3 ms·

This is something that I would love to see happen with open source projects: 1. company is created around the project 2. other companies started using the proj

by omouse 10y ago

This is something that I would love to see happen with open source projects: 1. company is created around the project 2. other companies started using the project and find it handy 3. companies need maintenance and support: consulting companies start opening up shop and serving them 4. parent company gets more customers because they're the first/official supporting company This similiar to the Wordpress model I think and they're fairly successful, they've got a whole ecosystem. We have added the Sandstorm Technology Roadmap to the Sandstorm repo, where you can learn about everything Sandstorm has built and plans to build. Perfect, now another company can take a chance on raising VC funds for this or bankrolling it themselves.

kentonv 10y ago
Ehh... The support model is pretty tricky to make work. It doesn't scale well, and it creates somewhat of a conflict of interest: if you make your product work too well, people won't need support. It has worked a few times but there are a lot more failures than successes, sadly. > Perfect, now another company can take a chance on raising VC funds for this or bankrolling it themselves. Let's be honest: it would be nearly impossible for this to happen. If we couldn't get VCs to fund us, no VC is going to fund some other people -- who likely don't understand the codebase or the vision in anywhere near as much detail as we do -- to work on the same thing. Even with an extremely rational argument for why they'd be able to do better, the psychological barriers to investing in something that "already failed" are huge. But if someone did try this, they should probably hire some people from the original team, I would think. :) A more likely scenario is, if Sandstorm shows strong growth as an open source project to the point of being fundable again, then the original team (with maybe some added biz dev expertise) can restart the company in the future.
- CiPHPerCoder 10y ago
  > A more likely scenario is, if Sandstorm shows strong growth as an open source project to the point of being fundable again, then the original team (with maybe some added biz dev expertise) can restart the company in the future. I sincerely wish you the best of luck. I think it's a valuable-to-society idea, even if it was hard to market.
CiPHPerCoder 10y ago
> This is something that I would love to see happen with open source projects: That won't happen. But not for lack of trying! My consulting company, Paragon Initiative Enterprises, has produced over a dozen high quality open source projects that make it easier to write secure PHP software. For starters, we wrote an entire CMS that has secure automatic updates baked into its core as a first-class feature (including for extension developers): https://paragonie.com/project/airship https://paragonie.com/project/airship Worried about SQL injection? EasyDB makes it easy and intuitive to use prepared statements. https://github.com/paragonie/easydb https://github.com/paragonie/easydb Need Content-Security-Policy headers quickly and easily? You want CSP-Builder: https://paragonie.com/project/csp-builder https://paragonie.com/project/csp-builder Want all the security of libsodium with an even simpler interface and a separate class for dealing with the filesystem? Check out Halite: https://paragonie.com/project/halite https://paragonie.com/project/halite Want to stop CSRF (including replay attacks)? https://github.com/paragonie/anti-csrf https://github.com/paragonie/anti-csrf Want to quickly examine the differences between two PHP Archives (e.g. for reproducible builds)? https://github.com/paragonie/pharaoh https://github.com/paragonie/pharaoh We even wrote the community's accepted interface for generating cryptographically secure random numbers in PHP 5 projects: https://github.com/paragonie/random_compat https://github.com/paragonie/random_compat And coming soon (pending an audit), a pure-PHP implementation of libsodium that will likely be adopted by WordPress so its automatic updates are Ed25519 secured: https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat And even more: https://paragonie.com/projects https://paragonie.com/projects Guess how many clients we've gotten from all this open source software we wrote over the past two years that demonstrably improves the security posture of software written in PHP? Zero. My solution: Our next project isn't going to be OSS, and it's unlikely that any of our future ones will be unless it's intended to be a giveaway. The open source + consulting business model may sound good in theory, but it simply doesn't work. (Though, I will grant that it's possible that the "consulting about someone else's open source project" is more sustainable, due to near-zero investment in said project itself.)
- omouse 10y ago
  The reason I mentioned it is because it has worked for Wordpress, Drupal and Magento in general. There's countless shops that build plugins and themes for those and are hired for things ranging from small changes to full-scale development. I would love to see that happen with Sandstorm or other projects because maybe the consulting model doesn't work for the parent company but I'm sure there's hundreds of smaller consulting firms that would love to support it.
chipotle_coyote 10y ago
This was largely RethinkDB's plan, and it worked about as well for us as it did for Sandstorm. One can argue Sandstorm executed it a bit better than we did. (Disclosure: speaking as a former RethinkDB employee, but not for anyone else, and I have no "inside information" to speak of about the finances.) I think this can work, but I think the unpleasant truth is that the developer tools market--which is certainly what RethinkDB was in, and which Sandstorm was certainly at least adjacent to--is a mostly lousy place to be in. The bulk of WordPress's revenue doesn't come from support or their plugin system, it comes from "premium subscription" services sold to their hosting customers and, to a lesser degree, advertising they show on hosted blogs (that aren't paying for premium subscriptions).
- naasking 10y ago
  > I think this can work, but I think the unpleasant truth is that the developer tools market--which is certainly what RethinkDB was in, and which Sandstorm was certainly at least adjacent to--is a mostly lousy place to be in. I think it is difficult to convince devs to pay for tools given the plethora of free options available. It's a stupid mindset even I suffer from, and I think only heavy marketing will work to convince devs of the advantages of a particular paid tool. I was convinced for Sandstorm, but didn't have a project I could use it for just yet, but I hadn't even heard of RethinkDB until a week before they announced the shut down.

