9 ms·

We built an air-gapped Jira alternative for regulated industries

270 points by viharkurama 1y ago

viharkurama 1y ago
After a U.S. federal contractor told us they loved Plane but couldn't use it due to ITAR requirements, we spent 6 months building a truly air-gapped version. No external connections, no license pings, no telemetry, everything runs in complete isolation. The interesting part: our air-gapped deployment actually runs faster than our SaaS version. Turns out when you eliminate all network latency, things get snappy. This post covers the technical challenges we solved (supply chain trust, 2GB bundle size, offline licensing) and why regulated industries need alternatives to cloud-only tools like Jira.
- jeron 1y ago
  >our air-gapped deployment actually runs faster than our SaaS version. Turns out when you eliminate all network latency, things get snappy. Notion, take notes
- vosper 1y ago
  > cloud-only tools like Jira. But Jira is not cloud-only? https://www.atlassian.com/enterprise/data-center https://www.atlassian.com/enterprise/data-center
  - magicalhippo 1y ago
    They've removed it from their pricing page now, but when they announced the discontinuation of the regular on-prem server the minimum for datacenter was like 500 licensed users or something along those lines. In any case it was clear it's not for small shops like us. That said, air-gapped is a hefty requirement, so perhaps those customers are predominantly large?
    - viharkurama 1y ago
      We took a different approach with Plane's air-gapped offering. No minimum user requirements at all. We evaluate based on your use case and domain requirements, not team size.
      - magicalhippo 1y ago
        Good approach IMHO. We do the similar with our B2B product (in an entirely different niche). We have everything from single-person companies up to very large ones. Similarly we set price based on use-case and requirements.
    - bpt3 1y ago
      It's still on this page: https://www.atlassian.com/enterprise/data-center/jira https://www.atlassian.com/enterprise/data-center/jira $51k for the smallest license they offer. I still run an old version on an air gapped network and will continue to do so until we're forced to change for some reason. It's not a hefty requirement; we run it for a team of < 10 developers on a small VM and it just works.
      - magicalhippo 1y ago
        Blind as a bat, thanks. Was looking for a pricing page or similar, totally scrolled by that box which looked like marketing fluff.
    - bigfatkitten 1y ago
      > That said, air-gapped is a hefty requirement, so perhaps those customers are predominantly large? There are lots of very small classified networks out there with only a few dozen users. There are a lot more user communities course that aren’t necessarily airgapped, but where they have special compliance requirements that pretty much mandate self hosting (or at least bring-your-own cloud.)
  - jasondc 1y ago
    $$$$ Very expensive
  - bpt3 1y ago
    It might as well be for the vast majority of companies, since I believe the smallest number of users you can buy support for is 500. To be more specific, they killed off the legacy Jira Server and now only offer these enterprise versions of Jira and the rest of the suite if you won't move to the cloud.
  - thaack 1y ago
    Sure if you commit to a 500 user minimum.
  - bowsamic 1y ago
    Atlassian actually threatened to sue our company if we didn't move from on-prem to cloud. I imagine they're doing the same to others
    - GabeIsko 1y ago
      There has historically been massive investor and shareholder pressure for companies to show "Cloud Recurring Revenue" and multiple wall street analysts will start issuing higher price points for your stock based on this, and eventually large institutional investor adjust their positions accordingly. I like the cloud for a lot of reasons. But, making your software worse to make your stock price higher seems like a loser for everyone long term.
- magicalhippo 1y ago
  > Turns out when you eliminate all network latency, things get snappy. Same experience with JIRA. I read all these negative comments here and elsewhere about how slow and clunky JIRA was, and I couldn't relate at all. Then I realized all those who complained was using JIRA Cloud and we were using on-prem, and it all made sense. We've since moved to JIRA Cloud ourselves, and I understand now. We moved and none of the new places had any viable computer room, so literally had to put the rack in a closet And well, that ain't cutting it for physical access control these days. Thankfully we have very simple flows without any BS, so not too many 1-5 second clicks to get things done.
  - IshKebab 1y ago
    > Then I realized all those who complained was using JIRA Cloud and we were using on-prem, and it all made sense. Even Atlassian doesn't use Jira cloud. Btw it's not "JIRA".
    - magicalhippo 1y ago
      > Even Atlassian doesn't use Jira cloud. That would explain a lot. > Btw it's not "JIRA". When did they change this? I'm fairly certain[1] it used to be JIRA. [1]: https://confluence.atlassian.com/jira061 https://confluence.atlassian.com/jira061
      - eastbound 1y ago
        In 2013, to be specific.
    - joeldo 1y ago
      That's no longer the case - a large portion of teams are now using cloud variants of Confluence/Jira.
    - tomrod 1y ago
      What a weird time to enforce British rules for acronyms. JIRA stands for JIRA Isn't Really Awesome.
- yodon 1y ago
  How do you handle compliance in confirming that the product is only used for the license duration? (Or is it more of a one time purchase plus recurring fee for updates?)
  - viharkurama 1y ago
    It's a subscription license. We offer air-gapped deployments under the Business plan. As part of compliance, we request customers to share license logs quarterly-no PII involved. Also, the license enforces seat limits, so you can't exceed the number of users you've purchased. https://plane.so/pricing https://plane.so/pricing
  - Msurrow 1y ago
    At this level (govt, 6 figure+ deals) I would at least consider if this problem should have a non-tech solution, and instead have a legal/lawyer solution. In my experience (not US based though) the govt contracts are under compliance programmes as well so the govt agency’s legal/contract mgmt team would probably follow up internally on expiring contracts (ie licences) and require the owning stakeholder to either renew the contract or abandon the software. Meaning the customer would supervise itself regarding licence. But even if you don’t want to rely on self-supervision then having your lawyer spend 1 hour reaching out with a “do you need to renew your licence” at the end of a licence term would probably be much cheaper than building and maintaining an air-gapped licence solution.
    - bobmcnamara 1y ago
      Years back a friend of mine's startup failed when USAF pirated their software and the original customer org stopped paying for it. Feds are DMCA immune, so no real recourse.
      - bigfatkitten 1y ago
        Sounds like having only one paying customer was the real cause of the business’s failure.
- unixhero 1y ago
  Itar ruins all the fun
- isatty 1y ago
  > The interesting part: our air-gapped deployment actually runs faster than our SaaS version. This is the least surprising thing I’ve read all day.
  - jagged-chisel 1y ago
    Indeed. For multiple reasons: - it is not at all surprising that when you remove cruft, code performs batter - it is not at all surprising that this is not common enough amongst software engineers to even consider these things (competing business interests probably cause this often)
    - graealex 1y ago
      Not being connected to the work VPN already slows down my Windows to a near halt since a few unreachable network drives is all it takes to make Explorer go unresponsive. Seems like engineers forget to test these things nowadays.
      - Too 1y ago
        If by ”nowadays” you mean the past 30 years. Slow network drives making Explorer go completely unresponsive has been a thing since Windows 95. I’m more surprised to hear that bug still hasn’t been fixed. Luckily I don’t use Windows myself since many years ago.
  - chooma 1y ago
    All year maybe?
  - chrisandchris 1y ago
    If they also realize that having less dependencies makes deployment easier we have gone full circle.
    - andy_ppp 1y ago
      I can't believe how many devs think dependancies are completely cost free...
- beardedwizard 1y ago
