5 ms·

> "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or

> "Software must be provided as a package – not as a service – with each user running their own private copy." This sounds like a going back to desktop apps. Or am I missing something? Yep, you're missing something: sandstorm is trying to be something like an open source app store for servers. I believe sandstorm can be run on anyone's server (or VPS). Then, you can manage through its web interface (one-click install) various sandstorm-compatible apps onto that server. Since you still control the server, it's your data, but because it's a server it can be accessed from your desktop computer, or phone, or whatever. I think there's an easy backup / transfer solution if, say, you want to move your server from Linode to DigitalOcean or to your own hardware. edit: to clarify how this relates to the post: I'm a web developer. In my free time I'd love to throw together a little free budgeting web app, but I have a distribution problem: Either I centralize it, in which case I have to deal with data security, authentication, and scaling, or I release it as a rails app and ask my users to go through that rigamarole of installing and running their own rails server. Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server.

milansuk 10y ago
Can I ask what will be your business model for your app? What options do you have in Sandstorm enviroment?
- kentonv 10y ago
  Sandstorm does not yet support any direct means of monetizing apps, other than selling the package itself through some existing file-download market. In the future we would like to provide built-in support for in-app purchases as well as possibly a Spotify-like revshare model.
scotu 10y ago
> Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server. you just made a case for NOT using a self hosted opensource app EDIT: extended the quoted text for better context
- Xylakant 10y ago
  no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
  - scotu 10y ago
    I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
    - kentonv 10y ago
      No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.

milansuk 10y ago

Can I ask what will be your business model for your app? What options do you have in Sandstorm enviroment?

kentonv 10y ago
Sandstorm does not yet support any direct means of monetizing apps, other than selling the package itself through some existing file-download market. In the future we would like to provide built-in support for in-app purchases as well as possibly a Spotify-like revshare model.

scotu 10y ago

> Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server. you just made a case for NOT using a self hosted opensource app EDIT: extended the quoted text for better context

Xylakant 10y ago
no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
- scotu 10y ago
  I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
  - kentonv 10y ago
    No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.