6 ms·

> a thread about someone asking about password management solutions for an organization of 10k employees, and someone recommended 1Password, which I already fin

by mbesto 4y ago

> a thread about someone asking about password management solutions for an organization of 10k employees, and someone recommended 1Password, which I already find hard to believe it could ever make financial and operational sense. Ha, these costs are a DROP in the bucket for businesses at 10k employees. > "can't we just hire someone else do that in-house, part-time? It would cost as much or less, but at least we would have a lot more control over the system and we wouldn't be at the mercy of a company that treats us as cattle." Good luck with this. You're missing things like: - Maintaining the software (upgrades, etc.) - Maintaining the hardware (you buying bare metal? cloud? who's upgrading servers? etc.) - Hiring/firing costs - Do developers want to work with a system that isn't GitHub and be productive? - etc. etc.

atonse 4y ago
Yeah it’s odd to read this. Even $20 a month is not worth wasting time over. It is a margin of error compared to the salary of that user. 1Password for 10k users? What would that be, 80k/month? There are probably pretty big volume discounts too. Payroll for 10k people is like $30m-70m.
- rglullis 4y ago
  This kind of logic I would expect only from a bean-counter, and a bad one to be honest... Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? Not just that... if I'm working at the IT department of this company (surely they have one) and hear about such deal, I'll have three thoughts: 1. Can I do it myself? Give me a raise and I'll take the extra responsibility. Everyone wins. 2. If they are throwing this much money out of the window, I'll go knock on my managers door and ask for a raise. 3. If they say they can't give me a raise for any bullshit reason, I'll immediately lose trust in upper management and I'll start looking for a job the next minute.
  - mbesto 4y ago
    > This kind of logic I would expect only from a bean-counter, and a bad one to be honest And your logic is so out of touch with reality that I don't know whether you're trolling or not.
  - smeyer 4y ago
    >This kind of logic I would expect only from a bean-counter I think you're not doing a very good job of updating your expectations based on what other folks are saying. Across multiple threads you have a whole variety of folks trying to explain their reasoning, and you're dismissing them all out of hand. You don't seem to be giving much consideration to the idea that you could be wrong in at least some reasonable organizations (rather than all the folks you're replying to).
  - phphphphp 4y ago
    And that’s the sort of thing I’d expect from a programmer! The operational complexity of anything operating at scale extends far beyond the immediate cost. For example, play your scenario out: they give you a raise, you start managing something, and then you decide to leave? Then what? Or, you turn out to be incompetent and make a mistake that takes 24 hours to fix: that’s thousands of people unable to work! That’s going to cost the business a lot more than 80k. Ownership is a burden, ownership at scale is a nightmare. Paying a third-party to own something for you is fantastic value in the default case, until you have a strong business case for taking on that ownership burden. “One of our nerds says he’ll own it for 50% of the cost” is a terrible option, it’s nightmare waiting to happen. If I had 10k people, and I could pay $50k to offload ownership of some critical infrastructure to a third party, I wouldn’t even blink. That’s great value.
    - rglullis 4y ago
      > sort of thing I’d expect from a programmer! Well, this is still called Hacker News. Am I in the wrong place? Anyway... you've created many strawmen here, where should I start? > you decide to leave? Then what? My "hiring" for it would imply defining a proper budget for it and a set of conditions negotiated a priori. It's not really "I will just do the job myself", I'm talking about "ok, you are willing to pay $80k/month to have this solved. Here are the 5 other different plans and solutions that we can implement and that will cost less than that, which one gets the go-ahead from upper management?" > make a mistake that takes 24 hours to fix: that’s thousands of people unable to work It's still coming out ahead of Github that took 11 days to solve? Also, what is that joke about HackerNews overloading with traffic whenever there is a github outage? Or that one of how half of the internet GDP being tied to AWS? Seriously though, the answer would be "you don't migrate everyone at once". You'd start with these migrations on a project-by-project basis, starting with the less critical projects on the new system and slowly weaning off on your dependency of the big vendor. Bonus: by migrating your systems you will have some kind of redundancy. If GH goes down, the teams could use the opportunity to move to the new system. It it works, the teams gain confidence and can accelerate the migration. It it doesn't, it becomes an opportunity to learn something out of a sunk cost. > If I had 10k people, and I could pay $50k to offload ownership of some critical infrastructure to a third party Paying $50k is not giving you any guarantee that your business is robust. You are just paying for CYA.
  - leipert 4y ago
    > Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? Depends on the structure of your org. Is the 0.5 FTE being able to maintain addons for all the browsers, dealing with on and off boarding, multiple apps for multiple platforms, write end-user documentation at the same level as 1Password does?
    - rglullis 4y ago
      Pay $80k/month to 1Password for an year, one year later you (and all 1Password customers) are still dependent on them. Contribute $800/month to the vaultwarden developers, one year later you (with the help from all the other companies that understand the benefits of open source) will end up with a FOSS product that can be as good or better than 1Password: https://news.ycombinator.com/item?id=31582369 https://news.ycombinator.com/item?id=31582369
  - nemothekid 4y ago
    >Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? I'm not sure who's the bean counter here. Maintaining a service, with the same availability as Github, is 3 FTE minimum, unless you are expecting your 0.5 FTE to also be on call. "I can hire an intern to replace $X" seems like the bean counter attitude. Do you have an SLA? Can management claw your raise back when your bespoke system has more than a day of downtime? If you go on vacation and the system goes down, can management expect you in the office on the next day? Remember they are paying you an $80k/yr "bonus" for three nines of availability. Or are you just going to tell the other 10k employees "hey it won't go down while I'm in Tahoe, just trust me."
