5 ms·

425% cost increase to enable SSO on Github. Just saying.

by AtNightWeCode 4y ago

deleted 4y ago
[deleted]
sebmellen 4y ago
So ridiculous. Really hurts for smaller startups.
- mbesto 4y ago
  If you're small then the benefits of SSO aren't really there anyway. When you're a team of 10, what benefit is SSO really giving?
  - orphean 4y ago
    I work in a small company and we have to have SSO for compliance reasons (SOC II, HIPAA, NIST, etc) It’s dumb but without it trying to tick all the compliance boxes is much more annoying.
    - AtNightWeCode 4y ago
      You go through a review, and somebody asks who this guy xxx123 is that made this change, and somebody vaguely recalls it is some consultant that for some reason still have access to everything but quit two years ago. Love those meetings.
  - sebmellen 4y ago
    Unfortunately this is not true when you're trying to undergo a SOC 2 audit.
    - mbesto 4y ago
      First, there is no requirement by SOC2 that says you "must use SSO for all applications". SOC2 talks about "logical access controls". For a team of 10, you would simply have a policy that states "any time a new developer comes on, they have to use MFA to access GitHub and this is enforced because we check the box in GH, blah blah" and "any time a developer leaves the company, we revoke all access, blah blah". Also, if you're going to spend $20k+ on SOC2 because your clients require it, then spending the $20k on GitHub shouldn't be a problem because your clients should be paying for it (i.e. your ACV should be high enough to cover these things).
      - sebmellen 4y ago
        Yes, but SSO makes writing those policies (across all apps) much simpler. I think it's too bad that SSO is so heavily taxed, because it's quite an elegant way to solve account provisioning. Interesting site: https://sso.tax/ https://sso.tax/
        mbesto 4y ago
        Understood. > I think it's too bad that SSO is so heavily taxed Honestly, most software (especially SaaS) is underpriced for the value it creates. SSO is just an easy way to bump clients into the "real" pricing of the software while still letting them try most/all of the core features.
spookthesunset 4y ago
The only places that want SSO will be larger enterprises who don’t have a problem paying $$$ for an enterprise package. Tying SSO to enterprise plans is a great way to segment your market!
- AtNightWeCode 4y ago
  Having a central way of managing who has access to a repo is an enterprise feature? I call bullshit on this.

425% cost increase to enable SSO on Github. Just saying.

deleted 4y ago

[deleted]

sebmellen 4y ago

So ridiculous. Really hurts for smaller startups.

mbesto 4y ago
If you're small then the benefits of SSO aren't really there anyway. When you're a team of 10, what benefit is SSO really giving?
- orphean 4y ago
  I work in a small company and we have to have SSO for compliance reasons (SOC II, HIPAA, NIST, etc) It’s dumb but without it trying to tick all the compliance boxes is much more annoying.
  - AtNightWeCode 4y ago
    You go through a review, and somebody asks who this guy xxx123 is that made this change, and somebody vaguely recalls it is some consultant that for some reason still have access to everything but quit two years ago. Love those meetings.
- sebmellen 4y ago
  Unfortunately this is not true when you're trying to undergo a SOC 2 audit.
  - mbesto 4y ago
    First, there is no requirement by SOC2 that says you "must use SSO for all applications". SOC2 talks about "logical access controls". For a team of 10, you would simply have a policy that states "any time a new developer comes on, they have to use MFA to access GitHub and this is enforced because we check the box in GH, blah blah" and "any time a developer leaves the company, we revoke all access, blah blah". Also, if you're going to spend $20k+ on SOC2 because your clients require it, then spending the $20k on GitHub shouldn't be a problem because your clients should be paying for it (i.e. your ACV should be high enough to cover these things).
    - sebmellen 4y ago
      Yes, but SSO makes writing those policies (across all apps) much simpler. I think it's too bad that SSO is so heavily taxed, because it's quite an elegant way to solve account provisioning. Interesting site: https://sso.tax/ https://sso.tax/
      - mbesto 4y ago
        Understood. > I think it's too bad that SSO is so heavily taxed Honestly, most software (especially SaaS) is underpriced for the value it creates. SSO is just an easy way to bump clients into the "real" pricing of the software while still letting them try most/all of the core features.

spookthesunset 4y ago

The only places that want SSO will be larger enterprises who don’t have a problem paying $$$ for an enterprise package. Tying SSO to enterprise plans is a great way to segment your market!

AtNightWeCode 4y ago
Having a central way of managing who has access to a repo is an enterprise feature? I call bullshit on this.