3 ms·

This seems like a great idea. I've come to think the UX requirements of enterprise and indie dev / start up customers are fundamentally incompatible in the clo

This seems like a great idea. I've come to think the UX requirements of enterprise and indie dev / start up customers are fundamentally incompatible in the cloud. As an enterprise I want to be able to set restrictions at the org, project, team and resource level for various compliance rules. And I want these rules to be restrictive by default (e.g block public access). However as an individual developer the mere existence of those options makes getting started and debugging things painful. It's why I'll never again use Azure for a side project, although it'd be my first choice for a government project.

djtango 2y ago
Isn't that why Heroku exists?
- spacebanana7 2y ago
  Yeah - Heroku, Firebase, Supabase etc all target these kind of smaller customers. The nice thing about this service is that it seems to be public first. Which reduces the user effort involved in managing a permissions layer on top of storage.
Frost1x 2y ago
When you have highly granular controls, you need to create intermediary common sets or “profiles” of those sets at decreasing levels of granularity for the more common use cases, at least some of the most common sets where I can simply choose a single setting to effect everything with sane defaults. Consumer cameras remind me of this when they started mimicking more and more sophisticated feature sets of professional cameras. Sure I want that fantastic sensor, great lens setup and ability to take both narrow and wide depth of field photos but I don’t know or rather want to be bothered dealing with adjusting all my f-stops, focal point etc. I need automation where possible for these cases to give me sane results. In that case it’s a bit more complex because you have engineering problems for those intermediary steps (e.g. autofocus and making sure the image results meet criteria) whereas for software profiles you can often get away with just choosing option sets. Some options still can’t be hand waived away though and require some degree of looking at other things to inform them or being manually set even for pure software controls.
Galanwe 2y ago
Or you need to have enough experience with any IaC tech that setting up a bucket with proper permisioning is a breeze. Once you get your own little pulumi/terraform library, these things really stop to be a pain.
TheNewsIsHere 2y ago
I understand the different need being espoused here, but I think it paints with an overly broad brush. My company is what people would colloquially refer to as a startup, although it is by most formal definitions an established company (more than five years old, profitable and self-funded, no external money, defined product and stable customer base). Under the US SBA classification we are a small business by revenue, and we have three people. Little frustrates us more than sophisticated features being locked behind enterprise packages, because we tend to select toward enterprise feature sets by default. We are small, but we make it a priority to do business in ways that most small businesses don’t focus on. This has been wonderfully successful for us because we have the kind of customers who will ask “how do you manage backups, and why should I trust you to do that?” We can answer those sorts of questions with the same kind of robust architecture people expect from much larger providers. We can point to adhering to the 3-2-1 rule with three different copies of customer data (one production, two backups) maintained in three locations managed by two (legally distinct) clouds/data centers, each at least 500 miles apart, two of which are resistant to ransomware attacks (the backups in S3), all of which are protected with hardware MFA. We have a fourth copy as a failsafe in the form of rolling VM backups made every 24 hours, saved for approximately 7 days. That is in large part due to using S3. Sophisticated feature sets are extremely valuable for us even if we aren’t an enterprise. They allow us to put our money where our mouth is.
- contrast 2y ago
  It sounds like you want to provide an enterprise-grade service, why wouldn’t you expect to pay enterprise-grade prices to your suppliers?
  - Terretta 2y ago
    In short: SSO is a core security requirement for any company [customer] with more than five employees. SaaS vendors appear not to have received this message, however. SSO is often only available as part of “Enterprise” pricing, which assumes either a huge number of users (minimum seat count) or is force-bundled with other “Enterprise” features which may have no value to the company using the software. If companies claim to “take your security seriously”, then SSO should be available as a feature that is either: - part of the core product, or - an optional paid extra for a reasonable delta, or - attached to a price tier, but with a reasonably small gap between the non-SSO tier and SSO tiers. https://sso.tax/ https://sso.tax/

djtango 2y ago

Isn't that why Heroku exists?

spacebanana7 2y ago
Yeah - Heroku, Firebase, Supabase etc all target these kind of smaller customers. The nice thing about this service is that it seems to be public first. Which reduces the user effort involved in managing a permissions layer on top of storage.

Frost1x 2y ago

When you have highly granular controls, you need to create intermediary common sets or “profiles” of those sets at decreasing levels of granularity for the more common use cases, at least some of the most common sets where I can simply choose a single setting to effect everything with sane defaults. Consumer cameras remind me of this when they started mimicking more and more sophisticated feature sets of professional cameras. Sure I want that fantastic sensor, great lens setup and ability to take both narrow and wide depth of field photos but I don’t know or rather want to be bothered dealing with adjusting all my f-stops, focal point etc. I need automation where possible for these cases to give me sane results. In that case it’s a bit more complex because you have engineering problems for those intermediary steps (e.g. autofocus and making sure the image results meet criteria) whereas for software profiles you can often get away with just choosing option sets. Some options still can’t be hand waived away though and require some degree of looking at other things to inform them or being manually set even for pure software controls.

Galanwe 2y ago

Or you need to have enough experience with any IaC tech that setting up a bucket with proper permisioning is a breeze. Once you get your own little pulumi/terraform library, these things really stop to be a pain.

TheNewsIsHere 2y ago

I understand the different need being espoused here, but I think it paints with an overly broad brush. My company is what people would colloquially refer to as a startup, although it is by most formal definitions an established company (more than five years old, profitable and self-funded, no external money, defined product and stable customer base). Under the US SBA classification we are a small business by revenue, and we have three people. Little frustrates us more than sophisticated features being locked behind enterprise packages, because we tend to select toward enterprise feature sets by default. We are small, but we make it a priority to do business in ways that most small businesses don’t focus on. This has been wonderfully successful for us because we have the kind of customers who will ask “how do you manage backups, and why should I trust you to do that?” We can answer those sorts of questions with the same kind of robust architecture people expect from much larger providers. We can point to adhering to the 3-2-1 rule with three different copies of customer data (one production, two backups) maintained in three locations managed by two (legally distinct) clouds/data centers, each at least 500 miles apart, two of which are resistant to ransomware attacks (the backups in S3), all of which are protected with hardware MFA. We have a fourth copy as a failsafe in the form of rolling VM backups made every 24 hours, saved for approximately 7 days. That is in large part due to using S3. Sophisticated feature sets are extremely valuable for us even if we aren’t an enterprise. They allow us to put our money where our mouth is.

contrast 2y ago
It sounds like you want to provide an enterprise-grade service, why wouldn’t you expect to pay enterprise-grade prices to your suppliers?
- Terretta 2y ago
  In short: SSO is a core security requirement for any company [customer] with more than five employees. SaaS vendors appear not to have received this message, however. SSO is often only available as part of “Enterprise” pricing, which assumes either a huge number of users (minimum seat count) or is force-bundled with other “Enterprise” features which may have no value to the company using the software. If companies claim to “take your security seriously”, then SSO should be available as a feature that is either: - part of the core product, or - an optional paid extra for a reasonable delta, or - attached to a price tier, but with a reasonably small gap between the non-SSO tier and SSO tiers. https://sso.tax/ https://sso.tax/