Hacker News Reader

Comment by vmatsiiako | Hacker News Reader

We provide all the main functionality completely for free under the MIT license. What this means is that all the integrations (Docker, AWS, Vercel, Kubernetes, Terraform, etc) are available completely to everyone. Next to that, all the features related to secret sharing, and security are also available under MIT.

ee is only reserved for some features that are (mostly) needed by enterprises (e.g., audit logs, sso, advanced access controls). This helps us get the financial means to also maintain the free ope-source product better.

View on HN

I'm not a fan of monorepos in general (though I admit tool support them better in many cases*) but making people download proprietary code makes them worse.

* Especially GitHub. Very opinionated in favor of monorepos.

Audit logging and SSO is pretty basic functionality that requires very little (many people would argue no) additional effort or cost to maintain on the development side.

Surprisingly, audit logging has been deceivingly complex for us. There are many types of events (part of logs) triggered throughout the platform carrying different payloads/formats (e.g. events related to secrets, users, etc.). The variation in such events is increasing with the complexity of the product not to mention costs required to handle accumulating events. Last month, we served 14.2M+ secrets alone through the platform not counting other events — I hope this sheds more light on the audit logging side of things?

Re SSO: Totally get this one and I'm aware of the SSO tax — we're still figuring this one out but know currently that it's an absolute must for enterprises.

You know what you're definitely right about audit logging. It does seem like one of those "easy on the surface, will absolutely kill you in the details" sorts of things.

I know we (WorkOS) have already chatted with you about SSO, but reading this comment I'm realizing we should really also chat about Audit Logs too.

We recently built an entire product to make it insanely easy to offer enterprise-grade audit logs to your customers. Plus it includes strongly-typed event payload schemas and log streaming to 3rd-party SIEM vendors. Super fast to integrated with pay-as-you-go pricing based on volume. Vercel and others are using this.

https://workos.com/audit-logs

I think we have a shared Slack channel set up with Infisical so feel free to DM me there. You can also email me direct: mg@workos.com. (Same goes for anyone else on HN needing this stuff. :))

Actually I've never seen SAML based sso go completely smoothly. There is always some additional support there. That's not the reason everyone charges for SSO, but it is never plug and play.

One of the tenants pricing is you don't charge based on your development cost but based on the value to the customer. So, I don't think it's worth thinking about the complexity of a feature or the cost to maintain in when thinking about pricing besides making sure the maintenance cost is less than what you charge.

Generally, the reason all these companies go and charge for SSO and audit logging is because open core is a land and expand strategy. They offer a free tool that's useful for individual developers, and then when they start demanding enterprise features that means they are integrated into the enterprise and have the opportunity to extract value.

I'm the founder of https://WorkOS.com ("Stripe for SSO") and I can definitely say it takes a lot of eng work to build and maintain. The complexity is fractal as you scale to more and more enterprise users with esoteric systems.

Big fans of WorkOS! Happy to be talking with your team about SSO options for Infisical :)

We built out all our OAuth2 integrations with other platforms (different from SSO but something relatable), so we have an idea of how much work it is to maintain these types of “integrations” and related services… Clearly enough to warrant entire solutions like WorkOS dedicated for this exact purpose.

We just spent about 3 months refactoring our audit logging. If it requires "no" additional effort, you can just fork the project and provide that "no" effort yourself.

The cost to maintain and develop SSO has nothing to do with why it's priced the way it is (very few things in our industry are priced strictly according to cost). SSO costs extra because it's one of the most effective market segmentation tools: the people that require SSO in order to use things are generally (though not exclusively) price-insensitive.

This upsets people, but the larger companies that pay the SSO premium are subsidizing the smaller companies who don't care. I'd rather not pay an SSO tax either, but I'm even less excited about using tools from companies that are going to vanish because they're not generating revenue.

https://sso.tax/

Really strange thing to reply to this with. Did you find it just now and searched for "sso" on HN just to get a chance to randomly post it?

Why strange? That was the first thing that came to mind when I read “sso” as part of the “enterprise’ offering, and was not surprised to see that someone else linked the sso tax website

You're right. I misread the original post and also managed to do a double fail and misunderstand the SSO Wall of Shame as well. Sorry, mbarneyme!

In other words: this product is employing a pricing strategy that is overwhelmingly common in our industry (because it works).

And the industry is sick of it...? At least some vocal minority

Reply on news.ycombinator.com