  But you didn't tell us how many orders of magnitude more expensive it is to operate :)
- white_dragon88 1y ago
  [dead]
jasondc 1y ago
Big fan of Plane since it's open-core. Doesn't seem to be a lot of options for self-hosted/open-core project management software. The existing ones looks pretty bad, and don't come anywhere close to Jira level functionality.
- majkinetor 1y ago
  Redmine is awesome
- IshKebab 1y ago
  > don't come anywhere close to Jira level functionality. In my experience that's probably a good thing. I've moved from a company using Phabricator to one using Jira. Phabricator had exactly everything we needed and was very nicely designed and worked really nicely. Jira has everything you need plus loads of other stuff that project managers feel like they need to add. Oh and they'll never clear anything up or fix any config bugs because they don't actually have to ever use the "report bug" form so who cares if there are 100 fields and half of the mandatory ones are hidden in "More fields"? 5 different states for "TODO"? Eh who cares. 3 different ways to say which team a bug is in? Better fill them all in for every bug. It's better to be missing features than to have features that project managers can configure.
  - jay_kyburz 1y ago
    The first bug you should log is that the bug logging page has unnecessary fields.
  - CamouflagedKiwi 1y ago
    I've used both as well, I found Phabricator fine for lightweight kanban-style team work tracking, but once we had PMs it was doomed because it would never do what they wanted (they didn't seem to be able to understand that it was not a Scrum system and would never match well). These days I'd be using Github instead, issues there are also nice and simple. I imagine it would ultimately suffer the same fate in a similar situation though (not that I intend to get there ever again). The problem with Jira is that it's so customisable and always ends up being customised by "process people" who think all problems can be solved by adding just one more field - but simultaneously it's never possible to customise your bit to work the way you want.
hd4 1y ago
just a fyi for anyone looking for a neat little kanban board, gitea has kanban built-in into the projects feature. (obviously lacks really fine-grain customization that would be found in other jira alternatives)
- acidburnNSA 1y ago
  And the gitea fork, forgejo does too.
zppln 1y ago
Ehm, fairly sure you can use Jira in an air-gapped environment.
- deleted 1y ago
  [deleted]
- jasondc 1y ago
  from Google: "Atlassian has sunsetted its Server product line, including Jira Server, meaning they are no longer supported and users need to migrate to Cloud or Data Center versions. Specifically, support for Atlassian Server products ended on February 15, 2024. This includes the end of new license sales, renewals, and security updates for Jira Server. "
  - deleted 1y ago
    [deleted]
  - kingnothing 1y ago
    There's the self-hosted Atlassian Data Center product. https://www.atlassian.com/enterprise/data-center https://www.atlassian.com/enterprise/data-center They also offer Government Cloud. https://www.atlassian.com/government https://www.atlassian.com/government
    - mschuster91 1y ago
      You'll pay through your nose for a Data Center license though, and it doesn't change the fact that Jira is a mess so slow that SAP can appear fast in comparison.
  - firesteelrain 1y ago
    Data center version is available. I use it.
firesteelrain 1y ago
Jira has a self-hosting option. It already is air gap ready. See Jira Data Center. 1. https://www.atlassian.com/enterprise/data-center/jira https://www.atlassian.com/enterprise/data-center/jira
Disposal8433 1y ago
There is no price anywhere. I would be interested to use that for either my job or for private projects, but where and how much do I pay? Edit: I looked again and even your pricing pages have no price. I understand that you may want to restrict yourself to rich companies, but I don't understand the point of posting on HN if that's the case.
- pc86 1y ago
  Air-gapped probably adds a zero or two to the highest tier Enterprise price. You wouldn't buy an Enterprise license for a personal project, why would you buy an Enterprise++ license (which is essentially what AG is)?
  - jasondc 1y ago
    It's part of the Business tier on the pricing page here: https://plane.so/pricing https://plane.so/pricing
- viharkurama 1y ago
  If you want air-gapped it's on Business tier, please look at our pricing page. That being said, we don't recommend the air-gapped version for personal use. Instead, you can use our open-source Community Edition here: https://github.com/makeplane/plane https://github.com/makeplane/plane — you can self-host it and disable telemetry entirely.
intexpress 1y ago
A version of JIRA that nobody can access sounds pretty good
- whatbackup 1y ago
  Almost choked on my coffee - cheers
thedonkeycometh 1y ago
[dead]
thedonkeycometh 1y ago
[dead]
psychoslave 1y ago
[flagged]
- movedx 1y ago
  You'll always find that this industry of ours just goes around full circle.
- tptacek 1y ago
  I don't think this cynicism is productive. I've had the pleasure of shipping "regular local applications" several times over my career, and to do it you lose a lot of very basic stuff that modern developers take for granted, most importantly software update and debugging telemetry. It's not a small thing to take a SAAS product and bundle it up like this, and most users don't benefit from it, so it's also not a natural starting place.
  - psychoslave 1y ago
    This mood produced this comment and some answers to it, and we can guess some thoughts in the process, but I wouldn't call it cynicism. There is a difference between using irony to rail the grandiloquence with which something is presented and harsh critics of the thing itself or the intention behind producing the thing itself. Engineering is all about trade-offs, so "nothing is granted without paying some constraint acceptance" is the only fundamental baseline.
- ricardobeat 1y ago
  Local apps usually still require installing dependencies from the network, call home for updates, use cloud storage or sharing, and may send telemetry data. Different levels of strictness.
  - psychoslave 1y ago
    No, local apps can be installed from a local storage just plugged for the occasion, with all its dependencies included. Local application is local, it doesn't deal with network in any way, except if end user goal require to send/receive some external information. So a calculator or a solo game doesn't require network at all, but a chat app or some MMORPG have a legitimate need to access network, but only to communicate with other users. Telemetry is just an other word for spying. Spyware integrated used to be considered a clear sign of malvolonte project. Software update can be put as a separated concern.
radicaldreamer 1y ago
This is just shipping a docker container for people to run the app on their own infrastructure. Retool does the same thing for companies which don’t want to expose internal resources and databases to the cloud.
axus 1y ago
Any more details about the offline patch/upgrade process? When I looked at gitlab years ago, it handled that fine but the documentation seemed "nervous" about it.
- viharkurama 1y ago
  You'll find all the docs here: https://developers.plane.so/self-hosting/methods/airgapped-edition https://developers.plane.so/self-hosting/methods/airgapped-e...
- mdaniel 1y ago
  I struggle to think why that would be any drama, unless the setup is trying to use "bare" gitlab (e.g. running the puppet commands manually versus $(docker save -o airgapped_gitlab.tar gitlab/gitlab-ce:18.2.0-ce && cp ./*.tar /dev/disk/usb-whatever/goodluck/))
miki123211 1y ago
TBH, if I were working in such a highly regulated industry, I'd be very hesitant about buying software from a company with a .so domain and basically beholden to the whims of the government of Somalia. If they said "implement a backdoor for us or all your non-airgapped customers lose access tomorrow", are you sure the company would be able and willing to say no?
- mdaniel 1y ago
  That's a very odd thing to bring up in the context of self-hosting, since you would not interact with their .so domain whatsoever; ensure that the AGPLv3 aligns with your needs, git clone -b v0.27.1 https://github.com/makeplane/plane.git https://github.com/makeplane/plane.git and be happy
- devanshuarora 1y ago