    - rglullis 4y ago
      > Maintaining a service, with the same availability as Github, is 3 FTE minimum. Keeping Github is a complex issue, because they are trying to offer the same service to millions of people. It is a totally different beast than having to manage a service to thousands of people. Github needs multiple datacenters in multiple regions. A company self-hosting needs one server and can handle thousands of users. A lot less complexity, a lot less moving parts. > when your bespoke system has more than a day of downtime? What is "bespoke" about Gitea? Or Gitlab if you want an all-stop-shop solution? They can also do all the enterprisey things that one expects from Github. Even if some catastrophe hits the server, your downtime will be measured by the time that it takes to provision a new server (hopefully automated), run some (hopefully automated) install scripts and restore the backup. All this work is a one-time cost, and any decent sysadmin should be able to handle it in minutes.
      - atonse 4y ago
        Here's a bean counter comment: Your self hosted site goes down. What's the cost per hour of my 10,000 users not being able to use it? The same as the cost per hour of GitHub going down, I agree, but GitHub will have 20 people working on fixing it. We'll just have to wait for you? What do I tell my 10k users? How about security? Are you going to manage the provisioning of those users, the access control? How about audits? How about scaling? Your magical .5 FTE will do all this on top of your daily duties? The calculus is never "just give me a raise" – it's not paying 1Password 80k vs paying some IT person that much. It's just that that money supports a core function for 10k people. A former-boss once told me when he became a CTO of a very large company – he said, "at our scale, most of our conversations revolve around risk rather than cost. we even start to wonder, will this vendor be able to cope with our level of demands? what if they go out of business? what if they want to quit? what is the cost to our organization in time and money to have to switch to a different vendor/product/etc?" Who knows, a company of that size might save half that money in cybersecurity insurance premiums just by adopting 1Password. (guessing here...) It's just way more complex than you think.
  - cure 4y ago
    > This kind of logic I would expect only from a bean-counter, and a bad one to be honest... Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? I think you're underestimating what it would take to solve the problem (even one as "simple" as this one). But, let's assume there is an off the shelf open source solution that is perfect for your environment and requires no changes and integrates easily in your corporate processes without any work (this is already very unrealistic...). Then, you need to run it and provide 24/7 uptime for your 10k users, which are presumably spread across multiple timezones. Your 0.5 FTE is going to be on call 24/7? Good luck filling that position. Finally, how are you going to support the 10k users? Is that 0.5 FTE going to answer all the support requests? I'm not saying it's bad to do things in house - and there are really good reasons to do so. You just have to be realistic. It's going to take a whole lot more than 0.5 FTE to run even a "simple" service like this with the kind of reliability and support your 10k users will demand. Suddenly that $80k/mo to make it someone else's problem doesn't sound so bad :)
    - rglullis 4y ago
      https://news.ycombinator.com/item?id=31659298 https://news.ycombinator.com/item?id=31659298
    - phreack 4y ago
      > Finally, how are you going to support the 10k users? Is that 0.5 FTE going to answer all the support requests? I know I'm cherry picking but the outsourced solution is taking 11 days to say "try again" so maybe whatever that employee takes is an improvement, heh
rglullis 4y ago
> Ha, these costs are a DROP in the bucket for businesses at 10k employees First, it's not just the cost. It's the fact that a company of 10k employees do not need to be at the mercy of a third-party vendor. And if the company is going to go with the line of "we want to outsource everything that is not core to the business", then they should be asking themselves what is their "core" business that warrants 10k employees in the first place. Second, if it's just the occasional SaaS that they need and they can't find or train people to do it, I'd understand it. The problem is when you look at the typical early-stage startup who raises $500k for a seed stage round and they think it is normal/expected to burn $10k/month on Github/Jira/CI/Contentful/Dropbox/Figma/etc/etc/etc, when there are alternatives that could work and people don't even try them. > You're missing things like: No, I am not. Check the comment that I referenced. I suggested a scenario where you can hire someone to implement the solution and have an ongoing support contract for a fraction of the cost from 1Password. > Do developers want to work with a system that isn't GitHub and be productive? Have they even tried? Surely any Engineering Manager worth anything should be able to at least back up their choices based on more than "we are using this because this is what everyone else is using"?
- mbesto 4y ago
  > It's the fact that a company of 10k employees do not need to be at the mercy of a third-party vendor. Oh man, where do I even start here. Have you ever worked in a company with 10k employees? In IT at a company with 10k employees? > Github/Jira/CI/Contentful/Dropbox/Figma/etc/etc/etc, when there are alternatives that could work and people don't even try them. So let me get this straight. You expect every organization with 10k employees to: - Find talent to build, operate, and maintain on said systems - Keep that talent - Train employees on said systems. Cheryl in accounting has only used SAP and you want her to understand how to use XYZ? - Spend the time NOT having the solution available to them while they wait for said system to be built/implemented. - And and and... > No, I am not. Check the comment that I referenced. I suggested a scenario where you can hire someone to implement the solution and have an ongoing support contract for a fraction of the cost from 1Password. You absolutely are. You clearly have no understanding when it comes to what is required to "just hire someone to do it". > Surely any Engineering Manager worth anything Yaaa, no true scotsmen! The trope of "just hire someone" needs to die. Orgs (of all sizes) regularly do buy vs build analysis all of the time. Saying that one is better than the other unilaterally is just plain wrong.

