3 ms·

Genuinely curious, how do you plan to compete with Ory and Zitadel in this space without being open source?

mooreds 3y ago
Great question. Appreciate the interest. I can only speak from my perspective as an employee, not the whole company. It is something I've thought about. I will also ask the CEO/founder or other leaders to weigh in. Many devs care about open source when they are evaluating a solution, but many really want "free as in beer". They want to try a product without getting out the credit card or engaging with sales. We cater to the latter category, which wants to understand the product quality without talking to any sales people. Some of these folks use our community product for their production needs, which is perfectly fine. We have people running FusionAuth in production with 1000s of tenants or 10000+ applications. (I always say they "pay" us by filing bug reports, giving feedback and voting on feature requests.) But some decide they want to pay us for hosting, support or advanced features. Those choices help us build a business. Devs, and especially buyers, are interested in sustainability of a product they are going to integrate into their system. An auth provider isn't a javascript widget that you can easily drop in or remove from your system. It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. You want to be sure the company and product is going to stick around. (If you want to make sure you can run the product even if everyone at FusionAuth wins the lottery, we do offer source code escrow for a price, but haven't had anyone take us up on it.) FusionAuth is a profitable company (we did recently raise a round to accelerate growth, you can read more about that here [0]). Open source companies often have a hard time meeting the profit goals of the market or investors. This is a known issue and often results in relicensing or changing the rules, as we've seen with Hashicorp[1] and Elastic[2]. This switcheroo can cause issues, confusion, and ill-will; FusionAuth's licensing avoids that. FusionAuth also develops in the open[3]. This open development process gives us another common benefit people get from OSS--community feedback. Also, I don't want to throw shade at Ory and Zitadel, since I have no idea about their finances (apart from a brief look at Crunchbase, which shows they've raised 22.5M[4] and 2.5M[5] respectively). I hope they're building sustainable businesses, but selling closed source software is a sure route to a profitable business that has built many big companies (including in the auth space, such as Okta or Auth0). Again, this is not FUD (or at least I don't intend it to be!), just an honest assessment at the difficulties of making money in open source dev tools [6]. We also compete on features, support and documentation. Again, I can't speak to Ory or Zitadel; they look nice, but I haven't built anything with them, so it is hard for me to know how good they are. I do know that we have had many clients appreciate of those aspects of our product. To sum up: * FusionAuth has a free option, which helps reduce friction and gives some of the benefits of OSS. The open process and escrow also give some of the benefits of OSS. * Some devs and buyers care about business sustainability, especially when integrating a tool deeply into their application. FusionAuth will never have to worry about relicensing a version because AWS is eating our SaaS revenue stream, for example. * We offer great support, documentation and intricate auth features at a reasonable price. Hope this helps. 0: https://fusionauth.io/blog/fusionauth-and-updata https://fusionauth.io/blog/fusionauth-and-updata 1: https://www.hashicorp.com/license-faq https://www.hashicorp.com/license-faq 2: https://www.elastic.co/pricing/faq/licensing https://www.elastic.co/pricing/faq/licensing 3: https://github.com/FusionAuth/fusionauth-issues/issues/ https://github.com/FusionAuth/fusionauth-issues/issues/ 4: https://www.crunchbase.com/organization/ory/company_overview/overview_timeline https://www.crunchbase.com/organization/ory/company_overview... 5: https://www.crunchbase.com/organization/zitadel https://www.crunchbase.com/organization/zitadel 6: I wrote about this a few years ago on my personal blog: https://www.mooreds.com/wordpress/archives/3438 https://www.mooreds.com/wordpress/archives/3438
- apitman 3y ago
  Thanks for the detailed answer. If people are already taking advantage of your free offering, how would it be different if you released the source? If you're worried about another company piggybacking off your work to start a competitor, why not use one of these newfangled non-compete licenses? That still gives users the security of being able to for the project internally if you go under.
  - mooreds 3y ago
    The free version of FusionAuth has limits beyond what other licenses have. See https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 for more details. I'm afraid that's all the detail I have about the decision to keep FusionAuth closed source.
    - mooreds 3y ago
      Sorry, on re-read, this sounds kinda abrupt. My bad. I think at the end this is a business decision. The executive team has considered options and decided that closed source is the right path for the company.
      - apitman 3y ago
        No worries. Didn't seem abrupt.
- deleted 3y ago
  [deleted]
- ensignavenger 3y ago
  >> It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. This is precisely why a real, Open Source solution should be a top priority feature for anyone evaluating software like this. We have seen closed source solutions, time and time again, "realign" their business by dropping features, or even entire, free plans. In some cases, closed source software has been removed from the market all together when the company gets bought out. Changes in pricing plans leads to a worse fit for customers... etc. At least when Hashicorp and Elastic abandoned Open Source, the community had the option to say "yeah, good luck, thanks for the good times, but no thanks on your new direction" and fork the product to continue maintaining it. When a closed source products owners decide to "shift gears" on the product line up, customers are left between a rock and a hard place. Maybe if there were no Open Source options, but fortunately, there are several in the auth space.