  Totally fair to ask. .so is widely used by software companies as a domain availability solution - think Notion. For regulated environments, the domain doesn’t matter, the architecture does. With air-gapped deployments, Plane doesn’t rely on any external DNS or domains — .so or otherwise. No license pings, no telemetry, no outbound calls. Everything runs in complete isolation, and customers have full control over the environment. Also worth noting: Plane’s open-source core (AGPLv3) allows for full transparency and auditability. So any notion of a backdoor is counter to how we operate — and how our users deploy us.
annoyingnoob 1y ago
Now do an air-gapped Confluence killer, please.
- kevlened 1y ago
  https://github.com/docmost/docmost https://github.com/docmost/docmost
- viharkurama 1y ago
  We already support this. We pack all our products in one single offering. This includes Projects + Wiki. More here: https://docs.plane.so/core-concepts/pages/wiki https://docs.plane.so/core-concepts/pages/wiki Here's a blog on how you can switch between products within Plane, https://plane.so/blog/introducing-apprail-plane-new-navigation https://plane.so/blog/introducing-apprail-plane-new-navigati...
rendall 1y ago
> This post explores the journey of building this specialized deployment option for regulated industries where data sovereignty isn't just preferred—it's mandatory. This is an AI writing tell: "It's not just x—it's y." https://youtu.be/9Ch4a6ffPZY https://youtu.be/9Ch4a6ffPZY
- kstrauser 1y ago
  I loathe every cheap throwaway comment like this. Know who else uses punctuation? People who write. In fact, that's where the AI got the idea.
- degamad 1y ago
  It's an AI writing tell that was copied from so many of us who use it.
  - rendall 1y ago
    Literally no one use that construction with an em dash unless they are using AI to write their copy.
- devanshuarora 1y ago
  To be fair, “not just X—it’s Y” showed up in product marketing way before AI started parroting it. Just saying. :)
  - rendall 1y ago
    Indeed. Marketers took the time to find the key combo that places an em dash. No one else does that. Except AI. It’s not just a typographic choice—it’s a tell!
    - dragonwriter 1y ago
      > Marketers took the time to find the key combo that places an em dash. No one else does that. Pretty much everything that is professionally published does, and lots of people who care about typography do, that.
tptacek 1y ago
Given their customer base, I wonder why they bothered with any license enforcement for the pure on-prem. Just do the "license enforcement" implicitly when customers want to update: they need to log in to get the new image. (Your regular annoying notice that FIPS-compliant crypto is, if anything, marginally less secure than non-FIPS crypto; not that it matters in any material way, just, it's not a flex.)
0xWTF 1y ago
As a DoD employee, it would be amazing if more companies took this seriously (I'm looking at you health tech bros).
- polski-g 1y ago
  It was shocking, talking to the Jira rep. They basically said they didn't want this sector's business.
- WaitWaitWha 1y ago
  No, no you do not. A week into installation, your cube mate will be complaining that the arrow keys do not work as used to and cannot use alt-tab on the fields, or the color orange and green make their eye hurt. So a ticket is opened, a software update is made, and then the patch is generated. That is 12 month on a good day because all the back track, re-validation, scope creep, auditing, re-validation, third party review, committee blessings, and good idea fairies. Then you have to get the patch into the environment. Now you need a blood oath from the entire chain of command up to Katie A. where she swears she is going to beat you if you whine about the color scheme again. ;) Three years past, and the changes are implemented. It does not matter because your monitor which had to be TAA compliant and could not be brought in without you soldering everything together is now running off of a hercules video card, yes that green only hercules card. You see only shades of green in the app...
- devanshuarora 1y ago
  Really appreciate that — and totally agree. We’ve been surprised by how many teams in defense, healthcare, and critical infrastructure are still stuck choosing between bloated legacy tools or cloud-only products that don’t check the right boxes. We built the air-gapped edition of Plane exactly for this.
- vanschelven 1y ago
  I do take this seriously (see link in my profile), but have to admit that doing so isn't an automatic entry tickets to places like the DoD
lifeisstillgood 1y ago
I guess my mental model is all wrong but those air-gapped choices - they seemed kind of what is natural to do …
Pi9h 1y ago
I am also building https://docmost.com https://docmost.com, a self-hostable Confluence alternative that can run fully air-gapped. It has support for spaces, real-time collaboration, a rich-text editor, built-in diagrams support and more. We launched on HN 1 year ago: https://news.ycombinator.com/item?id=40832146 https://news.ycombinator.com/item?id=40832146
- mnholt 1y ago
  What does your enterprise pricing look like?
duffpkg 1y ago
This also makes it infinitely more useful for healthcare. Not healthcare software specifically. Lots of use cases in logistics, irl maintenance, etc. Patient data creates hipaa challenges and tends to overflow into any system.
- viharkurama 1y ago
  +1. We already work with a few healthcare teams, and self-hosted is almost always their go-to. Our air-gapped edition has been in beta for a bit, and we’re seeing more use cases pop up—especially in places where HIPAA and data isolation matter a lot.
- tptacek 1y ago
  Why would a health care org care about air-gapped deployments? Most (really, almost all) health care data is stored on cloud SAAS databases already; for people who care, this vendor already had an on-prem version.
  - SMrF 1y ago
    What you say makes sense, but I think there can be reasons. For our military customers we offer an air-gapped version of our app early on because it was easier for customers than getting an ATO. Also as a bootstrapped company it was a lot cheaper than FedRAMP. I'm guessing I'd lean on a similar strategy if I had a health care startup.
    - tptacek 1y ago
      Most health care companies get along just fine in AWS, just for what it's worth.
- mannyv 1y ago
  Nothing in HIPAA mandates air gaps. In the context of HIPAA that's really overkill. In fact, self-hosting might even do you wrong when things go bad, because AWS is probably better managed and more secure. And they have all their certs, which is legally important.
mind_heist 1y ago
This is totally a tangential point. Why do they call it "air gapped" instead of "air tight" ? Are these supposed to mean different things ?
- dummydummy1234 1y ago
  Airgapped systems have an air gap between the system and the wider world. The only way to move data to and from them is for someone to walk across the gap with physical media. There are no communication cables between the host system and the wider world.
  - defrost 1y ago
    There are other ways, of course. * air-gap malware can be designed to communicate secure information acoustically, at frequencies near or beyond the limit of human hearing. * In 2014, researchers introduced ″AirHopper″, a bifurcated attack pattern showing the feasibility of data exfiltration from an isolated computer to a nearby mobile phone, using FM frequency signals. * In 2015, "HELLONE", a covert signaling channel between air-gapped computers using thermal manipulations, was introduced. "BitWhisper" supports bidirectional communication and requires no additional dedicated peripheral hardware. * Later in 2015, researchers introduced "GSMem", a method for exfiltrating data from air-gapped computers over cellular frequencies. The transmission - generated by a standard internal bus - renders the computer into a small cellular transmitter antenna. https://en.wikipedia.org/wiki/Air-gap_malware https://en.wikipedia.org/wiki/Air-gap_malware
    - h4ckerle 1y ago
      Don't forget Stuxnet which crossed the airgap via infecting USB Devices. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
      - defrost 1y ago
        Not forgotten at all, deliberately unmentioned as I focused on crossing the air gap by means other than: The only way to move data to and from them is for someone to walk across the gap with physical media. Stuxnet was walked across via physical media (USB drives).
colordrops 1y ago
