5 ms·

Yeah, not suggesting feature withholding per se, but a differentiator on why one would buy vs run the OSS build.

by gabereiser 3y ago

staunton 3y ago
What's the difference?
- gabereiser 3y ago
  plugins, hardware, hosting, support, there's a number of ways to offer a service for an open source project. Open Core models come to mind. Another is not having enterprise SSO as part of the core. Or not having clustering. Something that would make a VP think twice about adopting your open source solution vs using you as a vendor.
  - justin_oaks 3y ago
    I know these are examples, so I don't want to pick on you too much, but I have one nitpick: Reserving SSO for enterprise customers is awful. Please don't do it. See https://sso.tax/ https://sso.tax/ for details but I'll quote this from it "SSO is a core security requirement for any company with more than five employees"
    - rhaps0dy 3y ago
      But it should be OK to reserve SSO for paying customers.
    - imiric 3y ago
      If a company requires SSO, they'll surely have a budget for paying for the products and services they use. The majority of OSS users won't have this requirement, and likely won't have the budget to pay for commercial features. So it doesn't make sense to give away a service that has a maintenance cost to everyone, as long as it's fairly priced.
    - gabereiser 3y ago
      If you have more than 5 employees, I’m sending you a sales rep to sell SSO to you.
      - justin_oaks 3y ago
        I see, I see. The world isn't fair. We have 5 employees and we want SSO but don't need SSO. So we'll go without it. It's annoying for us but it allows your business to exist because enterprise needs SSO.
      - mavelikara 3y ago
        I am going to the competitor. I am paying for the software, but I don’t want your “enterprise tier”, which is really designed for 1000+ employee companies. BTW, I did just this this morning. The AE came back to offer the enterprise package for the price of the mid-tier package.
      - Xymist 3y ago
        If I have to go through a sales rep to try or buy your product, I'm going with a competitor. Zero touch is a feature, upsell opportunities are cancer.
    - BoorishBears 3y ago
      As others are pointing out, once you've grown big enough that you can't trust everyone with the keys go the kingdom: enterprise pricing is for you. SSO Tax is a fun meme, but it misses the point: Whether it's 5 people or even 3, you've scaled your business enough to hire people who aren't in the inner circle. That's a fair place to consider you an enterprise.
      - justin_oaks 3y ago
        Not sure what you're talking about. It's not like without SSO everyone in the company has to all use the same password. Services allow people to have separate users with separate privileges.
        BoorishBears 3y ago
        It sounds like you're unaware of why SSO is considered a security feature at all them, but it's covered right on the site: https://sso.tax/ https://sso.tax/ It's to allow centralized access management. Stuff like firing someone and revoking their access from one platform instantly, instead running around and changing permissions in every tool manually. Or ensuring people in department A can't be invited to some platform for people in department B in order to limit information access. SSO tax is predicated on the idea that the moment you outgrow the informal arrangements and liberal access, you're really a business. Seems pretty fair?
        smaudet 3y ago
        > It sounds like you're unaware of why SSO is considered a security feature Technically it's an anti feature... The "feature" you are talking about is really identity management not sign on (which, btw, users have different identites, outside of the scope of a single company). At its core it's just a delete function for a username. Putting that in a script with http access should be enough (and not put behind a ridiculous price tag). Separate services otherwise are enough, no need for SSO.
        3y ago
    - debarshri 3y ago
      Let me give a contrarian argument. I dont think it is awful to have sso reserved only for enterprise customers. I think enterprise customer who are going through compliance will definitely have to but into that tier therefore. If you think you need SSO and but you do not have the budget for upgrading to their enterprise tier, may be you are not the right customer that they are targeting to sell. It is not you, it is them.
      - justin_oaks 3y ago
        You're right. I was thinking from the position of the consumer for which SSO is both convenient and a security feature. I wasn't thinking as the service provider that needs a way to force the folks with the big bucks to pay up. It sucks for the little companies, but it may be necessary for the service to do so.
    - lelanthran 3y ago
      > I know these are examples, so I don't want to pick on you too much, but I have one nitpick: Reserving SSO for enterprise customers is awful. Please don't do it. SSO is expensive, adding maybe $10/user/month if the team adds in a purchased solution (passing the cost directly onto the client). If the customer doesn't want to pay for it because they aren't an enterprise, you can't blame the supplier for not supplying it at a lower price than $10/user/month.
  - caloique 3y ago
    Co-founder of BoxyHQ here - We've crafted an open-source enterprise SSO because we firmly believe that robust security shouldn't be a privilege limited to large organizations. Ideally, essential enterprise-level features like this should become commonplace for all. While we acknowledge the reasons behind SSO being in the enterprise tier, we're all on a collective journey to enhance our security measures. Open Core models are indeed a good option (my preference), yet the dynamics vary across solutions and industries. It's up to each of us to explore, experiment, and discover what resonates with our market. In doing so, we can foster growth while maintaining our commitment to supporting the community in the long run.
    - gabereiser 3y ago
      Well stated. I was merely showing how one could implement an open core strategy. I’m a firm believer in SSO for all (and not limited to social platforms or GitHub).

