4 ms·

> For customers there are 0 benefits to a subscription model. For companies of course there are many. OP described in detail the benefit for customers--constan

> For customers there are 0 benefits to a subscription model. For companies of course there are many. OP described in detail the benefit for customers--constantly updated software. Critical for something as security conscience as a password manager.

chrischen 8y ago
People updated software before they started using subscription models. Paying for software meant they had to make more compelling updates.
- seandougall 8y ago
  True in the traditional model. But the Mac App Store model doesn’t have paid upgrades, which meant there was no incentive for them to keep updating. With a subscription system, there’s (theoretically at least) the possibility that customers would jump ship if they feel the developers aren’t pulling their weight.
  - chrischen 8y ago
    Lucky for MacOS users we don’t have to use it like iOS users on the iOS app store.
- nsgi 8y ago
  For something like a password manager, the most compelling updates are security fixes, but there are several problems with charging for these: - It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out - Because security upgrades are invisible to the user, it may be harder for the customer to see their value v. new features - The timeline of when security updates need to go out is less predictable than that of feature upgrades, resulting in unpredictable revenue and expenditure for both the vendor and the customer and the customer may not have the budget to pay for an unexpected security fix - Customers often want to take time to consider whether it is worth paying for upgrades, whereas security fixes should be applied as soon as possible - The vendor must invest a lot of resources in testing the security of their software even when no security upgrades are warranted
  - pktgen 8y ago
    > - It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out The ideal model for locally-run software, in my opinion, is to sell perpetual licenses to each major version for a one-time cost and promise security and maintenance updates for a certain period. New features can go into new major versions that users have to pay for (sometimes with discounted upgrade pricing), or, on a discretionary basis, as free updates. This used to be the typical business model for locally-run software. Microsoft, for example, sold Windows versions for a one-time cost, promised security and some other level of updates until a certain year (and new features could be added on a discretionary basis), and provided upgrade pricing for new major versions that added new features. This kept control in users' hands, as their paid-for software could be used forever (at least until and unless external factors, like hardware incompatibilities, prevented it from working), though of course it would be very dumb to use, say, XP today on an Internet-connected machine. I am generally against subscription models for local software where there is no legitimate reliance on an outside service, and also against the trend of trying to create such a reliance for no legitimate reason ("We've added cloud sync and that's what the subscription is for. Servers cost money every month, which is why we're charging you every month." - except I can handle my own file storage and don't want your sync service).
    - spronkey 8y ago
      Ugh, this trend of 'cloud sync' is highly annoying. Let me put an encrypted file on something that resembles a filesystem. If I want cloud sync, I'll put that file on Dropbox/OneDrive/GDrive/Whatever else. It's only become a big thing after iOS and it's lack-of-a-filesystem and lack of inter-app data flows locked users out of their own devices. Quite often I don't want many of the "new features". For me, bug fixes and security fixes are the main thing, followed by compatibility updates. I'm quite happy to pay for the latter when it was me that caused the issue by updating my OS/hardware in the first place. I'd quite like some amount of the former to be included in the original cost.
      - wilsonnb 8y ago
        It's become a big thing because it's convenient. Every time I sign into 1Password on any of my devices, all of my passwords are there. I don't need an account with Google, Dropbox, or Microsoft for it to work and I don't need to do any manual setup. It "just works", which is exactly what the average person wants their software to do. Manually dealing with files is a sign of poor software design for simple use cases, in my opinion. I quite like the iOS model that abstracts the idea of a filesystem away from the user because the user never cared about the file system anyways. They just had to deal with it to do whatever they really wanted to do.
- CountSessine 8y ago
  You need software companies to provide you with security updates for their products. Insisting that you won’t pay for security updates without new features or that security updates should be offered gratis won’t lead to quality software - it just leads to feature bloat. Attaching a separate price to security updates aligns your needs with a software company’s incentives. Why is that a bad thing in your view?
  - chrischen 8y ago
    If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more, since they have the functionality of your app hostage if you decide to cancel and the automatic monthly billing has no ties to the quantity or wuality of updates they push out. That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software.
    - CountSessine 8y ago
      That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software. Security vulnerabilities generally aren’t considers latent defects under warranty laws (at least not in NA). I’m not sure what the tech world would look like if it were - for one thing, software teams would probably need a P.Eng. on their teams to ship. For another, using open source software would be even harder to do without an intermediary like Red Hat who would be willing to accept tort liability. At any rate, your software vendor has no legal responsibility to provide you with security updates. Maybe they should. But you’ll pay for that anyways. How do you want to amortize those security updates? By paying the dividend discount price of the updates up front and risk having the product abandoned in a few years (cheating you out of your ‘dividend’), or by paying directly through a subscription? If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more, since they have the functionality of your app hostage if you decide to cancel and the automatic monthly billing has no ties to the quantity or wuality of updates they push out. That makes no sense - you have it completely backwards. Their incentive to provide me with timely security updates is my continued subscription fees. On the other hand, if you pay the dividend discount price for those security updates up front, they have every incentive to stop releasing updates and cheat you out of your update ‘dividend’.
efdee 8y ago
To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords.
- chrisweekly 8y ago
  > "To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords." Huh. For my part, I'd have trouble trusting a password manager (or browser, or OS) that claimed it _didn't_ need regular updates in order to remain secure.
- jonknee 8y ago
  Everything on your computer, including the OS itself needs to be regularly updated in order to remain safe... It's not just security, it needs to be updated to continue to run on your devices. New versions of iOS, Android, Windows and Mac OS change things that need to be taken into account. The browser extensions must be kept up to date. There is a lot of work to do just to keep things running without adding any new features.
  - efdee 8y ago
    The point was requiring regular updates to stay safe, so yes, security updates. The attack surface of a password manager would be infinitesimally smaller than that of an OS. As far as general updates go, I agree with you, but these shouldn't need to be that frequent. I still have software from the XP era running on my computer.