Most self-hosted apps, including jira, can be airgapped. Yeah maybe it's not made super easy like Plane, but any org that requires this is going to have an IT department that can handle it.
rubidium 1y ago
They make it seem like a big deal. It’s pretty much how all software used to ship :)
- esafak 1y ago
  I've heard they're planning to ship it with printed documentation some time soon!!
- devanshuarora 1y ago
  Yes, absolutely, in a way, we’re just bringing back the old-school model — full package, zero dependencies, runs on your own infra — but with modern tooling and UX.
- vanschelven 1y ago
  Both those things can be true at the same time: all software used to ship like that, and shipping like that in the current era _is a big deal_. Spoken as someone who's core differentiator is "self hosted" [0] [0] https://www.bugsink.com/ https://www.bugsink.com/
EverydayBalloon 1y ago
[dead]
doctorpangloss 1y ago
the air gapped Jira alternative for regulated industries is a big white board
- devanshuarora 1y ago
  We ran our company on a whiteboard, until we couldn't, so I get it. And honestly it does beat a lot of bloated tools out there. But when you need permissioning, history, workflows, audit logs—and your infra lives in a bunker—we try to be the next best thing. Air-gapped, fast, and without the Jira bloat.
  - white_dragon88 1y ago
    [dead]
aetherspawn 1y ago
Buy-and-forget perpetual pricing for internal networks, please. Don’t want to pick up annual subscriptions, and don’t want any dependency on a third party company that might not last or will start doubling prices in the future after an acquisition - been burned heaps by that.
tannike 1y ago
HCSB?
tannike 1y ago
HCSB in the image? Copyright dodging?
precommunicator 1y ago
From the table: > Component: Telemetry > Cloud / Self-Hosted: Opt-in analytics > Air-Gapped: Disabled by default What's the difference?
polski-g 1y ago
We use Plane. It's acceptable. Not great, not terrible. Jira wanting 26k per year, per customer we have was unacceptable. I wish their docker deployment was normal (only docker-compose.yml), not a shell script that launches docker. It needs ldap auth and better search capability (fts, boolean, filtering). UI is clunky; everything is editable all the time, so you might end up accidently editing the ticket contents.
deleted 1y ago
[deleted]
treve 1y ago
I just learned air-gapped includes private networks. I was under the impression this strictly meant isolated non-networked computers. Was this always the case or has the term diluted over time?
- RandallBrown 1y ago
  I think it just depends on the context you're talking about. Air gapped just means there's no connection between two things so it could be talking about networks or individual computers.
- tasn 1y ago
  In my circles we include private networks going back at least 15 years. So maybe diluted, but if diluted, at least not new.
- devanshuarora 1y ago
  Strictly speaking, air-gapped originally meant physically isolated, no network connections at all. But in practice, the definition has broadened a bit, especially in enterprise and defense settings. Today, it may include closed private networks with no internet access, still isolated, but with internal connectivity for practical reasons (like backups, logging, or internal auth).
  - hgomersall 1y ago
    Pfft! Truly air-gapped would be each key on the keyboard physically unconnected to anything else. True security.
- alexb_ 1y ago
  I work on an air-gapped network. The most important thing that the words "air gap" communicate is that there is no connection, nothing at all, to anything outside the network. The only way to move anything on or off are using disc drives (no USB for security reasons). The word "private network" does not really communicate that there is a physical gap of no wires at all from the computers on the network and everything else on the internet.
Aeolun 1y ago
I think it’s hilarious that this is something they specifically had to do, and was apparently hard? All my software works fine in completely air-gapped environments.
- hmhhashem 1y ago
  When you add features such as telemetry, curl calls in install scripts, and in general build on public cloud infra, everything assumes you have internet connectivity. That assumption is so crucial that it is embedded in everything and touches most software components. When you already have an established product, I imagine changing it to remove the assumption without a full rewrite can be tricky.
- devanshuarora 1y ago
  Yes, agreed, if you build with air-gapped in mind from day one, it should just work. In our case, we had to unwind a bunch of assumptions baked into modern SaaS: license checks, analytics, image pulls, update pings… even small things like font hosting or third-party embeds needed rethinking. Not hard in principle, just a lot of invisible cleanup to make it truly self-contained. Learned a ton doing it.
juliangmp 1y ago
> Even with our robust self-hosted option, we kept hearing the same feedback from legal and compliance teams: "Private cloud" solutions that still require Virtual Private Network (VPN) tunnels don't meet their stringent requirements. If it has a VPN tunnel to some outside server, you shouldn't really call it "self-hosted*
- Cthulhu_ 1y ago
  Self-hosting implies the software runs on the customer's own servers, but phone-home license checks (or analytics, or whatnot) is not unheard of.
miyuru 1y ago
Looks like they only support single node deployment at the moment. Having worked with airdropped software packaging, next step is a multi node setup.
hamaspiker 1y ago
[dead]
hardwaresofton 1y ago
AGPL continues to be the future of F/OSS https://vadosware.io/post/the-future-of-free-and-open-source-is-agpl/ https://vadosware.io/post/the-future-of-free-and-open-source... Dread it, run from it, AGPL still arrives. Sustainable F/OSS is the most likely to-still-be-active-5-years-from-now kind of F/OSS.
0points 1y ago
"air-gapped" self hosted app. It used to be the default that self hosted apps didn't telemetry and call home. I feel there's more than one self hosted foss jira alternative around already, that of course wouldn't telemtry or call home. Some I used in the past: https://www.redmine.org/ https://www.redmine.org/ https://phacility.com/phabricator/ https://phacility.com/phabricator/ no longer maintained :-(
- xorcist 1y ago
  Phrabricator lives on in Phorge, which is seeing active contributions. I haven't used Phorge, but Phrabricator is easily my favourite tool among the source code portals. The code review system actually works and does not make me tear my hair out. I am completely at a loss why the commercial side of it seemingly failed after all those years, when products such as Bitbucket and Gitlab seem to do well.
jollyllama 1y ago
We wanted to host on prem a few years ago. Plane was around at the time but didn't look like a mature enough solution. On the other hand, our Redmine instance was far too "mature." We went with YouTrack since it had a highly customizable import plugin for Redmine.
elric 1y ago
I think we have different definitions of the term "air-gapped". Users still very much connect to it using a network. This just doesn't phone home (or elsewhere). A truly airgapped Jira-alternative would be somewhat impractical.
- hkchad 1y ago
  Why? I use to manage one on a classified air-gapped network, back before Atlassian was all Cloud Based or 'Data Center' license junk. We had Stash, Jira, Confluence, FishEye, HipChat, everything hosted on a non-internet connected network.
- beng-nl 1y ago
  If the local network as a whole can do work, connect to the Kira-alternative for their work, but the network is isolated from the internet - then it counts as airgapped IMO.
willejs 1y ago
Running software in an airgapped environment is difficult, but the hardest thing is the install, packaging and shipping updates. I have used https://zarf.dev/ https://zarf.dev/ to do this for a government client, and it was an amazing experience. I highly recommend it. K8s seems heavy, but if you want to run datastores with backups (k8s operators), or highly customised environments, and automate all of that, instead of loads of bash and custom code, it shines.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
time4tea 1y ago
So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources.. Bit-for-bit reproducible builds are definitely doable, but mean including build dates is tricky, and care needs to be taken with archival file ordering. Is this such a big departure from the norm? Curious what constitutes normal!