by mbesto 4y ago

atonse 4y ago

Yeah it’s odd to read this. Even $20 a month is not worth wasting time over. It is a margin of error compared to the salary of that user. 1Password for 10k users? What would that be, 80k/month? There are probably pretty big volume discounts too. Payroll for 10k people is like $30m-70m.

rglullis 4y ago
This kind of logic I would expect only from a bean-counter, and a bad one to be honest... Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? Not just that... if I'm working at the IT department of this company (surely they have one) and hear about such deal, I'll have three thoughts: 1. Can I do it myself? Give me a raise and I'll take the extra responsibility. Everyone wins. 2. If they are throwing this much money out of the window, I'll go knock on my managers door and ask for a raise. 3. If they say they can't give me a raise for any bullshit reason, I'll immediately lose trust in upper management and I'll start looking for a job the next minute.
- mbesto 4y ago
  > This kind of logic I would expect only from a bean-counter, and a bad one to be honest And your logic is so out of touch with reality that I don't know whether you're trolling or not.
- smeyer 4y ago
  >This kind of logic I would expect only from a bean-counter I think you're not doing a very good job of updating your expectations based on what other folks are saying. Across multiple threads you have a whole variety of folks trying to explain their reasoning, and you're dismissing them all out of hand. You don't seem to be giving much consideration to the idea that you could be wrong in at least some reasonable organizations (rather than all the folks you're replying to).
- phphphphp 4y ago
  And that’s the sort of thing I’d expect from a programmer! The operational complexity of anything operating at scale extends far beyond the immediate cost. For example, play your scenario out: they give you a raise, you start managing something, and then you decide to leave? Then what? Or, you turn out to be incompetent and make a mistake that takes 24 hours to fix: that’s thousands of people unable to work! That’s going to cost the business a lot more than 80k. Ownership is a burden, ownership at scale is a nightmare. Paying a third-party to own something for you is fantastic value in the default case, until you have a strong business case for taking on that ownership burden. “One of our nerds says he’ll own it for 50% of the cost” is a terrible option, it’s nightmare waiting to happen. If I had 10k people, and I could pay $50k to offload ownership of some critical infrastructure to a third party, I wouldn’t even blink. That’s great value.
  - rglullis 4y ago
    > sort of thing I’d expect from a programmer! Well, this is still called Hacker News. Am I in the wrong place? Anyway... you've created many strawmen here, where should I start? > you decide to leave? Then what? My "hiring" for it would imply defining a proper budget for it and a set of conditions negotiated a priori. It's not really "I will just do the job myself", I'm talking about "ok, you are willing to pay $80k/month to have this solved. Here are the 5 other different plans and solutions that we can implement and that will cost less than that, which one gets the go-ahead from upper management?" > make a mistake that takes 24 hours to fix: that’s thousands of people unable to work It's still coming out ahead of Github that took 11 days to solve? Also, what is that joke about HackerNews overloading with traffic whenever there is a github outage? Or that one of how half of the internet GDP being tied to AWS? Seriously though, the answer would be "you don't migrate everyone at once". You'd start with these migrations on a project-by-project basis, starting with the less critical projects on the new system and slowly weaning off on your dependency of the big vendor. Bonus: by migrating your systems you will have some kind of redundancy. If GH goes down, the teams could use the opportunity to move to the new system. It it works, the teams gain confidence and can accelerate the migration. It it doesn't, it becomes an opportunity to learn something out of a sunk cost. > If I had 10k people, and I could pay $50k to offload ownership of some critical infrastructure to a third party Paying $50k is not giving you any guarantee that your business is robust. You are just paying for CYA.
- leipert 4y ago
  > Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? Depends on the structure of your org. Is the 0.5 FTE being able to maintain addons for all the browsers, dealing with on and off boarding, multiple apps for multiple platforms, write end-user documentation at the same level as 1Password does?
  - rglullis 4y ago
