3 ms·

Another one for the sso wall of shame - https://sso.tax/ https://sso.tax/

by MrDarcy 2y ago

prabhatsharma 2y ago
You should read this - https://openobserve.ai/blog/sso-tax https://openobserve.ai/blog/sso-tax
- Eridrus 2y ago
  I think you don't understand the core argument re the SSO Tax, which is that security is a positive sum good, which is why it should not be the feature used for price discrimination. Not all products have other good features to use for price discrimination, so I have some sympathy for vendors here, but I think it often indicates laziness in thinking about what they can use to do the necessary price discrimination.
  - prabhatsharma 2y ago
    I do understand it's super important for security, and I want large companies who have ample money and spend a lot on security to pay me as well for it. If you are running OpenObserve in your basement or are a small startup you get it for free in OpenObserve and stay secure.
    - Eridrus 2y ago
      I want large companies to pay you too, but SSO is not a purely large company feature. There are plenty of companies with more than 10 developers that are not large companies.
      - prabhatsharma 2y ago
        OpenObserve offers free SSO on our cloud service to anyone and Free SSO for anyone using enterprise version if they ingest under 200 GB/Day (6 TB/Month). This should cover all companies with 10 developers.
        thedevilslawyer 2y ago
        So a small company with say 25 dev/employees with say 2 gb of data per day? Edit: People here do get what you're saying - "This is the only way we can force some users to pay". What you're not hearing is "Either don't call out your software as FOSS, or if you do, figure out ways of price discriminating without hurting security for FOSS users."
      - magicalhippo 2y ago
        We're in that position. We make B2B software and just increased to 12 devs. Due to security demands from customers, SSO is a must for products like this and it frequently forces us into the enterprise bin.
osigurdson 2y ago
How should companies monetize products? Maybe people should just go back to full commercial models, not sure.
- prabhatsharma 2y ago
  Most people who talk about SSO Tax don't really care for it's values but rather want free stuff. I have had conversations with multi-billion dollar companies who would avoid paying a single dollar to support open source companies and bring SSO tax into conversation. On our part OpenObserve offers free SSO on our cloud service to anyone and Free SSO for anyone using enterprise version if they ingest under 200 GB/Day (6 TB/Month).
  - MajimasEyepatch 2y ago
    The problem with not offering SSO on lower tiers is that it can make it hard to test into a new service. I might want to try out a new tool with one team for a couple of months and see how it goes before recommending adoption for a broader group. I don't want to have to sign a year-long six-figure contract just to try something out. Sometimes you can work out a trial period with the sales team, but that's not always easy, and it puts a strict ticking clock on things that doesn't work in all situations.
  - yourapostasy 2y ago
    > ...conversations with multi-billion dollar companies... Slight clarification here. Might not apply in OpenObservability's case but might help others on their journey to enterprise sales with their projects. Those are typically conversations with managers holding $X purchasing authority, typically like $500K for a US director'ish level, within multi-billion dollar companies. These managers usually aren't averse to spending on open source projects. They're averse to cutting a check not tied to a support contract with responsive, polite, helpful support with published support policies at 0300h local time on a break-fix line with 75 other people from other support teams in the company watching. A surprising number of open source projects won't offer that guarantee, and instead only offer the option to "donate" with vague promises of priority support. More projects are getting better at this more recently, but it takes a surprising amount of red tape to onboard as a vendor into these organizations, and a lot of open source teams don't have the appetite for putting up with that. Until kind of recently, the conversation switching to the SSO Tax is really about accessing that level of guaranteed support delivery.
Groxx 2y ago
SSO often costs quite a lot to maintain, given how widely varied the systems are. Seems reasonable to charge for an optional high-complexity and high-maintenance-burden feature.
- terminalbraid 2y ago
  Are you referring to the development cost or just the "keep SSO wired to other orgs in for our cloud product"? Development-wise, SSO standards don't change much and aren't terribly difficult to get up an running if you stick to oauth and saml. By not offering that in a self-hosted open source version where the maintenance is delegated to the user turns this to a naked cash grab.
  - Groxx 2y ago
    The constant stream of B2B stuff that tends to come with it is the real cost. 95%+ of stuff is indeed technically quite standard and Solved™, like with all things oauth... but that last 5% will relentlessly bleed your will to live out of you. Oauth is a massive mess that necessitates libraries with custom tweaks for hundreds of providers, SAML exists but only aging or over-sized B2B touches it so you now have obtuse B2B customers demanding you Address and Attest To Compliance With unrelated PHP CVEs for a Linux distro that's a decade older than the ancient long-term-support version your company started under, plus you're a Ruby shop so wtf even, and... Yeah I've been there. If you can tell B2B to fuck off, it's legitimately easy. If you're running a business around it, they're your major sources of income, you're taken along for their ride and it has absolutely no reason to be Ride-able like that but this is the designed-by-committee world we live in now.
nhumrich 2y ago
How is this on the SSO tax wall of shame? They support it SSO on their free tier.