270 points by viharkurama 1y ago

After a U.S. federal contractor told us they loved Plane but couldn't use it due to ITAR requirements, we spent 6 months building a truly air-gapped version. No external connections, no license pings, no telemetry, everything runs in complete isolation. The interesting part: our air-gapped deployment actually runs faster than our SaaS version. Turns out when you eliminate all network latency, things get snappy. This post covers the technical challenges we solved (supply chain trust, 2GB bundle size, offline licensing) and why regulated industries need alternatives to cloud-only tools like Jira.

jeron 1y ago
>our air-gapped deployment actually runs faster than our SaaS version. Turns out when you eliminate all network latency, things get snappy. Notion, take notes
vosper 1y ago
> cloud-only tools like Jira. But Jira is not cloud-only? https://www.atlassian.com/enterprise/data-center https://www.atlassian.com/enterprise/data-center
- magicalhippo 1y ago
  They've removed it from their pricing page now, but when they announced the discontinuation of the regular on-prem server the minimum for datacenter was like 500 licensed users or something along those lines. In any case it was clear it's not for small shops like us. That said, air-gapped is a hefty requirement, so perhaps those customers are predominantly large?
  - viharkurama 1y ago
    We took a different approach with Plane's air-gapped offering. No minimum user requirements at all. We evaluate based on your use case and domain requirements, not team size.
    - magicalhippo 1y ago
      Good approach IMHO. We do the similar with our B2B product (in an entirely different niche). We have everything from single-person companies up to very large ones. Similarly we set price based on use-case and requirements.
  - bpt3 1y ago
    It's still on this page: https://www.atlassian.com/enterprise/data-center/jira https://www.atlassian.com/enterprise/data-center/jira $51k for the smallest license they offer. I still run an old version on an air gapped network and will continue to do so until we're forced to change for some reason. It's not a hefty requirement; we run it for a team of < 10 developers on a small VM and it just works.
    - magicalhippo 1y ago
      Blind as a bat, thanks. Was looking for a pricing page or similar, totally scrolled by that box which looked like marketing fluff.
  - bigfatkitten 1y ago
    > That said, air-gapped is a hefty requirement, so perhaps those customers are predominantly large? There are lots of very small classified networks out there with only a few dozen users. There are a lot more user communities course that aren’t necessarily airgapped, but where they have special compliance requirements that pretty much mandate self hosting (or at least bring-your-own cloud.)
- jasondc 1y ago
  $$$$ Very expensive
- bpt3 1y ago
  It might as well be for the vast majority of companies, since I believe the smallest number of users you can buy support for is 500. To be more specific, they killed off the legacy Jira Server and now only offer these enterprise versions of Jira and the rest of the suite if you won't move to the cloud.
- thaack 1y ago
  Sure if you commit to a 500 user minimum.
- bowsamic 1y ago
  Atlassian actually threatened to sue our company if we didn't move from on-prem to cloud. I imagine they're doing the same to others
  - GabeIsko 1y ago
    There has historically been massive investor and shareholder pressure for companies to show "Cloud Recurring Revenue" and multiple wall street analysts will start issuing higher price points for your stock based on this, and eventually large institutional investor adjust their positions accordingly. I like the cloud for a lot of reasons. But, making your software worse to make your stock price higher seems like a loser for everyone long term.
magicalhippo 1y ago
> Turns out when you eliminate all network latency, things get snappy. Same experience with JIRA. I read all these negative comments here and elsewhere about how slow and clunky JIRA was, and I couldn't relate at all. Then I realized all those who complained was using JIRA Cloud and we were using on-prem, and it all made sense. We've since moved to JIRA Cloud ourselves, and I understand now. We moved and none of the new places had any viable computer room, so literally had to put the rack in a closet And well, that ain't cutting it for physical access control these days. Thankfully we have very simple flows without any BS, so not too many 1-5 second clicks to get things done.
- IshKebab 1y ago
  > Then I realized all those who complained was using JIRA Cloud and we were using on-prem, and it all made sense. Even Atlassian doesn't use Jira cloud. Btw it's not "JIRA".
  - magicalhippo 1y ago
    > Even Atlassian doesn't use Jira cloud. That would explain a lot. > Btw it's not "JIRA". When did they change this? I'm fairly certain[1] it used to be JIRA. [1]: https://confluence.atlassian.com/jira061 https://confluence.atlassian.com/jira061
    - eastbound 1y ago
      In 2013, to be specific.
  - joeldo 1y ago
    That's no longer the case - a large portion of teams are now using cloud variants of Confluence/Jira.
  - tomrod 1y ago
    What a weird time to enforce British rules for acronyms. JIRA stands for JIRA Isn't Really Awesome.
yodon 1y ago
How do you handle compliance in confirming that the product is only used for the license duration? (Or is it more of a one time purchase plus recurring fee for updates?)
- viharkurama 1y ago
  It's a subscription license. We offer air-gapped deployments under the Business plan. As part of compliance, we request customers to share license logs quarterly-no PII involved. Also, the license enforces seat limits, so you can't exceed the number of users you've purchased. https://plane.so/pricing https://plane.so/pricing
- Msurrow 1y ago
  At this level (govt, 6 figure+ deals) I would at least consider if this problem should have a non-tech solution, and instead have a legal/lawyer solution. In my experience (not US based though) the govt contracts are under compliance programmes as well so the govt agency’s legal/contract mgmt team would probably follow up internally on expiring contracts (ie licences) and require the owning stakeholder to either renew the contract or abandon the software. Meaning the customer would supervise itself regarding licence. But even if you don’t want to rely on self-supervision then having your lawyer spend 1 hour reaching out with a “do you need to renew your licence” at the end of a licence term would probably be much cheaper than building and maintaining an air-gapped licence solution.
  - bobmcnamara 1y ago
    Years back a friend of mine's startup failed when USAF pirated their software and the original customer org stopped paying for it. Feds are DMCA immune, so no real recourse.
    - bigfatkitten 1y ago
      Sounds like having only one paying customer was the real cause of the business’s failure.
unixhero 1y ago
Itar ruins all the fun
isatty 1y ago
> The interesting part: our air-gapped deployment actually runs faster than our SaaS version. This is the least surprising thing I’ve read all day.
- jagged-chisel 1y ago
  Indeed. For multiple reasons: - it is not at all surprising that when you remove cruft, code performs batter - it is not at all surprising that this is not common enough amongst software engineers to even consider these things (competing business interests probably cause this often)
  - graealex 1y ago
    Not being connected to the work VPN already slows down my Windows to a near halt since a few unreachable network drives is all it takes to make Explorer go unresponsive. Seems like engineers forget to test these things nowadays.
    - Too 1y ago
      If by ”nowadays” you mean the past 30 years. Slow network drives making Explorer go completely unresponsive has been a thing since Windows 95. I’m more surprised to hear that bug still hasn’t been fixed. Luckily I don’t use Windows myself since many years ago.
- chooma 1y ago
  All year maybe?
- chrisandchris 1y ago
  If they also realize that having less dependencies makes deployment easier we have gone full circle.
  - andy_ppp 1y ago
    I can't believe how many devs think dependancies are completely cost free...
beardedwizard 1y ago
But you didn't tell us how many orders of magnitude more expensive it is to operate :)
white_dragon88 1y ago
[dead]

jasondc 1y ago

Big fan of Plane since it's open-core. Doesn't seem to be a lot of options for self-hosted/open-core project management software. The existing ones looks pretty bad, and don't come anywhere close to Jira level functionality.

