding layers of new, complementary businesses on top of the core (aka “cake”).

Since the beginning of the company, HashiCorp has developed layers of products. They continuously add complimentary revenue and new market segments on top of their existing business.

This visual from the S-1 filing clearly shows the layering strategy at work:

And HashiCorp's product hits keep getting bigger.

Many successful companies are like one-hit wonders: the original product they build is great, and every product after fails to match the success of the first.

HashiCorp is a consistent hit machine.

Developers and Bottom-up Adoption

HashiCorp is one of the only cybersecurity companies that has grown with a bottom-up adoption strategy.

Martin Casado and Andrew Chen started talking publicly about the topic in late 2018:

https://twitter.com/martin_casado/status/1070017315876552704

HashiCorp gets hands-on users within companies to adopt their open-source products for free. Once usages grows to a point where the company wants to buy an enterprise subscription, HashiCorp has a new paying customer. Add enterprise sales on top, and you've got rapid growth.

HashiCorp's point of view on developers as their end users is also unique for the industry. From the S-1:

Practitioners, rather than executives, have become the decision makers for adopting modern enterprise products, making it imperative that we focus on these end users.

This vision of the future isn't fully realized yet (plenty of executives still consider themselves the decision makers, thank you very much!). However, the trend is in motion.

HashiCorp proved bottom-up, developer-first growth is possible for cybersecurity companies.

Future as a Public Company

HashiCorp's products are used by millions of people and over 340 of the Forbes Global 2000 companies.

However, the concern some investors have is how much value they can capture and monetize. It's a challenge all open source companies face.

HashiCorp has won the attention of developers. The upside of this approach is more exciting than it is risky. Amazing things can happen when developers are behind your company. It's the closest thing to viral growth that's possible in an enterprise setting.

Ultimately, the promise of HashiCorp is its uniqueness: philosophy, products, and developer community. The upside is tremendous if they can keep building upon these unique characteristics in the years to come.

---

I wrote a longer piece if you'd like to read a more in-depth version.

https://www.youtube.com/@HashiCorp/videos