chrischen 8y ago

People updated software before they started using subscription models. Paying for software meant they had to make more compelling updates.

seandougall 8y ago
True in the traditional model. But the Mac App Store model doesn’t have paid upgrades, which meant there was no incentive for them to keep updating. With a subscription system, there’s (theoretically at least) the possibility that customers would jump ship if they feel the developers aren’t pulling their weight.
- chrischen 8y ago
  Lucky for MacOS users we don’t have to use it like iOS users on the iOS app store.
nsgi 8y ago
For something like a password manager, the most compelling updates are security fixes, but there are several problems with charging for these: - It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out - Because security upgrades are invisible to the user, it may be harder for the customer to see their value v. new features - The timeline of when security updates need to go out is less predictable than that of feature upgrades, resulting in unpredictable revenue and expenditure for both the vendor and the customer and the customer may not have the budget to pay for an unexpected security fix - Customers often want to take time to consider whether it is worth paying for upgrades, whereas security fixes should be applied as soon as possible - The vendor must invest a lot of resources in testing the security of their software even when no security upgrades are warranted
- pktgen 8y ago
  > - It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out The ideal model for locally-run software, in my opinion, is to sell perpetual licenses to each major version for a one-time cost and promise security and maintenance updates for a certain period. New features can go into new major versions that users have to pay for (sometimes with discounted upgrade pricing), or, on a discretionary basis, as free updates. This used to be the typical business model for locally-run software. Microsoft, for example, sold Windows versions for a one-time cost, promised security and some other level of updates until a certain year (and new features could be added on a discretionary basis), and provided upgrade pricing for new major versions that added new features. This kept control in users' hands, as their paid-for software could be used forever (at least until and unless external factors, like hardware incompatibilities, prevented it from working), though of course it would be very dumb to use, say, XP today on an Internet-connected machine. I am generally against subscription models for local software where there is no legitimate reliance on an outside service, and also against the trend of trying to create such a reliance for no legitimate reason ("We've added cloud sync and that's what the subscription is for. Servers cost money every month, which is why we're charging you every month." - except I can handle my own file storage and don't want your sync service).
  - spronkey 8y ago
    Ugh, this trend of 'cloud sync' is highly annoying. Let me put an encrypted file on something that resembles a filesystem. If I want cloud sync, I'll put that file on Dropbox/OneDrive/GDrive/Whatever else. It's only become a big thing after iOS and it's lack-of-a-filesystem and lack of inter-app data flows locked users out of their own devices. Quite often I don't want many of the "new features". For me, bug fixes and security fixes are the main thing, followed by compatibility updates. I'm quite happy to pay for the latter when it was me that caused the issue by updating my OS/hardware in the first place. I'd quite like some amount of the former to be included in the original cost.
    - wilsonnb 8y ago
      It's become a big thing because it's convenient. Every time I sign into 1Password on any of my devices, all of my passwords are there. I don't need an account with Google, Dropbox, or Microsoft for it to work and I don't need to do any manual setup. It "just works", which is exactly what the average person wants their software to do. Manually dealing with files is a sign of poor software design for simple use cases, in my opinion. I quite like the iOS model that abstracts the idea of a filesystem away from the user because the user never cared about the file system anyways. They just had to deal with it to do whatever they really wanted to do.
CountSessine 8y ago
You need software companies to provide you with security updates for their products. Insisting that you won’t pay for security updates without new features or that security updates should be offered gratis won’t lead to quality software - it just leads to feature bloat. Attaching a separate price to security updates aligns your needs with a software company’s incentives. Why is that a bad thing in your view?
- chrischen 8y ago
  If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more, since they have the functionality of your app hostage if you decide to cancel and the automatic monthly billing has no ties to the quantity or wuality of updates they push out. That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software.
  - CountSessine 8y ago
    That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software. Security vulnerabilities generally aren’t considers latent defects under warranty laws (at least not in NA). I’m not sure what the tech world would look like if it were - for one thing, software teams would probably need a P.Eng. on their teams to ship. For another, using open source software would be even harder to do without an intermediary like Red Hat who would be willing to accept tort liability. At any rate, your software vendor has no legal responsibility to provide you with security updates. Maybe they should. But you’ll pay for that anyways. How do you want to amortize those security updates? By paying the dividend discount price of the updates up front and risk having the product abandoned in a few years (cheating you out of your ‘dividend’), or by paying directly through a subscription? If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more, since they have the functionality of your app hostage if you decide to cancel and the automatic monthly billing has no ties to the quantity or wuality of updates they push out. That makes no sense - you have it completely backwards. Their incentive to provide me with timely security updates is my continued subscription fees. On the other hand, if you pay the dividend discount price for those security updates up front, they have every incentive to stop releasing updates and cheat you out of your update ‘dividend’.

efdee 8y ago

To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords.

chrisweekly 8y ago
> "To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords." Huh. For my part, I'd have trouble trusting a password manager (or browser, or OS) that claimed it _didn't_ need regular updates in order to remain secure.
jonknee 8y ago
Everything on your computer, including the OS itself needs to be regularly updated in order to remain safe... It's not just security, it needs to be updated to continue to run on your devices. New versions of iOS, Android, Windows and Mac OS change things that need to be taken into account. The browser extensions must be kept up to date. There is a lot of work to do just to keep things running without adding any new features.
- efdee 8y ago
  The point was requiring regular updates to stay safe, so yes, security updates. The attack surface of a password manager would be infinitesimally smaller than that of an OS. As far as general updates go, I agree with you, but these shouldn't need to be that frequent. I still have software from the XP era running on my computer.