majkinetor 1y ago
Redmine is awesome
IshKebab 1y ago
> don't come anywhere close to Jira level functionality. In my experience that's probably a good thing. I've moved from a company using Phabricator to one using Jira. Phabricator had exactly everything we needed and was very nicely designed and worked really nicely. Jira has everything you need plus loads of other stuff that project managers feel like they need to add. Oh and they'll never clear anything up or fix any config bugs because they don't actually have to ever use the "report bug" form so who cares if there are 100 fields and half of the mandatory ones are hidden in "More fields"? 5 different states for "TODO"? Eh who cares. 3 different ways to say which team a bug is in? Better fill them all in for every bug. It's better to be missing features than to have features that project managers can configure.
- jay_kyburz 1y ago
  The first bug you should log is that the bug logging page has unnecessary fields.
- CamouflagedKiwi 1y ago
  I've used both as well, I found Phabricator fine for lightweight kanban-style team work tracking, but once we had PMs it was doomed because it would never do what they wanted (they didn't seem to be able to understand that it was not a Scrum system and would never match well). These days I'd be using Github instead, issues there are also nice and simple. I imagine it would ultimately suffer the same fate in a similar situation though (not that I intend to get there ever again). The problem with Jira is that it's so customisable and always ends up being customised by "process people" who think all problems can be solved by adding just one more field - but simultaneously it's never possible to customise your bit to work the way you want.

hd4 1y ago

just a fyi for anyone looking for a neat little kanban board, gitea has kanban built-in into the projects feature. (obviously lacks really fine-grain customization that would be found in other jira alternatives)

acidburnNSA 1y ago
And the gitea fork, forgejo does too.

zppln 1y ago

Ehm, fairly sure you can use Jira in an air-gapped environment.

deleted 1y ago
[deleted]
jasondc 1y ago
from Google: "Atlassian has sunsetted its Server product line, including Jira Server, meaning they are no longer supported and users need to migrate to Cloud or Data Center versions. Specifically, support for Atlassian Server products ended on February 15, 2024. This includes the end of new license sales, renewals, and security updates for Jira Server. "
- deleted 1y ago
  [deleted]
- kingnothing 1y ago
  There's the self-hosted Atlassian Data Center product. https://www.atlassian.com/enterprise/data-center https://www.atlassian.com/enterprise/data-center They also offer Government Cloud. https://www.atlassian.com/government https://www.atlassian.com/government
  - mschuster91 1y ago
    You'll pay through your nose for a Data Center license though, and it doesn't change the fact that Jira is a mess so slow that SAP can appear fast in comparison.
- firesteelrain 1y ago
  Data center version is available. I use it.

firesteelrain 1y ago

Jira has a self-hosting option. It already is air gap ready. See Jira Data Center. 1. https://www.atlassian.com/enterprise/data-center/jira https://www.atlassian.com/enterprise/data-center/jira

Disposal8433 1y ago

There is no price anywhere. I would be interested to use that for either my job or for private projects, but where and how much do I pay? Edit: I looked again and even your pricing pages have no price. I understand that you may want to restrict yourself to rich companies, but I don't understand the point of posting on HN if that's the case.

pc86 1y ago
Air-gapped probably adds a zero or two to the highest tier Enterprise price. You wouldn't buy an Enterprise license for a personal project, why would you buy an Enterprise++ license (which is essentially what AG is)?
- jasondc 1y ago
  It's part of the Business tier on the pricing page here: https://plane.so/pricing https://plane.so/pricing
viharkurama 1y ago
If you want air-gapped it's on Business tier, please look at our pricing page. That being said, we don't recommend the air-gapped version for personal use. Instead, you can use our open-source Community Edition here: https://github.com/makeplane/plane https://github.com/makeplane/plane — you can self-host it and disable telemetry entirely.

intexpress 1y ago

A version of JIRA that nobody can access sounds pretty good

whatbackup 1y ago
Almost choked on my coffee - cheers

thedonkeycometh 1y ago

[dead]

thedonkeycometh 1y ago

[dead]

psychoslave 1y ago

[flagged]

movedx 1y ago
You'll always find that this industry of ours just goes around full circle.
tptacek 1y ago
I don't think this cynicism is productive. I've had the pleasure of shipping "regular local applications" several times over my career, and to do it you lose a lot of very basic stuff that modern developers take for granted, most importantly software update and debugging telemetry. It's not a small thing to take a SAAS product and bundle it up like this, and most users don't benefit from it, so it's also not a natural starting place.
- psychoslave 1y ago
  This mood produced this comment and some answers to it, and we can guess some thoughts in the process, but I wouldn't call it cynicism. There is a difference between using irony to rail the grandiloquence with which something is presented and harsh critics of the thing itself or the intention behind producing the thing itself. Engineering is all about trade-offs, so "nothing is granted without paying some constraint acceptance" is the only fundamental baseline.
ricardobeat 1y ago
Local apps usually still require installing dependencies from the network, call home for updates, use cloud storage or sharing, and may send telemetry data. Different levels of strictness.
- psychoslave 1y ago
  No, local apps can be installed from a local storage just plugged for the occasion, with all its dependencies included. Local application is local, it doesn't deal with network in any way, except if end user goal require to send/receive some external information. So a calculator or a solo game doesn't require network at all, but a chat app or some MMORPG have a legitimate need to access network, but only to communicate with other users. Telemetry is just an other word for spying. Spyware integrated used to be considered a clear sign of malvolonte project. Software update can be put as a separated concern.

radicaldreamer 1y ago

This is just shipping a docker container for people to run the app on their own infrastructure. Retool does the same thing for companies which don’t want to expose internal resources and databases to the cloud.

axus 1y ago

Any more details about the offline patch/upgrade process? When I looked at gitlab years ago, it handled that fine but the documentation seemed "nervous" about it.

viharkurama 1y ago
You'll find all the docs here: https://developers.plane.so/self-hosting/methods/airgapped-edition https://developers.plane.so/self-hosting/methods/airgapped-e...
mdaniel 1y ago
I struggle to think why that would be any drama, unless the setup is trying to use "bare" gitlab (e.g. running the puppet commands manually versus $(docker save -o airgapped_gitlab.tar gitlab/gitlab-ce:18.2.0-ce && cp ./*.tar /dev/disk/usb-whatever/goodluck/))

miki123211 1y ago

TBH, if I were working in such a highly regulated industry, I'd be very hesitant about buying software from a company with a .so domain and basically beholden to the whims of the government of Somalia. If they said "implement a backdoor for us or all your non-airgapped customers lose access tomorrow", are you sure the company would be able and willing to say no?

