4 ms·

as soon as you want to enable users to self-host, esp on-prem/airgapped, any internet dependencies, unscannable code, etc, will fail basic env and security reqs

as soon as you want to enable users to self-host, esp on-prem/airgapped, any internet dependencies, unscannable code, etc, will fail basic env and security reqs. In general, also loses control, which is a risk, and for technically unnecessary reasons, elevating that to radioactive. provide both oss and paid hosting, and becomes fine.

mooreds 6y ago
> as soon as you want to enable users to self-host, esp on-prem/airgapped, any internet dependencies, unscannable code, etc, will fail basic env and security reqs. Hmmm. My employer has people who have used our commercial, closed source, self hosted auth software and obtained PCI compliance. I'm not a security expert, but my understanding is that is a relatively rigorous security process. Am I incorrect? > provide both oss and paid hosting How do you deal with the "Amazon/GCP/Azure takes the OSS software and cross sells it to their customer base" problem? This is something I've been thinking about for years and years. Not that this is your problem to solve :) and I get that as a customer of a software business one typically doesn't care, but thought I'd ask. One answer I've heard is "be better at running your software than AWS" which makes sense, but doesn't address cross selling. AWS doesn't have to be the best at running ElasticSearch, they just have to be good enough because they own a major distribution and payment channel. Another answer I've heard is "you should be so lucky as to have a public cloud pick up your OSS project" which I totally understand (obscurity is a bigger competitor than the public could for most projects). But it doesn't address the very real threat to the business which may arrive just when the project can start to throw off profits to pay back the initial investment. Again, I realize there's nuance here and that if a company takes the contributions of the community that can accelerate their growth and feature set. But I'm just curious on your take on the public cloud provider angle.
- lmeyerov 6y ago
  self-hosting solves the saas dependency part, which is great! saas should be a value add, not a req. Proprietary & closed source means risk sign-offs and having to work w an extra party for sign-offs, so unattractive. I'm not sure an auth dependency merits that. (And nowadays, a negative signal for security...) re:business model... I don't know VC-scale ($1-10B/yr), but not every infra project has to immediately turn into a 10K employee company. That's someone putting their global domination ambition over their users, so a sniff test for me on a co's management. Maybe there is a way to do it, and imo, a $50M/yr co here is totally doable, a fine achievement, and can be used to figure out Product 2. As an infra user, esp with our own users having us make high-trust decisions for things they don't really understand, I prefer adding dependencies to projects I don't think will do a quick flip / flameout / sell me out / etc.
  - mooreds 6y ago
    Thanks, definitely appreciate the perspective and thoughtful answers. I don't think that worries about a cloud provider eating the lunch a company has set (to get metaphorical on you) is solely limited to VC funded companies, but I do appreciate they're more likely to worry (see ElasticSearch, of course). > but not every infra project has to immediately turn into a 10K employee company. Couldn't agree more! Cheers!
    - lmeyerov 6y ago
      Also, I'm not sure I buy the concern about aws & friends in this space for a few reasons: -- Now that SaaS for identity is established, the natural next step is OSS versions that come with SaaS, so if you're starting fresh and know that's coming... it seems short-sighted to start without that -- aws & friends have their own identity products, so given the already-commoditized market, they're unlikely to want to be pushing your n+1 one OSS seems more like a growth driver here than a risk b/c of the competitive market, though I can see that being unsettling to traditional business/VC types who are out of touch with the market. What the value-add for a managed layer is seems like "a lot possible", e.g., scale, support, multi-cloud, so I'd expect customers to pull you pretty quick if they didn't already. In our case, quite explicitly, we're evaluating a path where on-prem single-tenant users can bundle & self-serve something (SSO/LDAP/...), while for our saas tier, we can hook into something normal by aws/azure/someone else. Lack of full-featured OSS (w/ no SaaS necessary) for on-prem, or at least a clear way to let us transparently swap something like Keycloak for those folks, is an instant no.
      - mooreds 6y ago
        Good points about AWS, though I will say that AWS has multiple different document databases and caching engines, so if there was customer demand, I don't doubt that they would run a different identity service. I have not used it, but from what I've seen, Cognito doesn't seem to get much love. > OSS seems more like a growth driver here than a risk b/c of the competitive market, though I can see that being unsettling to traditional business/VC types who are out of touch with the market. I hope you weren't talking about me :) . We'll see, I certainly some funded auth startups going the open core/OSS route (SuperTokens, Clerky, WorkOS). > In our case, quite explicitly, we're evaluating a path where on-prem single-tenant users can bundle & self-serve something (SSO/LDAP/...), while for our saas tier, we can hook into something normal by aws/azure/someone else. Lack of full-featured OSS (w/ no SaaS necessary) for on-prem, or at least a clear way to let us transparently swap something like Keycloak for those folks, is an instant no. Yeah, we have a number of clients who use us just like this (both SaaS and on-prem, often as an identity broker) and are willing to pay our license fees for the support, the documentation and the functionality. I've also reached out to people who seemed like a fit and they had a hard requirement for OSS. Different strokes for different folks.