    Pay $80k/month to 1Password for an year, one year later you (and all 1Password customers) are still dependent on them. Contribute $800/month to the vaultwarden developers, one year later you (with the help from all the other companies that understand the benefits of open source) will end up with a FOSS product that can be as good or better than 1Password: https://news.ycombinator.com/item?id=31582369 https://news.ycombinator.com/item?id=31582369
- nemothekid 4y ago
  >Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? I'm not sure who's the bean counter here. Maintaining a service, with the same availability as Github, is 3 FTE minimum, unless you are expecting your 0.5 FTE to also be on call. "I can hire an intern to replace $X" seems like the bean counter attitude. Do you have an SLA? Can management claw your raise back when your bespoke system has more than a day of downtime? If you go on vacation and the system goes down, can management expect you in the office on the next day? Remember they are paying you an $80k/yr "bonus" for three nines of availability. Or are you just going to tell the other 10k employees "hey it won't go down while I'm in Tahoe, just trust me."
  - rglullis 4y ago
    > Maintaining a service, with the same availability as Github, is 3 FTE minimum. Keeping Github is a complex issue, because they are trying to offer the same service to millions of people. It is a totally different beast than having to manage a service to thousands of people. Github needs multiple datacenters in multiple regions. A company self-hosting needs one server and can handle thousands of users. A lot less complexity, a lot less moving parts. > when your bespoke system has more than a day of downtime? What is "bespoke" about Gitea? Or Gitlab if you want an all-stop-shop solution? They can also do all the enterprisey things that one expects from Github. Even if some catastrophe hits the server, your downtime will be measured by the time that it takes to provision a new server (hopefully automated), run some (hopefully automated) install scripts and restore the backup. All this work is a one-time cost, and any decent sysadmin should be able to handle it in minutes.
    - atonse 4y ago
      Here's a bean counter comment: Your self hosted site goes down. What's the cost per hour of my 10,000 users not being able to use it? The same as the cost per hour of GitHub going down, I agree, but GitHub will have 20 people working on fixing it. We'll just have to wait for you? What do I tell my 10k users? How about security? Are you going to manage the provisioning of those users, the access control? How about audits? How about scaling? Your magical .5 FTE will do all this on top of your daily duties? The calculus is never "just give me a raise" – it's not paying 1Password 80k vs paying some IT person that much. It's just that that money supports a core function for 10k people. A former-boss once told me when he became a CTO of a very large company – he said, "at our scale, most of our conversations revolve around risk rather than cost. we even start to wonder, will this vendor be able to cope with our level of demands? what if they go out of business? what if they want to quit? what is the cost to our organization in time and money to have to switch to a different vendor/product/etc?" Who knows, a company of that size might save half that money in cybersecurity insurance premiums just by adopting 1Password. (guessing here...) It's just way more complex than you think.
- cure 4y ago
  > This kind of logic I would expect only from a bean-counter, and a bad one to be honest... Why would anyone pay $80k/month to solve a problem that could be solved with 0.5 FTE? I think you're underestimating what it would take to solve the problem (even one as "simple" as this one). But, let's assume there is an off the shelf open source solution that is perfect for your environment and requires no changes and integrates easily in your corporate processes without any work (this is already very unrealistic...). Then, you need to run it and provide 24/7 uptime for your 10k users, which are presumably spread across multiple timezones. Your 0.5 FTE is going to be on call 24/7? Good luck filling that position. Finally, how are you going to support the 10k users? Is that 0.5 FTE going to answer all the support requests? I'm not saying it's bad to do things in house - and there are really good reasons to do so. You just have to be realistic. It's going to take a whole lot more than 0.5 FTE to run even a "simple" service like this with the kind of reliability and support your 10k users will demand. Suddenly that $80k/mo to make it someone else's problem doesn't sound so bad :)
  - rglullis 4y ago
    https://news.ycombinator.com/item?id=31659298 https://news.ycombinator.com/item?id=31659298
  - phreack 4y ago
    > Finally, how are you going to support the 10k users? Is that 0.5 FTE going to answer all the support requests? I know I'm cherry picking but the outsourced solution is taking 11 days to say "try again" so maybe whatever that employee takes is an improvement, heh

