Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Main things to consider when building an app for business/enterprise?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 132 posts

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#91

Post by HarrietJones »

I'm someone who works on mature products in this space. The biggest mistake that people make is they assume that the slow, clunky old fashioned systems that current organisations use are easy to replace. They are nearly always wrong. This is great for me, because I get customers apologetically coming back to me after converting to whatever the ERP de jour is has failed.

If an organisation is using an actively developed custom system that is decades old, then you will need decades of development to replace it. This should be obvious, but I can already feel many people reading this shaking their heads in disagreement.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#92

Post by mooreds »

pclmulqdq wrote: post #87
mooreds wrote: post #51

Earlier quoted context omitted.

Disclosure: I work for an auth service vendor. Great feedback about knowing who the buyer is. Lots of folks think about the user, but knowing the buyer (and they are usually not the same person) is critical too. If you are a building a SaaS, I'd recommend outsourcing your auth, since that is both critical and undifferentiated functionality. There are lots of solutions out there. FusionAuth is one option (I work there…

I'm not entirely sure I agree with this - most auth providers are very expensive, and if you don't need the full-featured offering, you are way overpaying for the engineering time to build your replacement. If you need all the features, it's a good deal, but you rarely do unless you are building something like Notion or Jira. Open source components (Ory) can do the basic cryptography, and if you go completely from sc…

> most auth providers are very expensive

Some are, sure, but there are many that are not.

FusionAuth (again, I'm an employee) has a free community edition ( https://fusionauth.io/pricing?step=plan&hosting=self-hosting ) if you run it yourself with no limits on MAUs, SAML connections, tenants or users. Of course, we have plans that cost money because, hey, we all like to eat.

Auth0 has a basic plan that is free for 7k users. Mostly focuses on username and password, but is entirely adequate for getting started.

Ory (suggested elsewhere in the thread and by you) is OSS and free. Again, you have to operate it, which isn't free, but you get the benefits of upgrades and a team focused on auth.

Keycloak has a lot of features and is free if your run it yourself.

Supertokens has a basic plan that is free for 5k users.

There are many more, as well. And that is to say nothing of the OSS libraries (like devise/omniauth) which you can leverage.

Coding this from scratch seems like an enormous waste of time for something that is not typically a differentiator. At the least, use an OSS library or auth service and limit yourself to the features you need.

Customers pay for features, not for auth. Auth is just the front door to the application.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#93

Post by mooreds »

sebmellen wrote: post #89
mooreds wrote: post #84

Earlier quoted context omitted.

Do you mean to use Ory Kratos in a self-hosted manner? From a brief look it seems like you aren't rolling your own auth when you use this, but rather integrating it into your application. What am I missing?

Kratos is not a complete Auth solution - if you self host you still need to write your own UI. We built another layer over it to handle RBAC and organization management. But at least Kratos covers all the complex crypto and security items related to authentication (not authorization, which I consider to be a part of “auth” writ large).

Gotcha. There are still security concerns with the UI, but I agree, offloading the heavy lifting of password hashing, preventing enumeration attacks, and algorithm selection to a dedicated system makes sense.

Authorization is a whole other ball of wax. You can sometimes get by with RBAC, but it is far more often entangled with business logic. I've seen a set of new companies that offer outsourced authorization like permit.io and cerbos, and for an app of a certain complexity, think they are worth evaluating.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#94

Post by moneywoes »

mooreds wrote: post #51
vishnugupta wrote: post #40

I was heading tech and product of a SAAS software for ~15 months so writing this from that experience. - Who is the buyer? Typically they are not same as the user of the product so understand what they look for in similar products. - SSO, preferably SAML based. - As for security, take care of OWASP top-10 [1] and you should be covered for app-sec. - Implement RBAC. Make it easy to add/manage users for an admin-user.…

Disclosure: I work for an auth service vendor. Great feedback about knowing who the buyer is. Lots of folks think about the user, but knowing the buyer (and they are usually not the same person) is critical too. If you are a building a SaaS, I'd recommend outsourcing your auth, since that is both critical and undifferentiated functionality. There are lots of solutions out there. FusionAuth is one option (I work there…

What about next js auth

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#95

Post by moneywoes »

x0x0 wrote: post #53
vishnugupta wrote: post #40

I was heading tech and product of a SAAS software for ~15 months so writing this from that experience. - Who is the buyer? Typically they are not same as the user of the product so understand what they look for in similar products. - SSO, preferably SAML based. - As for security, take care of OWASP top-10 [1] and you should be covered for app-sec. - Implement RBAC. Make it easy to add/manage users for an admin-user.…

Background: cofounded an enterprise saas company. I like this coverage of tech, though it's missing soc2 which will be required. And 27001 eventually. I disagree on making it easy for admins to add users. Just don't: rather, implement (a bit of) scim or jit user creation with the idp flows. The big thing it's missing is sales. This software is sold not bought. In any sales process with 3 different constituencies (use…

How did you build your sales skills and get those first 10 customers?

Like I want to Build a property saas should I start prospecting first

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#96

Post by mannyv »

Enterprise software is different from business software.

Enterprise scale stuff has different requirements than just business software. In general enterprises have scale problems and demand you integrate into their workflow.

Never design enterprise software unless you have a domain expert and a customer in hand. Their requirements will make it impossible to do anything else.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#97

Post by mooreds »

moneywoes wrote: post #94
mooreds wrote: post #51

Earlier quoted context omitted.

Disclosure: I work for an auth service vendor. Great feedback about knowing who the buyer is. Lots of folks think about the user, but knowing the buyer (and they are usually not the same person) is critical too. If you are a building a SaaS, I'd recommend outsourcing your auth, since that is both critical and undifferentiated functionality. There are lots of solutions out there. FusionAuth is one option (I work there…

What about next js auth

If it fits with your tech stack, definitely worth evaluating.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#99

Post by ianpenney »

What happens when your unencrypted laptop gets stolen or lost?

Go read the Cloud Security Alliance’s CAIQ questionnaire. There’s much more to serving enterprise than just your code quality and cloud platform. You need to operate the business in a safe way.

Re: Ask HN: Main things to consider when building an app for business/enterprise?

#100

Post by konha »

gizmo wrote: post #72
konha wrote: post #43

Earlier quoted context omitted.

The obvious solution to all these problems is to not implement them yourself and use a platform like Auth0 or WorkOS.

That’s a solution only from a business perspective. Some of these SSO platforms have a “move fast break things” attitude to software development and a security track record to match.

> That’s a solution only from a business perspective.

That’s not the worst perspective to prioritize when building a B2B SaaS product.

You’re right of course about the risk / the trust you’ll have to put into a third party.

Post reply on HN