Another one for the sso wall of shame - https://sso.tax/ https://sso.tax/

prabhatsharma 2y ago

You should read this - https://openobserve.ai/blog/sso-tax https://openobserve.ai/blog/sso-tax

Eridrus 2y ago
I think you don't understand the core argument re the SSO Tax, which is that security is a positive sum good, which is why it should not be the feature used for price discrimination. Not all products have other good features to use for price discrimination, so I have some sympathy for vendors here, but I think it often indicates laziness in thinking about what they can use to do the necessary price discrimination.
- prabhatsharma 2y ago
  I do understand it's super important for security, and I want large companies who have ample money and spend a lot on security to pay me as well for it. If you are running OpenObserve in your basement or are a small startup you get it for free in OpenObserve and stay secure.
  - Eridrus 2y ago
    I want large companies to pay you too, but SSO is not a purely large company feature. There are plenty of companies with more than 10 developers that are not large companies.
    - prabhatsharma 2y ago
      OpenObserve offers free SSO on our cloud service to anyone and Free SSO for anyone using enterprise version if they ingest under 200 GB/Day (6 TB/Month). This should cover all companies with 10 developers.
      - thedevilslawyer 2y ago
        So a small company with say 25 dev/employees with say 2 gb of data per day? Edit: People here do get what you're saying - "This is the only way we can force some users to pay". What you're not hearing is "Either don't call out your software as FOSS, or if you do, figure out ways of price discriminating without hurting security for FOSS users."
    - magicalhippo 2y ago
      We're in that position. We make B2B software and just increased to 12 devs. Due to security demands from customers, SSO is a must for products like this and it frequently forces us into the enterprise bin.

osigurdson 2y ago

How should companies monetize products? Maybe people should just go back to full commercial models, not sure.

prabhatsharma 2y ago
Most people who talk about SSO Tax don't really care for it's values but rather want free stuff. I have had conversations with multi-billion dollar companies who would avoid paying a single dollar to support open source companies and bring SSO tax into conversation. On our part OpenObserve offers free SSO on our cloud service to anyone and Free SSO for anyone using enterprise version if they ingest under 200 GB/Day (6 TB/Month).
- MajimasEyepatch 2y ago
  The problem with not offering SSO on lower tiers is that it can make it hard to test into a new service. I might want to try out a new tool with one team for a couple of months and see how it goes before recommending adoption for a broader group. I don't want to have to sign a year-long six-figure contract just to try something out. Sometimes you can work out a trial period with the sales team, but that's not always easy, and it puts a strict ticking clock on things that doesn't work in all situations.
- yourapostasy 2y ago
  > ...conversations with multi-billion dollar companies... Slight clarification here. Might not apply in OpenObservability's case but might help others on their journey to enterprise sales with their projects. Those are typically conversations with managers holding $X purchasing authority, typically like $500K for a US director'ish level, within multi-billion dollar companies. These managers usually aren't averse to spending on open source projects. They're averse to cutting a check not tied to a support contract with responsive, polite, helpful support with published support policies at 0300h local time on a break-fix line with 75 other people from other support teams in the company watching. A surprising number of open source projects won't offer that guarantee, and instead only offer the option to "donate" with vague promises of priority support. More projects are getting better at this more recently, but it takes a surprising amount of red tape to onboard as a vendor into these organizations, and a lot of open source teams don't have the appetite for putting up with that. Until kind of recently, the conversation switching to the SSO Tax is really about accessing that level of guaranteed support delivery.

Groxx 2y ago

SSO often costs quite a lot to maintain, given how widely varied the systems are. Seems reasonable to charge for an optional high-complexity and high-maintenance-burden feature.

terminalbraid 2y ago
Are you referring to the development cost or just the "keep SSO wired to other orgs in for our cloud product"? Development-wise, SSO standards don't change much and aren't terribly difficult to get up an running if you stick to oauth and saml. By not offering that in a self-hosted open source version where the maintenance is delegated to the user turns this to a naked cash grab.
- Groxx 2y ago
  The constant stream of B2B stuff that tends to come with it is the real cost. 95%+ of stuff is indeed technically quite standard and Solved™, like with all things oauth... but that last 5% will relentlessly bleed your will to live out of you. Oauth is a massive mess that necessitates libraries with custom tweaks for hundreds of providers, SAML exists but only aging or over-sized B2B touches it so you now have obtuse B2B customers demanding you Address and Attest To Compliance With unrelated PHP CVEs for a Linux distro that's a decade older than the ancient long-term-support version your company started under, plus you're a Ruby shop so wtf even, and... Yeah I've been there. If you can tell B2B to fuck off, it's legitimately easy. If you're running a business around it, they're your major sources of income, you're taken along for their ride and it has absolutely no reason to be Ride-able like that but this is the designed-by-committee world we live in now.

nhumrich 2y ago

How is this on the SSO tax wall of shame? They support it SSO on their free tier.