mdaniel 1y ago
That's a very odd thing to bring up in the context of self-hosting, since you would not interact with their .so domain whatsoever; ensure that the AGPLv3 aligns with your needs, git clone -b v0.27.1 https://github.com/makeplane/plane.git https://github.com/makeplane/plane.git and be happy
devanshuarora 1y ago
Totally fair to ask. .so is widely used by software companies as a domain availability solution - think Notion. For regulated environments, the domain doesn’t matter, the architecture does. With air-gapped deployments, Plane doesn’t rely on any external DNS or domains — .so or otherwise. No license pings, no telemetry, no outbound calls. Everything runs in complete isolation, and customers have full control over the environment. Also worth noting: Plane’s open-source core (AGPLv3) allows for full transparency and auditability. So any notion of a backdoor is counter to how we operate — and how our users deploy us.

annoyingnoob 1y ago

Now do an air-gapped Confluence killer, please.

kevlened 1y ago
https://github.com/docmost/docmost https://github.com/docmost/docmost
viharkurama 1y ago
We already support this. We pack all our products in one single offering. This includes Projects + Wiki. More here: https://docs.plane.so/core-concepts/pages/wiki https://docs.plane.so/core-concepts/pages/wiki Here's a blog on how you can switch between products within Plane, https://plane.so/blog/introducing-apprail-plane-new-navigation https://plane.so/blog/introducing-apprail-plane-new-navigati...

rendall 1y ago

> This post explores the journey of building this specialized deployment option for regulated industries where data sovereignty isn't just preferred—it's mandatory. This is an AI writing tell: "It's not just x—it's y." https://youtu.be/9Ch4a6ffPZY https://youtu.be/9Ch4a6ffPZY

kstrauser 1y ago
I loathe every cheap throwaway comment like this. Know who else uses punctuation? People who write. In fact, that's where the AI got the idea.
degamad 1y ago
It's an AI writing tell that was copied from so many of us who use it.
- rendall 1y ago
  Literally no one use that construction with an em dash unless they are using AI to write their copy.
devanshuarora 1y ago
To be fair, “not just X—it’s Y” showed up in product marketing way before AI started parroting it. Just saying. :)
- rendall 1y ago
  Indeed. Marketers took the time to find the key combo that places an em dash. No one else does that. Except AI. It’s not just a typographic choice—it’s a tell!
  - dragonwriter 1y ago
    > Marketers took the time to find the key combo that places an em dash. No one else does that. Pretty much everything that is professionally published does, and lots of people who care about typography do, that.

tptacek 1y ago

Given their customer base, I wonder why they bothered with any license enforcement for the pure on-prem. Just do the "license enforcement" implicitly when customers want to update: they need to log in to get the new image. (Your regular annoying notice that FIPS-compliant crypto is, if anything, marginally less secure than non-FIPS crypto; not that it matters in any material way, just, it's not a flex.)

0xWTF 1y ago

As a DoD employee, it would be amazing if more companies took this seriously (I'm looking at you health tech bros).

polski-g 1y ago
It was shocking, talking to the Jira rep. They basically said they didn't want this sector's business.
WaitWaitWha 1y ago
No, no you do not. A week into installation, your cube mate will be complaining that the arrow keys do not work as used to and cannot use alt-tab on the fields, or the color orange and green make their eye hurt. So a ticket is opened, a software update is made, and then the patch is generated. That is 12 month on a good day because all the back track, re-validation, scope creep, auditing, re-validation, third party review, committee blessings, and good idea fairies. Then you have to get the patch into the environment. Now you need a blood oath from the entire chain of command up to Katie A. where she swears she is going to beat you if you whine about the color scheme again. ;) Three years past, and the changes are implemented. It does not matter because your monitor which had to be TAA compliant and could not be brought in without you soldering everything together is now running off of a hercules video card, yes that green only hercules card. You see only shades of green in the app...
devanshuarora 1y ago
Really appreciate that — and totally agree. We’ve been surprised by how many teams in defense, healthcare, and critical infrastructure are still stuck choosing between bloated legacy tools or cloud-only products that don’t check the right boxes. We built the air-gapped edition of Plane exactly for this.
vanschelven 1y ago
I do take this seriously (see link in my profile), but have to admit that doing so isn't an automatic entry tickets to places like the DoD

lifeisstillgood 1y ago

I guess my mental model is all wrong but those air-gapped choices - they seemed kind of what is natural to do …

Pi9h 1y ago

I am also building https://docmost.com https://docmost.com, a self-hostable Confluence alternative that can run fully air-gapped. It has support for spaces, real-time collaboration, a rich-text editor, built-in diagrams support and more. We launched on HN 1 year ago: https://news.ycombinator.com/item?id=40832146 https://news.ycombinator.com/item?id=40832146

mnholt 1y ago
What does your enterprise pricing look like?

duffpkg 1y ago

This also makes it infinitely more useful for healthcare. Not healthcare software specifically. Lots of use cases in logistics, irl maintenance, etc. Patient data creates hipaa challenges and tends to overflow into any system.

viharkurama 1y ago
+1. We already work with a few healthcare teams, and self-hosted is almost always their go-to. Our air-gapped edition has been in beta for a bit, and we’re seeing more use cases pop up—especially in places where HIPAA and data isolation matter a lot.
tptacek 1y ago
Why would a health care org care about air-gapped deployments? Most (really, almost all) health care data is stored on cloud SAAS databases already; for people who care, this vendor already had an on-prem version.
- SMrF 1y ago
  What you say makes sense, but I think there can be reasons. For our military customers we offer an air-gapped version of our app early on because it was easier for customers than getting an ATO. Also as a bootstrapped company it was a lot cheaper than FedRAMP. I'm guessing I'd lean on a similar strategy if I had a health care startup.
  - tptacek 1y ago
    Most health care companies get along just fine in AWS, just for what it's worth.
mannyv 1y ago
Nothing in HIPAA mandates air gaps. In the context of HIPAA that's really overkill. In fact, self-hosting might even do you wrong when things go bad, because AWS is probably better managed and more secure. And they have all their certs, which is legally important.

mind_heist 1y ago

This is totally a tangential point. Why do they call it "air gapped" instead of "air tight" ? Are these supposed to mean different things ?

dummydummy1234 1y ago
Airgapped systems have an air gap between the system and the wider world. The only way to move data to and from them is for someone to walk across the gap with physical media. There are no communication cables between the host system and the wider world.
- defrost 1y ago
  There are other ways, of course. * air-gap malware can be designed to communicate secure information acoustically, at frequencies near or beyond the limit of human hearing. * In 2014, researchers introduced ″AirHopper″, a bifurcated attack pattern showing the feasibility of data exfiltration from an isolated computer to a nearby mobile phone, using FM frequency signals. * In 2015, "HELLONE", a covert signaling channel between air-gapped computers using thermal manipulations, was introduced. "BitWhisper" supports bidirectional communication and requires no additional dedicated peripheral hardware. * Later in 2015, researchers introduced "GSMem", a method for exfiltrating data from air-gapped computers over cellular frequencies. The transmission - generated by a standard internal bus - renders the computer into a small cellular transmitter antenna. https://en.wikipedia.org/wiki/Air-gap_malware https://en.wikipedia.org/wiki/Air-gap_malware
  - h4ckerle 1y ago
    Don't forget Stuxnet which crossed the airgap via infecting USB Devices. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
    - defrost 1y ago
      Not forgotten at all, deliberately unmentioned as I focused on crossing the air gap by means other than: The only way to move data to and from them is for someone to walk across the gap with physical media. Stuxnet was walked across via physical media (USB drives).

