Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When 'open core' projects reject contributions for competing with the EE

github.com

Post reply on HN
Print view View original

171–180 of 202 posts

Re: When 'open core' projects reject contributions for competing with the EE

#171

Post by sowbug »

LegibleCrimson wrote: post #147
sowbug wrote: post #143

Earlier quoted context omitted.

The same is true of any successful open-source project, isn't it? Almost all popular projects are used by for-profit companies, regardless of who owns the copyright on the code.

I feel different about fully open source projects. You are working for free for the benefit of the company, all other companies who want to use it, and the rest of the world. I'm happy to work for free when it benefits everybody equally. I don't care that for profits benefit, because they all benefit potentially the same amount. It's a boon for the world. With open core, you're working for free for the benefit of the…

What I'm hearing is that you object to cases where the entity exerting the most control over the direction of an open-core project has an incentive to restrict the project in favor of something else the entity also controls -- usually their non-open project.

It's a reasonable position, but I can imagine open-core projects that aren't conflicted this way, and open-source projects that are.

Re: When 'open core' projects reject contributions for competing with the EE

#173

Post by pydry »

gtirloni wrote: post #79
pydry wrote: post #23

Earlier quoted context omitted.

Situations like this one bring out the difference between people who want open source to be supported and those who just want a freebee.

The PR author apparently didn't want a freebee and actually spent time contributing.

The PR author had an expectation that their PR deserved to be merged.

The people who agree with that are the ones who see FOSS as a freebie.

Re: When 'open core' projects reject contributions for competing with the EE

#174

Post by kuschku »

gehen88 wrote: post #158
arcfour wrote: post #6

Ah, the SSO tax. We only care about security if you pay us, even if you implement it yourself.

SSO is not a requirement for secure software. It’s a requirement for enterprises because otherwise they have to manually keep track of everyone’s accounts everywhere, but that’s a management issue not a security issue (unless managed poorly). Admittedly for many SaaS and OSS offerings SSO is an enterprise-only feature while it doesn’t have to be, but it’s the best discriminator they have to separate cheaper plans fro…

For software to have secure authZ/authN, it should have robust 2FA mechanisms including WebAuthn, properly integrate with access tokens, and support scoped third party access.

Most software only offers simple username/password auth, or a paid SSO option as the only way to get 2FA working. And SSO makes it much easier to revoke access or change passwords if necessary.

I'm running hundreds of services self-hosted just for myself and less than a handful of close friends. I'm using SSO for all of them.

I had to patch SSO into countless services and I actively maintain forks with self-reimplemented enterprise features for almost half of them.

I had to do similar changes to get S3 support, as I use the AGPL version of Minio as storage backend for everything so I only have to setup backups in a single place.

The only reason one could try to argue that these are enterprise only features is if you assume personal users have no need for 2FA or backups.

Re: When 'open core' projects reject contributions for competing with the EE

#175

Post by kuschku »

IshKebab wrote: post #163
dugite-code wrote: post #110

Earlier quoted context omitted.

> only enterprises care about SSO. Well that's just fundamentally not true any longer with OIDC. There are even simple OIDC auth plugins for reverse proxies now. It's what I consider a fairly basic feature in this day and age and it's a shame every time it's disregard as simply an enterprise feature You might have an argument with saml, because it's a right pain, but not OIDC

I don't really follow. If you're setting this up for a couple of people you can just manually add accounts. It's probably even easier than setting up OIDC or whatever. It's only when you get to enterprise level and IT departments want centralised accounts that it matters. They really need SSO. Frankly I think it's a pretty great status quo. Consider the alternative, which is that the software would either not exist o…

If only enterprises need SSO, please tell me how I'd set up WebAuthn 2FA for these services without SSO.

Also, please explain how I'd change my password across this project, miniflux, seafile, postfix, dovecot, radicale, quassel, synapse and more all at the same time without SSO (in case the password got leaked)

So far, using keycloak and adding SSO support to these apps seems certainly like an easier option even for setups with 3-5 users such as my own.

Re: When 'open core' projects reject contributions for competing with the EE

#176

Post by kuschku »

lukaszwojtow wrote: post #108

I guess they can fork that "open core", introduce that feature, then maintain it themselves forever. Pull changes from original open core and their "open" branch will be better than original. Of course they don't want this work. They want the company to maintain it instead.

