Fnox, a Secret Manager That Pairs Well with Mise

Posted2 months agoActive2 months ago

bpierre

185 points

43 comments

github.comTechstory

calmmixed

Debate

60/100

Secret ManagementDevops ToolsSecurity

Key topics

Secret Management

Devops Tools

Security

Fnox is a new secret manager that pairs well with mise, a dev environment management tool, sparking discussion on its design and potential alternatives.

Snapshot generated from the HN discussion

Discussion Activity

Moderate engagement

First comment

Peak period

12-18h

Avg / period

3.2

Comment distribution29 data points

Loading chart...

Based on 29 loaded comments

Key moments

01Story posted
Oct 27, 2025 at 12:29 PM EDT
2 months ago
Step 01
02First comment
Oct 27, 2025 at 1:56 PM EDT
1h after posting
Step 02
03Peak activity
10 comments in 12-18h
Hottest window of the conversation
Step 03
04Latest activity
Oct 30, 2025 at 9:22 AM EDT
2 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (43 comments)

Showing 29 comments of 43

mackross

2 months ago

1 reply

Love the thought put into mise and now fnox. They’re a joy to use.

maccard

2 months ago

3 replies

Agree on mise. It's a great tool, really well implemented and easy to use. I've been trying to set up hk[0] this week and it's unfortunately not been as smooth a ride though.

[0] https://hk.jdx.dev/

jdxcode

2 months ago

1 reply

that's fair. The DX of hk is a much harder problem since it will always require a decent amount of customization to fit into a project. I will be improving this though.

I'd probably say hk is the most challenging pre-commit manager to setup compared to its peers. That said, it's also the only one that can run hooks in parallel safely and deal with partially staged files where the others don't bother with these problems.

At least right now hk is good for folks that want the fastest and don't mind a bit of effort. Hopefully I can improve that and make it the best all-around.

maccard

2 months ago

2 replies

Im very open to a bit of a learning curve! I wasn’t able to get a pre commit of ‘tofu fmt -check’ with the list of tf files changed working, which was frustrating! I found working with pkl tough as there’s little/no editor support (compared to writing tasks in toml with mise). I tried adding a post install hook to mise to run hk install which had surprising side effects!

I’m looking forward to trying fnox!

jdxcode

2 months ago

1 reply

I added this for the next hk release: https://github.com/jdx/hk/commit/0fe8610fbe5d9f1c6977e0be596...

maccard

2 months ago

In the spirit of things I sent a PR in for the other footgun that I noticed. https://github.com/jdx/hk/pull/382

jdxcode

2 months ago

I suspect it may have been that it was using `*.tf` instead of `**/*.tf`

drcongo

2 months ago

1 reply

Mind if I ask what trouble you've had setting up hk? I've been using it a while now and I love it almost as much as I love mise. Took me a little while to get my head around pkl (and if I'm honest, I'm very much still winging it) but otherwise it's been a joy to use.

maccard

2 months ago

1 reply

No support for opentofu, so I had to write a custom hook for tofu instead of terraform. Then the hook itself didn’t work because tofu fmt didn’t like the full list of files being passed on instead of just the tf files. Then I had an issue with tflint. It wasn’t clear that hk would install in the current directory and not the git repo. Writing pkl was awkward - vscode has no support.

That’s just off the top of my head.

drcongo

2 months ago

1 reply

Thanks, that's a list of things I've never needed from it which explains our different experiences!

maccard

2 months ago

1 reply

Our use case is a dotnet project with infra defined in terraform. Dotnet fmt is too slow to run as a pre commit hook so I wanted to try tflint and tofu fmt as I know they are very quick and they are relatively easy to work with.

They both accept a list of files to work on, but the filter on hk gives you a full list of files that changed, so if a cs file and a tf file changes, both steps will fire with both the cs and the tf file

I think a small improvement might be adding a matched_files template sub that would only show the files that matched the glob rule. I also think an LSP integration for VSCode would go a long way. I could manage the first but the second might be pushing my limits

jdxcode

2 months ago

1 reply

there is one: https://github.com/apple/pkl-lsp it works great for me

maccard

2 months ago

Thanks! I didn’t think of searching outside the store. Works great so far.

antimius

2 months ago

Yeah, I found the import of existing pre-commit config wasn't very useful. I just switched to using prek as a much faster drop-in replacement for pre-commit https://github.com/j178/prek. Really like mise though, and just started using fnox yesterday.

cultureulterior

2 months ago

4 replies

There's no explanation or link to mise from that page that I can see. I now know what mise is, but that's from googling

danw1979

2 months ago

github.com is a popular website that lets you publish your git (a version control system) -based projects for others to read and contribute to.

In this case, the user “jdx” has published an issue (a bug or feature development tracker) about a complimentary project, but you can still access the source code and documentation about “mise” by clicking on the hyperlink labelled “mise” at the top of the page.

NamlchakKhandro

2 months ago

lmao wut?

cultureulterior

2 months ago

It's a dev tool manager

fishgoesblub

2 months ago

The link in the post is literally on the Mise Github page. One click and you're on the main page reading the detailed README.

augunrik

2 months ago

2 replies

From the initial feature set it sounds like Mozilla SOPS.

cippaciong

2 months ago

I was gonna say the same. Not that there is anything bad in having alternatives, but if you like fnox, you might want to have a look at SOPS as well.

KingMob

2 months ago

Mise already supported sops and age (https://mise.jdx.dev/environments/secrets/), so I'm assuming there's something more to it. (Existing or planned.)

pprotas

2 months ago

3 replies

Any alternatives to mise with less bloat? I don’t want the direnv and tasks functionality

arcanemachiner

2 months ago

asdf is a predecessor to mise, and focuses language version management only.

https://asdf-vm.com

rsanheim

2 months ago

Just...don't use them?

I've use mise happily for many months without using direnv or tasks, and everything I use it for works and is solid. Installs python, ruby, node, does the switching, does the shims, stays out of the way.

direnv and tasks and everything else mise can do is all opt-in.

NamlchakKhandro

2 months ago

what bloat?

Ferret7446

2 months ago

1 reply

If you need to manage your dev secrets, it seems like you've fucked up? It's 2025, any secrets should be generated on or provisioned on a single machine. If you're copying them or storing them, then https://xkcd.com/463/

elric

2 months ago

Yes, because in 2025 every business is FAANG scale and has a dedicated SRE team and a SecOps team to manage all the secrets foo. (/s, obviously)

Different people have different experiences and work on things in a very diverse scale. The existence of one thing does not obviate all other things.

63stack

2 months ago

I was about to implement it into a pilot project, but then ran into this while reading the docs:

# New person joins the team:

# 7. Team lead updates fnox.toml with new recipient

# Then re-encrypts all secrets:

fnox set DATABASE_URL "$(fnox get DATABASE_URL)" --provider age # ... repeat for all secrets

It's a bit surprising you have to manually do this, I'd imagine fnox already has knowledge of all the secrets and could do this automatically.

14 more comments available on Hacker News

View full discussion on Hacker News

ID: 45722931Type: storyLast synced: 11/20/2025, 7:35:46 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.

Open link View on HN