mooreds 6y ago

> as soon as you want to enable users to self-host, esp on-prem/airgapped, any internet dependencies, unscannable code, etc, will fail basic env and security reqs. Hmmm. My employer has people who have used our commercial, closed source, self hosted auth software and obtained PCI compliance. I'm not a security expert, but my understanding is that is a relatively rigorous security process. Am I incorrect? > provide both oss and paid hosting How do you deal with the "Amazon/GCP/Azure takes the OSS software and cross sells it to their customer base" problem? This is something I've been thinking about for years and years. Not that this is your problem to solve :) and I get that as a customer of a software business one typically doesn't care, but thought I'd ask. One answer I've heard is "be better at running your software than AWS" which makes sense, but doesn't address cross selling. AWS doesn't have to be the best at running ElasticSearch, they just have to be good enough because they own a major distribution and payment channel. Another answer I've heard is "you should be so lucky as to have a public cloud pick up your OSS project" which I totally understand (obscurity is a bigger competitor than the public could for most projects). But it doesn't address the very real threat to the business which may arrive just when the project can start to throw off profits to pay back the initial investment. Again, I realize there's nuance here and that if a company takes the contributions of the community that can accelerate their growth and feature set. But I'm just curious on your take on the public cloud provider angle.

lmeyerov 6y ago
self-hosting solves the saas dependency part, which is great! saas should be a value add, not a req. Proprietary & closed source means risk sign-offs and having to work w an extra party for sign-offs, so unattractive. I'm not sure an auth dependency merits that. (And nowadays, a negative signal for security...) re:business model... I don't know VC-scale ($1-10B/yr), but not every infra project has to immediately turn into a 10K employee company. That's someone putting their global domination ambition over their users, so a sniff test for me on a co's management. Maybe there is a way to do it, and imo, a $50M/yr co here is totally doable, a fine achievement, and can be used to figure out Product 2. As an infra user, esp with our own users having us make high-trust decisions for things they don't really understand, I prefer adding dependencies to projects I don't think will do a quick flip / flameout / sell me out / etc.
- mooreds 6y ago
  Thanks, definitely appreciate the perspective and thoughtful answers. I don't think that worries about a cloud provider eating the lunch a company has set (to get metaphorical on you) is solely limited to VC funded companies, but I do appreciate they're more likely to worry (see ElasticSearch, of course). > but not every infra project has to immediately turn into a 10K employee company. Couldn't agree more! Cheers!
  - lmeyerov 6y ago
    Also, I'm not sure I buy the concern about aws & friends in this space for a few reasons: -- Now that SaaS for identity is established, the natural next step is OSS versions that come with SaaS, so if you're starting fresh and know that's coming... it seems short-sighted to start without that -- aws & friends have their own identity products, so given the already-commoditized market, they're unlikely to want to be pushing your n+1 one OSS seems more like a growth driver here than a risk b/c of the competitive market, though I can see that being unsettling to traditional business/VC types who are out of touch with the market. What the value-add for a managed layer is seems like "a lot possible", e.g., scale, support, multi-cloud, so I'd expect customers to pull you pretty quick if they didn't already. In our case, quite explicitly, we're evaluating a path where on-prem single-tenant users can bundle & self-serve something (SSO/LDAP/...), while for our saas tier, we can hook into something normal by aws/azure/someone else. Lack of full-featured OSS (w/ no SaaS necessary) for on-prem, or at least a clear way to let us transparently swap something like Keycloak for those folks, is an instant no.
    - mooreds 6y ago
      Good points about AWS, though I will say that AWS has multiple different document databases and caching engines, so if there was customer demand, I don't doubt that they would run a different identity service. I have not used it, but from what I've seen, Cognito doesn't seem to get much love. > OSS seems more like a growth driver here than a risk b/c of the competitive market, though I can see that being unsettling to traditional business/VC types who are out of touch with the market. I hope you weren't talking about me :) . We'll see, I certainly some funded auth startups going the open core/OSS route (SuperTokens, Clerky, WorkOS). > In our case, quite explicitly, we're evaluating a path where on-prem single-tenant users can bundle & self-serve something (SSO/LDAP/...), while for our saas tier, we can hook into something normal by aws/azure/someone else. Lack of full-featured OSS (w/ no SaaS necessary) for on-prem, or at least a clear way to let us transparently swap something like Keycloak for those folks, is an instant no. Yeah, we have a number of clients who use us just like this (both SaaS and on-prem, often as an identity broker) and are willing to pay our license fees for the support, the documentation and the functionality. I've also reached out to people who seemed like a fit and they had a hard requirement for OSS. Different strokes for different folks.