colordrops 1y ago

Most self-hosted apps, including jira, can be airgapped. Yeah maybe it's not made super easy like Plane, but any org that requires this is going to have an IT department that can handle it.

rubidium 1y ago

They make it seem like a big deal. It’s pretty much how all software used to ship :)

esafak 1y ago
I've heard they're planning to ship it with printed documentation some time soon!!
devanshuarora 1y ago
Yes, absolutely, in a way, we’re just bringing back the old-school model — full package, zero dependencies, runs on your own infra — but with modern tooling and UX.
vanschelven 1y ago
Both those things can be true at the same time: all software used to ship like that, and shipping like that in the current era _is a big deal_. Spoken as someone who's core differentiator is "self hosted" [0] [0] https://www.bugsink.com/ https://www.bugsink.com/

EverydayBalloon 1y ago

[dead]

doctorpangloss 1y ago

the air gapped Jira alternative for regulated industries is a big white board

devanshuarora 1y ago
We ran our company on a whiteboard, until we couldn't, so I get it. And honestly it does beat a lot of bloated tools out there. But when you need permissioning, history, workflows, audit logs—and your infra lives in a bunker—we try to be the next best thing. Air-gapped, fast, and without the Jira bloat.
- white_dragon88 1y ago
  [dead]

aetherspawn 1y ago

Buy-and-forget perpetual pricing for internal networks, please. Don’t want to pick up annual subscriptions, and don’t want any dependency on a third party company that might not last or will start doubling prices in the future after an acquisition - been burned heaps by that.

tannike 1y ago

HCSB?

tannike 1y ago

HCSB in the image? Copyright dodging?

precommunicator 1y ago

From the table: > Component: Telemetry > Cloud / Self-Hosted: Opt-in analytics > Air-Gapped: Disabled by default What's the difference?

polski-g 1y ago

We use Plane. It's acceptable. Not great, not terrible. Jira wanting 26k per year, per customer we have was unacceptable. I wish their docker deployment was normal (only docker-compose.yml), not a shell script that launches docker. It needs ldap auth and better search capability (fts, boolean, filtering). UI is clunky; everything is editable all the time, so you might end up accidently editing the ticket contents.

deleted 1y ago

[deleted]

treve 1y ago

I just learned air-gapped includes private networks. I was under the impression this strictly meant isolated non-networked computers. Was this always the case or has the term diluted over time?

RandallBrown 1y ago
I think it just depends on the context you're talking about. Air gapped just means there's no connection between two things so it could be talking about networks or individual computers.
tasn 1y ago
In my circles we include private networks going back at least 15 years. So maybe diluted, but if diluted, at least not new.
devanshuarora 1y ago
Strictly speaking, air-gapped originally meant physically isolated, no network connections at all. But in practice, the definition has broadened a bit, especially in enterprise and defense settings. Today, it may include closed private networks with no internet access, still isolated, but with internal connectivity for practical reasons (like backups, logging, or internal auth).
- hgomersall 1y ago
  Pfft! Truly air-gapped would be each key on the keyboard physically unconnected to anything else. True security.
alexb_ 1y ago
I work on an air-gapped network. The most important thing that the words "air gap" communicate is that there is no connection, nothing at all, to anything outside the network. The only way to move anything on or off are using disc drives (no USB for security reasons). The word "private network" does not really communicate that there is a physical gap of no wires at all from the computers on the network and everything else on the internet.

Aeolun 1y ago

I think it’s hilarious that this is something they specifically had to do, and was apparently hard? All my software works fine in completely air-gapped environments.

hmhhashem 1y ago
When you add features such as telemetry, curl calls in install scripts, and in general build on public cloud infra, everything assumes you have internet connectivity. That assumption is so crucial that it is embedded in everything and touches most software components. When you already have an established product, I imagine changing it to remove the assumption without a full rewrite can be tricky.
devanshuarora 1y ago
Yes, agreed, if you build with air-gapped in mind from day one, it should just work. In our case, we had to unwind a bunch of assumptions baked into modern SaaS: license checks, analytics, image pulls, update pings… even small things like font hosting or third-party embeds needed rethinking. Not hard in principle, just a lot of invisible cleanup to make it truly self-contained. Learned a ton doing it.

juliangmp 1y ago

> Even with our robust self-hosted option, we kept hearing the same feedback from legal and compliance teams: "Private cloud" solutions that still require Virtual Private Network (VPN) tunnels don't meet their stringent requirements. If it has a VPN tunnel to some outside server, you shouldn't really call it "self-hosted*

Cthulhu_ 1y ago
Self-hosting implies the software runs on the customer's own servers, but phone-home license checks (or analytics, or whatnot) is not unheard of.

miyuru 1y ago

Looks like they only support single node deployment at the moment. Having worked with airdropped software packaging, next step is a multi node setup.

hamaspiker 1y ago

[dead]

hardwaresofton 1y ago

AGPL continues to be the future of F/OSS https://vadosware.io/post/the-future-of-free-and-open-source-is-agpl/ https://vadosware.io/post/the-future-of-free-and-open-source... Dread it, run from it, AGPL still arrives. Sustainable F/OSS is the most likely to-still-be-active-5-years-from-now kind of F/OSS.

0points 1y ago

"air-gapped" self hosted app. It used to be the default that self hosted apps didn't telemetry and call home. I feel there's more than one self hosted foss jira alternative around already, that of course wouldn't telemtry or call home. Some I used in the past: https://www.redmine.org/ https://www.redmine.org/ https://phacility.com/phabricator/ https://phacility.com/phabricator/ no longer maintained :-(

xorcist 1y ago
Phrabricator lives on in Phorge, which is seeing active contributions. I haven't used Phorge, but Phrabricator is easily my favourite tool among the source code portals. The code review system actually works and does not make me tear my hair out. I am completely at a loss why the commercial side of it seemingly failed after all those years, when products such as Bitbucket and Gitlab seem to do well.

jollyllama 1y ago

We wanted to host on prem a few years ago. Plane was around at the time but didn't look like a mature enough solution. On the other hand, our Redmine instance was far too "mature." We went with YouTrack since it had a highly customizable import plugin for Redmine.

elric 1y ago

I think we have different definitions of the term "air-gapped". Users still very much connect to it using a network. This just doesn't phone home (or elsewhere). A truly airgapped Jira-alternative would be somewhat impractical.

hkchad 1y ago
Why? I use to manage one on a classified air-gapped network, back before Atlassian was all Cloud Based or 'Data Center' license junk. We had Stash, Jira, Confluence, FishEye, HipChat, everything hosted on a non-internet connected network.
beng-nl 1y ago
If the local network as a whole can do work, connect to the Kira-alternative for their work, but the network is isolated from the internet - then it counts as airgapped IMO.

willejs 1y ago

Running software in an airgapped environment is difficult, but the hardest thing is the install, packaging and shipping updates. I have used https://zarf.dev/ https://zarf.dev/ to do this for a government client, and it was an amazing experience. I highly recommend it. K8s seems heavy, but if you want to run datastores with backups (k8s operators), or highly customised environments, and automate all of that, instead of loads of bash and custom code, it shines.

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

time4tea 1y ago

So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources.. Bit-for-bit reproducible builds are definitely doable, but mean including build dates is tricky, and care needs to be taken with archival file ordering. Is this such a big departure from the norm? Curious what constitutes normal!