Great question. Appreciate the interest. I can only speak from my perspective as an employee, not the whole company. It is something I've thought about. I will also ask the CEO/founder or other leaders to weigh in. Many devs care about open source when they are evaluating a solution, but many really want "free as in beer". They want to try a product without getting out the credit card or engaging with sales. We cater to the latter category, which wants to understand the product quality without talking to any sales people. Some of these folks use our community product for their production needs, which is perfectly fine. We have people running FusionAuth in production with 1000s of tenants or 10000+ applications. (I always say they "pay" us by filing bug reports, giving feedback and voting on feature requests.) But some decide they want to pay us for hosting, support or advanced features. Those choices help us build a business. Devs, and especially buyers, are interested in sustainability of a product they are going to integrate into their system. An auth provider isn't a javascript widget that you can easily drop in or remove from your system. It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. You want to be sure the company and product is going to stick around. (If you want to make sure you can run the product even if everyone at FusionAuth wins the lottery, we do offer source code escrow for a price, but haven't had anyone take us up on it.) FusionAuth is a profitable company (we did recently raise a round to accelerate growth, you can read more about that here [0]). Open source companies often have a hard time meeting the profit goals of the market or investors. This is a known issue and often results in relicensing or changing the rules, as we've seen with Hashicorp[1] and Elastic[2]. This switcheroo can cause issues, confusion, and ill-will; FusionAuth's licensing avoids that. FusionAuth also develops in the open[3]. This open development process gives us another common benefit people get from OSS--community feedback. Also, I don't want to throw shade at Ory and Zitadel, since I have no idea about their finances (apart from a brief look at Crunchbase, which shows they've raised 22.5M[4] and 2.5M[5] respectively). I hope they're building sustainable businesses, but selling closed source software is a sure route to a profitable business that has built many big companies (including in the auth space, such as Okta or Auth0). Again, this is not FUD (or at least I don't intend it to be!), just an honest assessment at the difficulties of making money in open source dev tools [6]. We also compete on features, support and documentation. Again, I can't speak to Ory or Zitadel; they look nice, but I haven't built anything with them, so it is hard for me to know how good they are. I do know that we have had many clients appreciate of those aspects of our product. To sum up: * FusionAuth has a free option, which helps reduce friction and gives some of the benefits of OSS. The open process and escrow also give some of the benefits of OSS. * Some devs and buyers care about business sustainability, especially when integrating a tool deeply into their application. FusionAuth will never have to worry about relicensing a version because AWS is eating our SaaS revenue stream, for example. * We offer great support, documentation and intricate auth features at a reasonable price. Hope this helps. 0: https://fusionauth.io/blog/fusionauth-and-updata https://fusionauth.io/blog/fusionauth-and-updata 1: https://www.hashicorp.com/license-faq https://www.hashicorp.com/license-faq 2: https://www.elastic.co/pricing/faq/licensing https://www.elastic.co/pricing/faq/licensing 3: https://github.com/FusionAuth/fusionauth-issues/issues/ https://github.com/FusionAuth/fusionauth-issues/issues/ 4: https://www.crunchbase.com/organization/ory/company_overview/overview_timeline https://www.crunchbase.com/organization/ory/company_overview... 5: https://www.crunchbase.com/organization/zitadel https://www.crunchbase.com/organization/zitadel 6: I wrote about this a few years ago on my personal blog: https://www.mooreds.com/wordpress/archives/3438 https://www.mooreds.com/wordpress/archives/3438

apitman 3y ago
Thanks for the detailed answer. If people are already taking advantage of your free offering, how would it be different if you released the source? If you're worried about another company piggybacking off your work to start a competitor, why not use one of these newfangled non-compete licenses? That still gives users the security of being able to for the project internally if you go under.
- mooreds 3y ago
  The free version of FusionAuth has limits beyond what other licenses have. See https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 for more details. I'm afraid that's all the detail I have about the decision to keep FusionAuth closed source.
  - mooreds 3y ago
    Sorry, on re-read, this sounds kinda abrupt. My bad. I think at the end this is a business decision. The executive team has considered options and decided that closed source is the right path for the company.
    - apitman 3y ago
      No worries. Didn't seem abrupt.
deleted 3y ago
[deleted]
ensignavenger 3y ago
>> It embeds in your system, even if you stick to a standard like OIDC, and is difficult to switch from, especially at scale. This is precisely why a real, Open Source solution should be a top priority feature for anyone evaluating software like this. We have seen closed source solutions, time and time again, "realign" their business by dropping features, or even entire, free plans. In some cases, closed source software has been removed from the market all together when the company gets bought out. Changes in pricing plans leads to a worse fit for customers... etc. At least when Hashicorp and Elastic abandoned Open Source, the community had the option to say "yeah, good luck, thanks for the good times, but no thanks on your new direction" and fork the product to continue maintaining it. When a closed source products owners decide to "shift gears" on the product line up, customers are left between a rock and a hard place. Maybe if there were no Open Source options, but fortunately, there are several in the auth space.