Elasticsearch is open source, again

Post by d0gsg0w00f » Fri, Aug 30, 2024, 5:14 PM UTC

FireBeyond wrote: post #388

thelittleone wrote: post #272

Earlier quoted context omitted.

Including the recent trend of access to SOC2 reports requiring an "Enterprise" tier subscription.

Or worse, "SSO" as an Enterprise feature. You're a 2-3 person startup, you set up GSuite, you want to set things up right, oh, "$Call us" for a tier with SSO. Nope, I guess disparate users for now. Not the worst in the world to be clear, but an entirely arbitrary gate, in my experience.

Post by latchkey » Fri, Aug 30, 2024, 5:29 PM UTC

the_duke wrote: post #57

everfrustrated wrote: post #16

Too late, the community all moved over to OpenSearch. I'll never forgive Elastic for locking basic security features behind their paid licence. Over the years probably millions of people had their data compromised due to that (due to people inadvertently leaving instances on the public internet - having auth enabled by default would have helped a lot)

That's hugely overblown. Maybe 20% of the companies I work with have switched.

Post by chihwei » Fri, Aug 30, 2024, 5:49 PM UTC

adrianco wrote: post #257

Here’s the initial AWS response to the license change that they made in 2018, which I helped write. At the time we didn’t think a new license made sense, as AGPL is sufficient to block AWS from using the code, but the core of the issue was that AWS wanted to contribute security features to the open source project and Elastic wanted to keep security as an enterprise feature, so rejected all the approaches AWS made at…

Post by _pdp_ » Fri, Aug 30, 2024, 6:21 PM UTC

julesvr wrote: post #309

thelittleone wrote: post #272

Earlier quoted context omitted.

Including the recent trend of access to SOC2 reports requiring an "Enterprise" tier subscription.

I have the same problem at the moment with Supabase. We're a startup trying to get ISO 27001 certified and need to upload Supabase's SOC2 report to Vanta, but we can't because we're on the Pro tier and they don't give access to that, even after emailing them. It's ridiculous.

Post by lsaferite » Fri, Aug 30, 2024, 7:02 PM UTC

YetAnotherNick wrote: post #393

lsaferite wrote: post #307

Earlier quoted context omitted.

And what of small companies that need things like SOC2 reports from vendors? If you want to work with large companies, being SOC certified makes it easier. Part of that is ensuring your vendors are also compliant with good standards and that's best done with SOC reports.

Getting SOC 2 compliance alone takes ~10k USD apart from vendor reports. Yes they may be small with employee count, but when I said small I just meant someone running something for small set of users for free or close to free. Not someone working with other enterprises.