8 ms·

Sandstorm for Work Beta: LDAP, SAML, Organization Management

131 points by jgillich 11y ago

philprx 11y ago
Too bad the pricing is not as smart as the technology: Look at splunk, it's free for small usage, to get people started, just as google apps used to be, then when half or the whole company depends on the tool, then it starts to cost money, and quite a lot. That's better, softer approach. Anyway, kudos to sandstorm, what they built is awesome.
- kentonv 11y ago
  Thanks for the feedback! Honestly if you are, say, 5-10 people, you'll get by just fine with the free version of Sandstorm. You can log in using an email address or Google or Github account. I think things like LDAP integration, access control lockdowns, and audit logging start becoming important when you want to have, say, 50 people or more on the server together, with a dedicated IT person or team managing it. We should probably work on making that clearer in our marketing copy, though!
  - nickpsecurity 11y ago
    Things like LDAP are often in the enterprise version of open apps. I sometimes wonder if self-contained implementation if those features simple to integrate and deploy would disrupt that. Disrupt the companies disrupting everything else! Haha. Not sure, though. It might still be a pain on a per-app basis to get enterprise features working.
losvedir 11y ago
Hmm, I'm a huge fan of sandstorm, but I have mixed feelings about this. I like sandstorm for its promise of easily running my own apps on my own server. My data is private and secure, yet I can still access it from my phone, laptop, library, etc. And a lot of really smart people are spending a lot of time making this happen, so in some ways I'm happy that they have a monetization strategy and strong motivation to keep at it! On the other hand, until now, I had thought their monetization strategy was their oasis hosting platform. But now that I see this "sandstorm for business" strategy, it seems there's at least a little incentive to hamstring the non-business side to encourage people to purchase the feature key. The incentives aren't exactly aligned anymore. Before, I thought that any development that improved the platform would increase oasis use, and be good for them and good for private self hosters. Now, development on the "for business" features is much better for them with no benefit to people who haven't purchased the key, so I think there might be more developer focus on it. On the other other hand, I can't think of a better way of going about it. Kudos to them for keeping it open source, being up front about the license check, and having the auto-update strategy. I like that if a business wants to stop paying, they're essentially locked into what they had paid for to that point, but haven't lost their data or access to the features they had. They just stopped paying for ongoing development so they don't get future features. That's pretty neat. Overall, I don't see anything wrong about this approach, and a healthy sandstorm ecosystem and happy sandstorm devs is good for everyone, including those self-hosting the free version. It's just now I have a tinge of disappointment thinking of all this great development I was getting for free before, that now might be spent on enterprise features not available to me.
- mst 11y ago
  My thought: They're trying to be Red Hat, except intentionally making their CentOS easy and inevitable.
  - nickpsecurity 11y ago
    That's a disturbing, but interesting, thought. I wonder how often this has played out. Might be worth considering explicitly in a risk assessment of OSS-centric startups.
  - kentonv 11y ago
    Note that while the set of "enterprise add-ons" we launched today are open source, we are not promising that all future add-ons will be open source. In particular future products we have planned that specifically target the needs of very large organizations may be proprietary. Once the contracts are so big that it's cheaper for the corp to maintain their own fork, then obviously our stay-open strategy breaks down, but we have a plan for that. (That said, I'm still looking for ways to make it work as OSS if possible.)
- kentonv 11y ago
  Sandstorm founder here. Thanks for your feedback -- I definitely understand the concern, and it's something I've thought about a lot. To be clear, we've always been upfront about our intent to sell "enterprise add-ons" to the self-hosted solution. See this post, from January 2015: https://sandstorm.io/news/2015-01-15-sandstorm-1.3M-seed-round-pay-it-forward https://sandstorm.io/news/2015-01-15-sandstorm-1.3M-seed-rou... It is our intent that any feature which is broadly useful to someone running a personal server should be in the free version. There is a gray area, of course: some people actually run LDAP servers in their homes. But we're pretty sure that the vast majority of personal users won't be interested in these business-oriented features. And we have a lot of potential features to implement that businesses need but individuals absolutely don't (examples: legal discovery tools; HIPAA compliance; cluster management), so there's really no need for us to hold back the more broadly-useful features for leverage. I'd actually argue that it would be very much against our interest to "hamstring" the personal version of the product, not just morally but strategically. Strategically speaking, we aren't going to make much money off personal users no matter what pricing we impose. Business is where the money is. Personal users are incredibly important, though, because the kinds of enthusiasts who would run their own Sandstorm server are also the kinds of people likely to develop apps and/or advocate for Sandstorm to their employer. It would be shooting ourselves in the foot to do anything to turn off those users. Of course, strategy isn't the only thing holding me back. Morally speaking, I personally started Sandstorm to make open source web apps viable, not to get rich. See: https://sandstorm.io/news/2014-07-21-open-source-web-apps-require-federated-hosting https://sandstorm.io/news/2014-07-21-open-source-web-apps-re... To be honest, I would actually argue that our hosting service is a bigger conflict of interest than Sandstorm for Work. It could make us inclined to make it hard to set up and maintain Sandstorm -- why spend time making installation painless and updates automatic if it only benefits the people who aren't paying us? Sandstorm for Work is actually the exact same build as the free version, with the same installation process, so now we're incentivized to keep it really easy -- and indeed, last night we shipped an overhaul of our first-time setup UX, which we did for the Sandstorm for Work launch, but it applies to the free version too. All in all, of all the options we've considered, I think this approach actually gives us the best alignment of incentives.

