Comment by api | Hacker News Reader

Comment by api | Hacker News Reader

Parent Full thread

Thanks for the response!

I gave up pretty fast on the e-mail option since I had to set up a mail server and it was painful... we use Google for e-mail and it could not use that, and setting up anything else is a many-step time sink.

I did not want sandcats.io but to use this on a private (ZeroTier) intranet. Even for your enterprise offering, which we might be willing to pay for, you still don't have a clear and simple way to auth. For enterprise I have to set up LDAP or other complicated nasty things.

My personal rule for UX:

Each step that must be performed to set something up cuts the adoption rate in half. So if you have an audience of 1000 and 4 steps, 63 people will end up trying your product.

That's not hard science, just a rule of thumb I use to impress upon myself and my team how important UX and zero-config is. It does have some basis in logic. Think of each step as a bit in an integer for 'cognitive load.' Each additional bit increases cognitive load exponentially, not linearly, since the total setup involves the specification by the user of N bits of information.

I'd highlight that there's multiple options here that require less steps, like using Sandcats, or passwordless email login, but that you've specifically decided none of those options are acceptable. So you're specifically looking for the most complicated use case you can come up with, and then complaining there's nothing simpler. ;)

I do like your rule, regarding people "trying your product", but I don't know if it really applies to setting up a server, because setting up a server of your own is probably the worst way to try something you aren't sure you want to use.

I'd suggest that anyone looking to "try" Sandstorm should be looking at Sandstorm Oasis, which is managed hosting you can try for free. (Along with being an easy place to see "live demos" of any of the apps on it.) If you try it on Oasis, and decide it fits your needs, you're much more likely to implement the additional steps required to configure it how you want it on your own hosting.

I don't think I'd ever personally put in the effort to set up something self-hosted until I already had "tried it".

To me the whole value prop of Sandstorm is the idea that we can run our own absolutely independent cloud server. External dependencies for auth or hosting (e.g. relaying everything through sandcats.io) bring us to "well why not just use Google?"

You should give Cloudron a try. It is an absolutely independent cloud server (including sending email).

And as much as Sandstorm helps, running a reasonably secure absolutely independent server is going to take some manner of work. ;)

While there are definitely platforms that work with just a username and password, they are arguably drastically less safe in that scenario.

Could you clarify a bit on that? I might not fully understand what additional security sandstorm gives here. Would those login security issues be mitigated once Cloudron has 2fa implemented?

The whole idea of Sandstorm is to drastically reduce that work.

And it certainly does. I daresay you will not find a self-hosting platform that requires less work to implement but is equally as secure.

In all honestly, Sandstorm without outgoing SMTP configured is not a great experience regardless of how you authenticate. So probably we need to focus on making SMTP setup more automated.

Reply on news.ycombinator.com