3 ms·

Strange that the author mentions two ways of doing this (managed here vs. managed there), and spends the rest of the article saying how those are not in any way

Strange that the author mentions two ways of doing this (managed here vs. managed there), and spends the rest of the article saying how those are not in any way fun, but never mentions the obvious third option: As Is. I sell a self-hosted source-included license of Twiddla, as a single breakout of the current codebase, with the understanding that no further updates will be provided once we're all satisfied that you're up and running correctly. You can do whatever you like with the code, and I'm happy to sell you additional consulting time to help with what you're doing. But you're essentially on your own. It pretty much dispenses with every concern in the article.

majewsky 10y ago
How do you deal with updates? Do you just sell them a newer version, like with MS Office major upgrades in the past?
- jasonkester 10y ago
  No updates. Hence the "As Is." They're buying the version of the website as it exists at the point of time when they buy it. The assumption being that it works for them now, it should continue working for them in the future, regardless of what direction the .com goes.
  - reitanqild 10y ago
    What about vulnerabilities then? Or is it supposed that the customer use it behind a firewall / VPN solution?
    - jasonkester 10y ago
      In this case, we're talking about software built on the Microsoft stack, so most of that is Windows Update's job (patching servers manually isn't really something that needs to happen in this world). As to vulnerabilities in the handful of 3rd party libraries that we use? In the 10 years that Twiddla has been around, we've had exactly zero cases where we had to patch something from our end for security reasons. I guess there's something to be said about avoiding the tall skinny (and wobbly) tower of 3rd party dependencies that seems to be the norm these days in web app development.
      - reitanqild 10y ago
        > In the 10 years that Twiddla has been around, we've had exactly zero cases where we had to patch something from our end for security reasons. That is quite good compared to the rest of the industry. Nice work!
    - PeterisP 10y ago
      If you're deploying a SaaS system on premises, because a particular company needs it, then it's quite likely that this is also the same type of company that would have a standard procedure to expose only a single port of that server to a specific list of internal computers only on a network level. The kind of companies that don't have everything behind a firewall / VPN would also just use SaaS directly, instead of requesting the hassle of an on-premise setup.

majewsky 10y ago

How do you deal with updates? Do you just sell them a newer version, like with MS Office major upgrades in the past?

jasonkester 10y ago
No updates. Hence the "As Is." They're buying the version of the website as it exists at the point of time when they buy it. The assumption being that it works for them now, it should continue working for them in the future, regardless of what direction the .com goes.
- reitanqild 10y ago
  What about vulnerabilities then? Or is it supposed that the customer use it behind a firewall / VPN solution?
  - jasonkester 10y ago
    In this case, we're talking about software built on the Microsoft stack, so most of that is Windows Update's job (patching servers manually isn't really something that needs to happen in this world). As to vulnerabilities in the handful of 3rd party libraries that we use? In the 10 years that Twiddla has been around, we've had exactly zero cases where we had to patch something from our end for security reasons. I guess there's something to be said about avoiding the tall skinny (and wobbly) tower of 3rd party dependencies that seems to be the norm these days in web app development.
    - reitanqild 10y ago
      > In the 10 years that Twiddla has been around, we've had exactly zero cases where we had to patch something from our end for security reasons. That is quite good compared to the rest of the industry. Nice work!
  - PeterisP 10y ago
    If you're deploying a SaaS system on premises, because a particular company needs it, then it's quite likely that this is also the same type of company that would have a standard procedure to expose only a single port of that server to a specific list of internal computers only on a network level. The kind of companies that don't have everything behind a firewall / VPN would also just use SaaS directly, instead of requesting the hassle of an on-premise setup.