4 ms·
Why not charge the maintainers themselves to advertise validation by your brand (once you have established that trusted brand)? I mean, I see that you are atta
by lend000 6y ago
Why not charge the maintainers themselves to advertise validation by your brand (once you have established that trusted brand)?
I mean, I see that you are attacking this problem from the analysis and search perspective, which is great and well needed, but there is an intersecting need for security validation and preventing malicious package updates. There is more liability that way, but imo there is greater incentive for enterprise customers and/or maintainers to pay for packages you distribute.
- liorgrossman 6y agoThat's a really interesting thought, we've never thought of this direction! Are there any successful products/companies with such business model (providing testing and certificates for money)
- jacques_chester 6y agoI think the reference examples would be certificate authorities, ratings agencies, Underwriters Laboratories, ISO9000 or SCAMPI inspectors/auditors, organic/kosher/halal/GMO-free food stamp companies etc. Selling quality marks can be quite lucrative, but you'd definitely need to think about exactly what people buy. And definitely think hard about deep insurance.
- liorgrossman 6y agoAwesome, I'm honestly not deeply familiar with most of those industries (let alone maybe credit rating agencies), but this is definitely a model that we need to explore. Thanks!
- lend000 6y agoThe parent comment said it well. This could be a good backup model to work with that could serve as a pivot if it turns out that most developers, like myself, tend to be pretty good at finding a package that fits their needs, but aren't going to read through the entire package to see if it's safe or if it opens connections to some random IP address in the install script.