7 ms·
You make it sound so easy. Any suggestions you've got regarding $800K in revenue in the next year? :)
by emilsedgh 13y ago
You make it sound so easy. Any suggestions you've got regarding $800K in revenue in the next year? :)
- ForHackernews 13y agoHow about hitting up all the multi-million dollar companies that run their businesses on top of OpenSSL?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- tlrobinson 13y agoHow much do you think companies[1][2] would collectively donate in order to try to avoid another Heartbleed? [1] http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/ http://mashable.com/2014/04/09/heartbleed-bug-websites-affec... [2] https://gist.github.com/dberkholz/10169691 https://gist.github.com/dberkholz/10169691
- jbooth 13y agoProbably none, what with game theory and the free-rider problem. Or, as it seems, about $2k.
- patio11 13y agoRounding error in donations, but easily $X0k+ to purchase proactive mitigation. It's not like (without loss of generality) Yahoo is a stranger to paying for engineers, security technology, software licenses, or insurance policies.
- amalcon 13y agoAnyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month (though of course membership in this club is still offered at OpenSSL's sole discretion, and they would be allowed to waive this fee). Google, Amazon, Facebook, and Akamai (off the top of my head) will each pay that without batting an eye; that's $480k/yr. right there. I imagine they could probably get some banks in that club as well.
- talklittle 13y agoThis sounds like it would introduce a massive conflict of interest. Also it assumes the OpenSSL team are the first to know about vulnerabilities. Heartbleed has shown that's not always the case.
- emilsedgh 13y agoDon't you think that does not align with the ethics of 'Open'SSL project?
- cperciva 13y agoAnyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month If I find a vulnerability in code from a project which is pulling this sort of stunt, I will make sure I share details with distributors only under the strict condition that they are not allowed to tell the project about it. Responsible disclosure usually means "start by telling the authors", because usually the authors know who needs to be contacted and will do that responsibly. If they're just going to sell off exploits to the highest bidders, they should have no role in the disclosure process.
- SoftwareMaven 13y agoI'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's about providing details earlier to a group of people who have a strong enough vested interest that they are willing to pay for it and have been vetted as trustworthy enough to allow it. Given how important OpenSSL is to the web's infrastructure (and the many companies who utilize it), I think there would be value in ensuring it has appropriate resources to fulfill that duty. This idea may not be a perfect solution, but calling it a "stunt" is hyperbole, IMO.
- Argorak 13y agoMarketing. Some numbers to compare: Virtus raised 1000 Euros in a month. https://www.bountysource.com/fundraisers/329-virtus-1-0-0 https://www.bountysource.com/fundraisers/329-virtus-1-0-0 While the lib is an interesting one, it is a fringe library in a fringe space (Ruby). Still, it made half of what openssl made in a year in a month. RVM, one of the Ruby version switchers/installers, raised 50k to fund the main developer a year of work on it: https://www.bountysource.com/fundraisers/489-rvm-2-0 https://www.bountysource.com/fundraisers/489-rvm-2-0 Thats already 1/16th of your number. Now, OpenSSL is _far more important_ than both of these but still doesn't manage to get funds? Sounds more like they just hope people to come because they want to.
- droopybuns 13y ago1) They need to form a 501c3. 2) They need to coordinate with fortune 1000 companies to get their company listed as a United Way alternative. 3) They need to campaign the nerds in the tech community whose companies do United Way donations and ask that their donations are directed to the OpenSSL foundation. This solves 2 problems: 1 is the immediate need for cash, and 2 is a reliable cash flow. We donate monthly. I currently give to a cancer non profit and a local hacker space. I would move my donations away from the hacker space for the foreseeable future of the OpenSSL guys did this.
- mncolinlee 13y agoA 501(c)(3) is expensive in legal work. Unless they can find a pro-bono lawyer, this puts the plan in the "it takes money to make money" category. Then it still doesn't guarantee they'll increase donations without marketing so people know about it. Until Heartbleed became public, I imagine few companies were aware that OpenSSL had so few resources and such great needs. They definitely need to capitalize and hope the bad press doesn't make large companies seek an alternative.
- pyre 13y agoI dunno. I think the effort might be worthy of the EFF's time if they have the expertise. I don't think that any EFF donors would be upset that they spent time to help OpenSSL setup a non-profit.
- wildgift 13y agoThey could join another nonprofit.
- cwilson 13y agoNot only this, but there is delay/wait-list of over a year to get your 501c3 status approved at the moment.
- davidw 13y agoThe Apache Software Foundation is one of those. Here are some of their (our) public numbers for 2012-13: https://www.apache.org/foundation/records/990-2012.pdf https://www.apache.org/foundation/records/990-2012.pdf
- leoc 13y agoI'm less sure how OpenSSL can pull in large revenues on an ongoing basis, but I can tell you how it can easily attract significant money right now: do some bloody fundraising over the next few days or weeks! Just structure it as a crowdfunding drive and stick it up on Kickstarter or whatever for minimum hassle. (You might have to do a bit more work to also avoid tax, I don't know.) If they've attracted €3000 so far in donations without lifting a finger, imagine what they could do if they actually went out to capitalise on the publicity and the unhappiness generated by Heartbleed over the past few days. For that matter, a third party could do the Kickstarter, just as long as people can trust him/her/it not to run away with the money. I previously suggested giving the money to the Internet Bug Bounty pot instead of to OpenSSL itself https://news.ycombinator.com/reply?id=7566208 https://news.ycombinator.com/reply?id=7566208 but obviously money could go to either, or to other relevant good causes.