Yeah, not suggesting feature withholding per se, but a differentiator on why one would buy vs run the OSS build.

staunton 3y ago

What's the difference?

gabereiser 3y ago
plugins, hardware, hosting, support, there's a number of ways to offer a service for an open source project. Open Core models come to mind. Another is not having enterprise SSO as part of the core. Or not having clustering. Something that would make a VP think twice about adopting your open source solution vs using you as a vendor.
- justin_oaks 3y ago
  I know these are examples, so I don't want to pick on you too much, but I have one nitpick: Reserving SSO for enterprise customers is awful. Please don't do it. See https://sso.tax/ https://sso.tax/ for details but I'll quote this from it "SSO is a core security requirement for any company with more than five employees"
  - rhaps0dy 3y ago
    But it should be OK to reserve SSO for paying customers.
  - imiric 3y ago
    If a company requires SSO, they'll surely have a budget for paying for the products and services they use. The majority of OSS users won't have this requirement, and likely won't have the budget to pay for commercial features. So it doesn't make sense to give away a service that has a maintenance cost to everyone, as long as it's fairly priced.
  - gabereiser 3y ago
    If you have more than 5 employees, I’m sending you a sales rep to sell SSO to you.
    - justin_oaks 3y ago
      I see, I see. The world isn't fair. We have 5 employees and we want SSO but don't need SSO. So we'll go without it. It's annoying for us but it allows your business to exist because enterprise needs SSO.
    - mavelikara 3y ago
      I am going to the competitor. I am paying for the software, but I don’t want your “enterprise tier”, which is really designed for 1000+ employee companies. BTW, I did just this this morning. The AE came back to offer the enterprise package for the price of the mid-tier package.
    - Xymist 3y ago
      If I have to go through a sales rep to try or buy your product, I'm going with a competitor. Zero touch is a feature, upsell opportunities are cancer.
  - BoorishBears 3y ago
    As others are pointing out, once you've grown big enough that you can't trust everyone with the keys go the kingdom: enterprise pricing is for you. SSO Tax is a fun meme, but it misses the point: Whether it's 5 people or even 3, you've scaled your business enough to hire people who aren't in the inner circle. That's a fair place to consider you an enterprise.
    - justin_oaks 3y ago
      Not sure what you're talking about. It's not like without SSO everyone in the company has to all use the same password. Services allow people to have separate users with separate privileges.
      - BoorishBears 3y ago
        It sounds like you're unaware of why SSO is considered a security feature at all them, but it's covered right on the site: https://sso.tax/ https://sso.tax/ It's to allow centralized access management. Stuff like firing someone and revoking their access from one platform instantly, instead running around and changing permissions in every tool manually. Or ensuring people in department A can't be invited to some platform for people in department B in order to limit information access. SSO tax is predicated on the idea that the moment you outgrow the informal arrangements and liberal access, you're really a business. Seems pretty fair?
        smaudet 3y ago
        > It sounds like you're unaware of why SSO is considered a security feature Technically it's an anti feature... The "feature" you are talking about is really identity management not sign on (which, btw, users have different identites, outside of the scope of a single company). At its core it's just a delete function for a username. Putting that in a script with http access should be enough (and not put behind a ridiculous price tag). Separate services otherwise are enough, no need for SSO.
        3y ago
  - debarshri 3y ago
    Let me give a contrarian argument. I dont think it is awful to have sso reserved only for enterprise customers. I think enterprise customer who are going through compliance will definitely have to but into that tier therefore. If you think you need SSO and but you do not have the budget for upgrading to their enterprise tier, may be you are not the right customer that they are targeting to sell. It is not you, it is them.
    - justin_oaks 3y ago
      You're right. I was thinking from the position of the consumer for which SSO is both convenient and a security feature. I wasn't thinking as the service provider that needs a way to force the folks with the big bucks to pay up. It sucks for the little companies, but it may be necessary for the service to do so.
  - lelanthran 3y ago
    > I know these are examples, so I don't want to pick on you too much, but I have one nitpick: Reserving SSO for enterprise customers is awful. Please don't do it. SSO is expensive, adding maybe $10/user/month if the team adds in a purchased solution (passing the cost directly onto the client). If the customer doesn't want to pay for it because they aren't an enterprise, you can't blame the supplier for not supplying it at a lower price than $10/user/month.
- caloique 3y ago
  Co-founder of BoxyHQ here - We've crafted an open-source enterprise SSO because we firmly believe that robust security shouldn't be a privilege limited to large organizations. Ideally, essential enterprise-level features like this should become commonplace for all. While we acknowledge the reasons behind SSO being in the enterprise tier, we're all on a collective journey to enhance our security measures. Open Core models are indeed a good option (my preference), yet the dynamics vary across solutions and industries. It's up to each of us to explore, experiment, and discover what resonates with our market. In doing so, we can foster growth while maintaining our commitment to supporting the community in the long run.
  - gabereiser 3y ago
    Well stated. I was merely showing how one could implement an open core strategy. I’m a firm believer in SSO for all (and not limited to social platforms or GitHub).