Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We built an air-gapped Jira alternative for regulated industries

plane.so

Post reply on HN
Print view View original

91–100 of 201 posts

Re: We built an air-gapped Jira alternative for regulated industries

#91

Post by SMrF »

tptacek wrote: post #79
duffpkg wrote: post #69

This also makes it infinitely more useful for healthcare. Not healthcare software specifically. Lots of use cases in logistics, irl maintenance, etc. Patient data creates hipaa challenges and tends to overflow into any system.

Why would a health care org care about air-gapped deployments? Most (really, almost all) health care data is stored on cloud SAAS databases already; for people who care, this vendor already had an on-prem version.

What you say makes sense, but I think there can be reasons. For our military customers we offer an air-gapped version of our app early on because it was easier for customers than getting an ATO. Also as a bootstrapped company it was a lot cheaper than FedRAMP. I'm guessing I'd lean on a similar strategy if I had a health care startup.

Re: We built an air-gapped Jira alternative for regulated industries

#92

Post by unethical_ban »

bobmcnamara wrote: post #84
atonse wrote: post #53

Earlier quoted context omitted.

This seems very suspect. Usually you do have recourse via procurement channels and reps. If you file a complaint with that agency stating that they’re using a license without paying for it, it will result in at least an investigation.

https://arstechnica.com/tech-policy/2008/08/air-force-cracks... Hopefully this was fixed, but this was the standing precedent at the time.

As soon as I saw that he put it on the employer machines at his own work before locking down a sale, they'd screw him whether he deserved it or not.

Re: We built an air-gapped Jira alternative for regulated industries

#93

Post by defrost »

dummydummy1234 wrote: post #88
mind_heist wrote: post #87

This is totally a tangential point. Why do they call it "air gapped" instead of "air tight" ? Are these supposed to mean different things ?

Airgapped systems have an air gap between the system and the wider world. The only way to move data to and from them is for someone to walk across the gap with physical media. There are no communication cables between the host system and the wider world.

There are other ways, of course.

* air-gap malware can be designed to communicate secure information acoustically, at frequencies near or beyond the limit of human hearing.

* In 2014, researchers introduced ″AirHopper″, a bifurcated attack pattern showing the feasibility of data exfiltration from an isolated computer to a nearby mobile phone, using FM frequency signals.

* In 2015, "HELLONE", a covert signaling channel between air-gapped computers using thermal manipulations, was introduced. "BitWhisper" supports bidirectional communication and requires no additional dedicated peripheral hardware.

* Later in 2015, researchers introduced "GSMem", a method for exfiltrating data from air-gapped computers over cellular frequencies. The transmission - generated by a standard internal bus - renders the computer into a small cellular transmitter antenna.

https://en.wikipedia.org/wiki/Air-gap_malware

Re: We built an air-gapped Jira alternative for regulated industries

#96

Post by tptacek »

SMrF wrote: post #91
tptacek wrote: post #79

Earlier quoted context omitted.

Why would a health care org care about air-gapped deployments? Most (really, almost all) health care data is stored on cloud SAAS databases already; for people who care, this vendor already had an on-prem version.

What you say makes sense, but I think there can be reasons. For our military customers we offer an air-gapped version of our app early on because it was easier for customers than getting an ATO. Also as a bootstrapped company it was a lot cheaper than FedRAMP. I'm guessing I'd lean on a similar strategy if I had a health care startup.

Most health care companies get along just fine in AWS, just for what it's worth.

Re: We built an air-gapped Jira alternative for regulated industries

#97

Post by acidburnNSA »

hd4 wrote: post #4

just a fyi for anyone looking for a neat little kanban board, gitea has kanban built-in into the projects feature. (obviously lacks really fine-grain customization that would be found in other jira alternatives)

And the gitea fork, forgejo does too.

Re: We built an air-gapped Jira alternative for regulated industries

#99

Post by mannyv »

duffpkg wrote: post #69

This also makes it infinitely more useful for healthcare. Not healthcare software specifically. Lots of use cases in logistics, irl maintenance, etc. Patient data creates hipaa challenges and tends to overflow into any system.

Nothing in HIPAA mandates air gaps. In the context of HIPAA that's really overkill.

In fact, self-hosting might even do you wrong when things go bad, because AWS is probably better managed and more secure. And they have all their certs, which is legally important.

Re: We built an air-gapped Jira alternative for regulated industries

#100

Post by bigmattystyles »

magicalhippo wrote: post #7
viharkurama wrote: post #2

After a U.S. federal contractor told us they loved Plane but couldn't use it due to ITAR requirements, we spent 6 months building a truly air-gapped version. No external connections, no license pings, no telemetry, everything runs in complete isolation. The interesting part: our air-gapped deployment actually runs faster than our SaaS version. Turns out when you eliminate all network latency, things get snappy. This…

> Turns out when you eliminate all network latency, things get snappy. Same experience with JIRA. I read all these negative comments here and elsewhere about how slow and clunky JIRA was, and I couldn't relate at all. Then I realized all those who complained was using JIRA Cloud and we were using on-prem, and it all made sense. We've since moved to JIRA Cloud ourselves, and I understand now. We moved and none of the…

The other thing, every pm wants a custom field just for their project, a field they’ll forget they asked for a day later. TLDR, put a governance board that’s fine saying no especially when someone inevitably pulls rank.
Post reply on HN