131 points by jgillich 11y ago

Too bad the pricing is not as smart as the technology: Look at splunk, it's free for small usage, to get people started, just as google apps used to be, then when half or the whole company depends on the tool, then it starts to cost money, and quite a lot. That's better, softer approach. Anyway, kudos to sandstorm, what they built is awesome.

kentonv 11y ago
Thanks for the feedback! Honestly if you are, say, 5-10 people, you'll get by just fine with the free version of Sandstorm. You can log in using an email address or Google or Github account. I think things like LDAP integration, access control lockdowns, and audit logging start becoming important when you want to have, say, 50 people or more on the server together, with a dedicated IT person or team managing it. We should probably work on making that clearer in our marketing copy, though!
- nickpsecurity 11y ago
  Things like LDAP are often in the enterprise version of open apps. I sometimes wonder if self-contained implementation if those features simple to integrate and deploy would disrupt that. Disrupt the companies disrupting everything else! Haha. Not sure, though. It might still be a pain on a per-app basis to get enterprise features working.

losvedir 11y ago

Hmm, I'm a huge fan of sandstorm, but I have mixed feelings about this. I like sandstorm for its promise of easily running my own apps on my own server. My data is private and secure, yet I can still access it from my phone, laptop, library, etc. And a lot of really smart people are spending a lot of time making this happen, so in some ways I'm happy that they have a monetization strategy and strong motivation to keep at it! On the other hand, until now, I had thought their monetization strategy was their oasis hosting platform. But now that I see this "sandstorm for business" strategy, it seems there's at least a little incentive to hamstring the non-business side to encourage people to purchase the feature key. The incentives aren't exactly aligned anymore. Before, I thought that any development that improved the platform would increase oasis use, and be good for them and good for private self hosters. Now, development on the "for business" features is much better for them with no benefit to people who haven't purchased the key, so I think there might be more developer focus on it. On the other other hand, I can't think of a better way of going about it. Kudos to them for keeping it open source, being up front about the license check, and having the auto-update strategy. I like that if a business wants to stop paying, they're essentially locked into what they had paid for to that point, but haven't lost their data or access to the features they had. They just stopped paying for ongoing development so they don't get future features. That's pretty neat. Overall, I don't see anything wrong about this approach, and a healthy sandstorm ecosystem and happy sandstorm devs is good for everyone, including those self-hosting the free version. It's just now I have a tinge of disappointment thinking of all this great development I was getting for free before, that now might be spent on enterprise features not available to me.

mst 11y ago
My thought: They're trying to be Red Hat, except intentionally making their CentOS easy and inevitable.
- nickpsecurity 11y ago
  That's a disturbing, but interesting, thought. I wonder how often this has played out. Might be worth considering explicitly in a risk assessment of OSS-centric startups.
- kentonv 11y ago
  Note that while the set of "enterprise add-ons" we launched today are open source, we are not promising that all future add-ons will be open source. In particular future products we have planned that specifically target the needs of very large organizations may be proprietary. Once the contracts are so big that it's cheaper for the corp to maintain their own fork, then obviously our stay-open strategy breaks down, but we have a plan for that. (That said, I'm still looking for ways to make it work as OSS if possible.)
kentonv 11y ago
Sandstorm founder here. Thanks for your feedback -- I definitely understand the concern, and it's something I've thought about a lot. To be clear, we've always been upfront about our intent to sell "enterprise add-ons" to the self-hosted solution. See this post, from January 2015: https://sandstorm.io/news/2015-01-15-sandstorm-1.3M-seed-round-pay-it-forward https://sandstorm.io/news/2015-01-15-sandstorm-1.3M-seed-rou... It is our intent that any feature which is broadly useful to someone running a personal server should be in the free version. There is a gray area, of course: some people actually run LDAP servers in their homes. But we're pretty sure that the vast majority of personal users won't be interested in these business-oriented features. And we have a lot of potential features to implement that businesses need but individuals absolutely don't (examples: legal discovery tools; HIPAA compliance; cluster management), so there's really no need for us to hold back the more broadly-useful features for leverage. I'd actually argue that it would be very much against our interest to "hamstring" the personal version of the product, not just morally but strategically. Strategically speaking, we aren't going to make much money off personal users no matter what pricing we impose. Business is where the money is. Personal users are incredibly important, though, because the kinds of enthusiasts who would run their own Sandstorm server are also the kinds of people likely to develop apps and/or advocate for Sandstorm to their employer. It would be shooting ourselves in the foot to do anything to turn off those users. Of course, strategy isn't the only thing holding me back. Morally speaking, I personally started Sandstorm to make open source web apps viable, not to get rich. See: https://sandstorm.io/news/2014-07-21-open-source-web-apps-require-federated-hosting https://sandstorm.io/news/2014-07-21-open-source-web-apps-re... To be honest, I would actually argue that our hosting service is a bigger conflict of interest than Sandstorm for Work. It could make us inclined to make it hard to set up and maintain Sandstorm -- why spend time making installation painless and updates automatic if it only benefits the people who aren't paying us? Sandstorm for Work is actually the exact same build as the free version, with the same installation process, so now we're incentivized to keep it really easy -- and indeed, last night we shipped an overhaul of our first-time setup UX, which we did for the Sandstorm for Work launch, but it applies to the free version too. All in all, of all the options we've considered, I think this approach actually gives us the best alignment of incentives.