- lsc 13y agosomeone below suggested hitting up all the multi-million dollar companies that use openSSL. A now deleted response said something to the effect of "sure, that's easy. I'll just call up the purchasing department." I don't know a lot about large companies, but I do know a little about getting small companies to give you money. Small companies are cheap, but there are a lot of us, and if you only need $800K, well, that is 800 companies donating a grand a year each. There are many thousands of small technical businesses who can afford a grand a year. So. First problem, for a small company? You need to give us something to buy. This helps out tax-wise, and it also makes the deal feel better. Hell, you can call OpenSSL a for-profit at that point, which means little paperwork for you, and if you pay out everything you get as salary, you have to pay the same payroll taxes on that either way anyhow, if I am not mistaken. So, what can the OpenSSL people sell me without causing a conflict of interest? How about advertising? maybe give me a website badge. "OpenSSL sponsor" maybe with a silver/gold/bronze or something (or maybe even just the amount) - Also put me on the sponsors list on the OpenSSL website with a link to my website and maybe my tagline or a logo at the more expensive levels. I'll take the grand out of my advertising budget and it's all above-board tax wise for me, and the paperwork is easy. I've bought advertising before.
- logicallee 13y agoThe problem isn't a lack of >I'll take the grand out of my advertising budget and it's all above-board tax wise for me, and the paperwork is easy. I've bought advertising before. It's a lack of, >I'll call up and close 800 businesses for you and keep track of invoicing them. As well as do product management on getting something together that is something they can support. I don't need any resources.
- lsc 13y agoAt this level, I wouldn't call anyone. In my experience, the best publicity is news stories written by other people. Many years ago, when I was the best ram per dollar deal around, a blogger's benchmark that made the reddit and hn front pages took my business from almost nothing to "I can quit my dayjob" money in a very short period of time. I bet if the OpenSSL folks announced this soonish, the sales work would be done by the media. In fact, I think this is the big advantage of the low-dollar small-business accounts. You can say "here is the deal, take it or leave it" and wait for people to take it. For the big corporate deals, you have to meet and call and actually sell. And for invoicing at this scale, use cashflow accounting. The sale closes when you receive payment. There will be some work matching up checks to logos, but at $1000 a pop, the 5% of customers who don't write the account identifier on the check are worth tracking down. You do need to do accounting, but you need to do accounting at the current $2000/year level, too. I don't think they are committing themselves to all that much extra work if they only get a few buyers. I have... intimate experience with the "I got too many customers before I had sufficient automation" problem... and yeah, it is a problem when you have $50/yr customers. It is not a problem, I think, when your smallest customers are $1000/yr.
- microjesus 13y agoThey need to bring about exposure and awareness. Although I use it obviously daily in work and in life; I have never even thought of nor been propositioned to donate. I had no idea that it wasn't being supported by a large company. Call me naive, but they need awareness. Paypal fees!? :) donates to foundation.
- microjesus 13y agoIs their web site ... for real? Who would donate $10 etc when it seems at first pass as if they only entertain massive donations. Hmmff.
- AJ007 13y agoI'm not sure about $800k a year, but taking a page from Tarn Adams, OpenSSL should be able to raise at least $2k a month by: Sending donors one of either: a) a short story b) a picture drawn in crayon
- tetha 13y agoUpvoting because I think people misunderstand the nudge here: Dwarf fortress does both of these, and easily pulls in more money than OpenSSL by average. Sometimes up to twice as much if they just had a big release. (Which is - regardless how good dwarf fortress is - a shame).
- EGreg 13y agoYou're asking like it's the first time an open source project was sponsored by large corporations. Let's see, what's in it for google just in terms of PR? Developers it can attract? Ways it can get webmaster mindshare?
- Tloewald 13y agoHow about: 1) Simple redesign of home page, 2) Showing prominent sponsors who've paid more than some amount in the last 12 months (e.g. Google, Redhat, Akamai), 3) And leading contributors 4) And news other than vulnerabilities (e.g. code fixes, new tests, etc.) It might not net $800,000 per year, but it would probably help.
- deftnerd 13y agoAnyone here run a SSL certificate provider? Just make a new line of certs that cost 3 times as much but donates the overage to OpenSSL. Lots of corporate IT people can get away paying $300 for a cert and know $200 of that is going to a good cause.
- QuantumChaos 13y agoReally? That sounds like something you would get in trouble for in most places. It's not for the IT employee to effectively give away the companies money by buying something for more than they have to spend. The decision to donate to a good cause is usually made by other people in the company.
- wildgift 13y agoI think it's a good idea. Cert prices vary, and there are reasons for it, and companies would rather pay for stability than save money.
- QuantumChaos 13y agoBut you are not paying for a service, because funding OpenSSL is a classic free rider problem: the company would be better of not funding OpenSSL, even though all companies would be better off if they all funded OpenSSL. By that logic, the tax accountant could argue that they should arrange a company's finances so they pay more tax, in order to pay for more "stability" by funding the government.
- robryan 13y agoDoes it matter about everyone else though? Your company values rock solid encrypted communication and it willing to pay a premium to ensure this it remains rock solid. The fact that everyone gets it is just a side effect of that.
- QuantumChaos 13y ago