rglullis 4y ago

> Ha, these costs are a DROP in the bucket for businesses at 10k employees First, it's not just the cost. It's the fact that a company of 10k employees do not need to be at the mercy of a third-party vendor. And if the company is going to go with the line of "we want to outsource everything that is not core to the business", then they should be asking themselves what is their "core" business that warrants 10k employees in the first place. Second, if it's just the occasional SaaS that they need and they can't find or train people to do it, I'd understand it. The problem is when you look at the typical early-stage startup who raises $500k for a seed stage round and they think it is normal/expected to burn $10k/month on Github/Jira/CI/Contentful/Dropbox/Figma/etc/etc/etc, when there are alternatives that could work and people don't even try them. > You're missing things like: No, I am not. Check the comment that I referenced. I suggested a scenario where you can hire someone to implement the solution and have an ongoing support contract for a fraction of the cost from 1Password. > Do developers want to work with a system that isn't GitHub and be productive? Have they even tried? Surely any Engineering Manager worth anything should be able to at least back up their choices based on more than "we are using this because this is what everyone else is using"?

mbesto 4y ago
> It's the fact that a company of 10k employees do not need to be at the mercy of a third-party vendor. Oh man, where do I even start here. Have you ever worked in a company with 10k employees? In IT at a company with 10k employees? > Github/Jira/CI/Contentful/Dropbox/Figma/etc/etc/etc, when there are alternatives that could work and people don't even try them. So let me get this straight. You expect every organization with 10k employees to: - Find talent to build, operate, and maintain on said systems - Keep that talent - Train employees on said systems. Cheryl in accounting has only used SAP and you want her to understand how to use XYZ? - Spend the time NOT having the solution available to them while they wait for said system to be built/implemented. - And and and... > No, I am not. Check the comment that I referenced. I suggested a scenario where you can hire someone to implement the solution and have an ongoing support contract for a fraction of the cost from 1Password. You absolutely are. You clearly have no understanding when it comes to what is required to "just hire someone to do it". > Surely any Engineering Manager worth anything Yaaa, no true scotsmen! The trope of "just hire someone" needs to die. Orgs (of all sizes) regularly do buy vs build analysis all of the time. Saying that one is better than the other unilaterally is just plain wrong.