by omouse 10y ago

kentonv 10y ago

Ehh... The support model is pretty tricky to make work. It doesn't scale well, and it creates somewhat of a conflict of interest: if you make your product work too well, people won't need support. It has worked a few times but there are a lot more failures than successes, sadly. > Perfect, now another company can take a chance on raising VC funds for this or bankrolling it themselves. Let's be honest: it would be nearly impossible for this to happen. If we couldn't get VCs to fund us, no VC is going to fund some other people -- who likely don't understand the codebase or the vision in anywhere near as much detail as we do -- to work on the same thing. Even with an extremely rational argument for why they'd be able to do better, the psychological barriers to investing in something that "already failed" are huge. But if someone did try this, they should probably hire some people from the original team, I would think. :) A more likely scenario is, if Sandstorm shows strong growth as an open source project to the point of being fundable again, then the original team (with maybe some added biz dev expertise) can restart the company in the future.

CiPHPerCoder 10y ago
> A more likely scenario is, if Sandstorm shows strong growth as an open source project to the point of being fundable again, then the original team (with maybe some added biz dev expertise) can restart the company in the future. I sincerely wish you the best of luck. I think it's a valuable-to-society idea, even if it was hard to market.

CiPHPerCoder 10y ago

> This is something that I would love to see happen with open source projects: That won't happen. But not for lack of trying! My consulting company, Paragon Initiative Enterprises, has produced over a dozen high quality open source projects that make it easier to write secure PHP software. For starters, we wrote an entire CMS that has secure automatic updates baked into its core as a first-class feature (including for extension developers): https://paragonie.com/project/airship https://paragonie.com/project/airship Worried about SQL injection? EasyDB makes it easy and intuitive to use prepared statements. https://github.com/paragonie/easydb https://github.com/paragonie/easydb Need Content-Security-Policy headers quickly and easily? You want CSP-Builder: https://paragonie.com/project/csp-builder https://paragonie.com/project/csp-builder Want all the security of libsodium with an even simpler interface and a separate class for dealing with the filesystem? Check out Halite: https://paragonie.com/project/halite https://paragonie.com/project/halite Want to stop CSRF (including replay attacks)? https://github.com/paragonie/anti-csrf https://github.com/paragonie/anti-csrf Want to quickly examine the differences between two PHP Archives (e.g. for reproducible builds)? https://github.com/paragonie/pharaoh https://github.com/paragonie/pharaoh We even wrote the community's accepted interface for generating cryptographically secure random numbers in PHP 5 projects: https://github.com/paragonie/random_compat https://github.com/paragonie/random_compat And coming soon (pending an audit), a pure-PHP implementation of libsodium that will likely be adopted by WordPress so its automatic updates are Ed25519 secured: https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat And even more: https://paragonie.com/projects https://paragonie.com/projects Guess how many clients we've gotten from all this open source software we wrote over the past two years that demonstrably improves the security posture of software written in PHP? Zero. My solution: Our next project isn't going to be OSS, and it's unlikely that any of our future ones will be unless it's intended to be a giveaway. The open source + consulting business model may sound good in theory, but it simply doesn't work. (Though, I will grant that it's possible that the "consulting about someone else's open source project" is more sustainable, due to near-zero investment in said project itself.)

omouse 10y ago
The reason I mentioned it is because it has worked for Wordpress, Drupal and Magento in general. There's countless shops that build plugins and themes for those and are hired for things ranging from small changes to full-scale development. I would love to see that happen with Sandstorm or other projects because maybe the consulting model doesn't work for the parent company but I'm sure there's hundreds of smaller consulting firms that would love to support it.

chipotle_coyote 10y ago

This was largely RethinkDB's plan, and it worked about as well for us as it did for Sandstorm. One can argue Sandstorm executed it a bit better than we did. (Disclosure: speaking as a former RethinkDB employee, but not for anyone else, and I have no "inside information" to speak of about the finances.) I think this can work, but I think the unpleasant truth is that the developer tools market--which is certainly what RethinkDB was in, and which Sandstorm was certainly at least adjacent to--is a mostly lousy place to be in. The bulk of WordPress's revenue doesn't come from support or their plugin system, it comes from "premium subscription" services sold to their hosting customers and, to a lesser degree, advertising they show on hosted blogs (that aren't paying for premium subscriptions).

naasking 10y ago
> I think this can work, but I think the unpleasant truth is that the developer tools market--which is certainly what RethinkDB was in, and which Sandstorm was certainly at least adjacent to--is a mostly lousy place to be in. I think it is difficult to convince devs to pay for tools given the plethora of free options available. It's a stupid mindset even I suffer from, and I think only heavy marketing will work to convince devs of the advantages of a particular paid tool. I was convinced for Sandstorm, but didn't have a project I could use it for just yet, but I hadn't even heard of RethinkDB until a week before they announced the shut down.