Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JFrog S-1

sec.gov

Post reply on HN
Print view View original

31–40 of 67 posts

Re: JFrog S-1

#31

Post by wwright »

foxdev wrote: post #14
awinder wrote: post #10

Earlier quoted context omitted.

For me JFrog is synonymous with Artifactory -- I think that was their earliest / bread & butter product? That may just be my interaction. It's an on-premise/cloud hybrid source artifact repository. The nice thing about it is that it is one product that can act as a maven/npm/pip/etc. repo. If you're in a polyglot org (big enterprise) and you have security needs/historical baggage to host on-premise (big enterprise) t…

What is an artifact in this context?

I would define it as a file that is distributed for use among many decoupled hosts and which is generated from some sort of source input.

Packages/libraries such as those used by NPM and Pip are some examples. It may also be an entire program, an OS package, a virtual machine, a Docker image, even things like PNG images.

Artifactory has tooling to make it easy to integrate into typical build pipelines.

Re: JFrog S-1

#32

Post by lovehashbrowns »

nawgz wrote: post #9
secondcoming wrote: post #8

Earlier quoted context omitted.

We use Artifactory to store custom debian packages. Not sure about the rest of their offering

Artifactory is a strong tool. I work for a large multinational with somewhat regressive IT policies, so you can't really use the internet - Artifactory is both a package cache and package manager, working across pretty much every language. I have used PyPi, JS, Java, & Docker artifacts contained in it, so that's pretty cool Also no idea what else they do.

The company I work for uses it for the same reasons as yours. We also have to use it to cache things like NPM and RPM packages. Without that caching, we would be putting a strain on public mirrors. We additionally have a layer of security because we have a system for approving which packages and package versions go into our cache.

They also have an XRay offering for scanning things like Docker containers for vulnerabilities, although for various reasons we do not use it. I wish we did! It would keep things integrated.

The main reason why we use Artifactory, though, is because it allows us to share artifacts across different regions and environments.

The one thing I don't like is how stingy jfrog is with their licenses. It makes automatic deployments of Artifactory a bit difficult for us. Their Mission Control offering isn't enough for the way we deploy Artifactory.

Re: JFrog S-1

#33

Post by oblio »

chromedev wrote: post #25
anunnymouse wrote: post #19

Earlier quoted context omitted.

What about things that arn't built on top of Kubernetes?

Those tools aren't built on Kubernetes, just easier to deploy in a production manner using the official Helm charts.

What if I want to hook up my Maven builds to Artifactory, how does Helm help me?

Re: JFrog S-1

#34

Post by cogman10 »

secondcoming wrote: post #8
thesimon wrote: post #5

I guess I've not worked in big enough corporates to use this. Can any user here provide some context what JFrog does? The website doesn't really say much, the example pipeline files for JFrog pipelines seem more complex than GitLab CI.

We use Artifactory to store custom debian packages. Not sure about the rest of their offering

It's our private maven repo. Works well for that.

Re: JFrog S-1

#36

Post by hinkley »

chromedev wrote: post #12

With Helm, there is no need for Artifactory. You get Harbor, Verdaccio, etc. It is silly to pay a company 100k+ when all this stuff is easily managed using official or far more powerful tools.

I know some HashiCorp customers who are actively maintaining their own wheels (built on top of Consul, no less) that duplicate HashiCorp functionality, badly. I don't know if I will ever understand why people work so hard to accomplish so little.

"To err is human. To really foul things up requires a computer."

Re: JFrog S-1

#37

Post by mbesto »

xfour wrote: post #4

Three S-1's in one day, and the AirBNB prep last week. Is there just light shining, or are these companies worried about the future prospects of the IPO market?

The IPO market was already being prepped but got delayed due to COVID. Since then much of tech stocks not only rebound but are at all time highs. Wall st is seething wanting to buy more stocks that they know can pop and those that have popped are arguably overvalued. (see Zoom)

Re: JFrog S-1

#38

Post by ebabani »

ttul wrote: post #28
xfour wrote: post #4

Three S-1's in one day, and the AirBNB prep last week. Is there just light shining, or are these companies worried about the future prospects of the IPO market?

In addition to what others have said, I think Amazon's Elastic Container Registry is a huge threat to JFrog's prospects. Perhaps they need to IPO now to gain access to the deep pools of capital they'll require to face down the threat from Amazon. Or maybe this is one of those IPOs like SendGrid that is fairly quickly followed by an acquisition.

Both ECR and CodeArtifact are competition from AWS. If you're already using AWS it's difficult to justify the switch to Artifactory, considering you also lose integrations with things like instance roles when you switch.

Re: JFrog S-1

#39

Post by perlgeek »

djhaskin987 wrote: post #24

For those of you looking for an open source alternative to the otherwise fantastic Artifactory product, have a look at Pulp, a Red Hat project that has been rapidly maturing and gaining features over the past two years: https://pulpproject.org/

Does Pulp have proper support for Debian packages by now?

Last I looked, it didn't supported signing repositories (and these days, it's basically impossible to get an unsigned repo into a Debian system).

Re: JFrog S-1

#40

Post by paxys »

jsiepkes wrote: post #13

Though Artifactory is currently still listed as being OSS on their site ( https://jfrog.com/open-source/ ) they stopped publishing the source code after the 7.0 release of Artifactory (somewhere beginning this year). I guess this could be the reason. Having an OSS product is not something investors get thrilled about... Usually JFrog is pretty responsive on StackOverflow though for this particular question they seem…

Rightly so, considering the next step for a lot of such OSS projects is AWS offering it as paid hosted service with zero benefit to the maintainers. So then they have to couple it with a restrictive license which devalues the "open" part.
Post reply on HN