And that's how I ended up forking dozens of projects spending a lot of my free time just maintaining my patches.

Still better than having to give in to this open core enshittification.

Re: When 'open core' projects reject contributions for competing with the EE

#177

Post by dugite-code »

kuschku wrote: post #175
IshKebab wrote: post #163

Earlier quoted context omitted.

I don't really follow. If you're setting this up for a couple of people you can just manually add accounts. It's probably even easier than setting up OIDC or whatever. It's only when you get to enterprise level and IT departments want centralised accounts that it matters. They really need SSO. Frankly I think it's a pretty great status quo. Consider the alternative, which is that the software would either not exist o…

If only enterprises need SSO, please tell me how I'd set up WebAuthn 2FA for these services without SSO. Also, please explain how I'd change my password across this project, miniflux, seafile, postfix, dovecot, radicale, quassel, synapse and more all at the same time without SSO (in case the password got leaked) So far, using keycloak and adding SSO support to these apps seems certainly like an easier option even for…

Heck even in a single user environment like my homelab SSO is the simpler option.

Re: When 'open core' projects reject contributions for competing with the EE

#178

Post by IshKebab »

kuschku wrote: post #175
IshKebab wrote: post #163

Earlier quoted context omitted.

I don't really follow. If you're setting this up for a couple of people you can just manually add accounts. It's probably even easier than setting up OIDC or whatever. It's only when you get to enterprise level and IT departments want centralised accounts that it matters. They really need SSO. Frankly I think it's a pretty great status quo. Consider the alternative, which is that the software would either not exist o…

If only enterprises need SSO, please tell me how I'd set up WebAuthn 2FA for these services without SSO. Also, please explain how I'd change my password across this project, miniflux, seafile, postfix, dovecot, radicale, quassel, synapse and more all at the same time without SSO (in case the password got leaked) So far, using keycloak and adding SSO support to these apps seems certainly like an easier option even for…

You would do it manually. Not the end of the world if you have For an enterprise with hundreds of users, that would mean thousands or tens of thousands of accounts to manage manually. Totally impossible.

It's a feature that's absolutely mandatory for enterprises, but "nice to have" for anyone else. That's why it's a great feature to use for price discrimination.

Re: When 'open core' projects reject contributions for competing with the EE

#179

Post by IshKebab »

danenania wrote: post #167
IshKebab wrote: post #164

Earlier quoted context omitted.

> There may be a queue of 25 other prs/issues/discussions that also need a response. There are 30 open PRs. No other open PR has more than 2 thumbs ups/hearts. This one was open for months. There's zero chance they were unaware of it. They may have thought "ugh that's awkward; let's not think about it", but that falls firmly into "hoping that nothing happens".

Thumbs up and hearts produce no notifications afaik so they could easily be unaware if they weren’t specifically following and checking up on the thread. And a PR being open for a long time could be an indication that it has been forgotten about rather than being purposefully ignored. You could definitely be right but you are also making some big assumptions imo that may not be true.

It has quite a few comments too. You get notifications for those. I'm sorry but there's no chance they didn't notice this. And they didn't even try and use that excuse!

Re: When 'open core' projects reject contributions for competing with the EE

#180

Post by kuschku »

IshKebab wrote: post #178
kuschku wrote: post #175

Earlier quoted context omitted.

If only enterprises need SSO, please tell me how I'd set up WebAuthn 2FA for these services without SSO. Also, please explain how I'd change my password across this project, miniflux, seafile, postfix, dovecot, radicale, quassel, synapse and more all at the same time without SSO (in case the password got leaked) So far, using keycloak and adding SSO support to these apps seems certainly like an easier option even for…

You would do it manually. Not the end of the world if you have For an enterprise with hundreds of users, that would mean thousands or tens of thousands of accounts to manage manually. Totally impossible. It's a feature that's absolutely mandatory for enterprises, but "nice to have" for anyone else. That's why it's a great feature to use for price discrimination.

How do I manually setup WebAuthn 2FA with this project? Please give me a guide.

Because afaict, the only way to get proper 2FA with this project is by paying them for SSO.

Post reply on HN