Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

There's a pretty well recognized trap in the security software space; call it the "IDA Pro Effect". IDA is the industry standard disassembler, easily the most popular commercial reverse engineering tool, certainly licensed by every major security research team. It costs ~$500.

This is a problem: successfully cornering the market for disassemblers and selling to ever security research team wins Hex-Rays literally thousands of dollars!

If you're going to craft a product pitch that appeals to the very high end of the market --- those comfortable with per-host command-line backup who care very intensely about security --- you may need to price way higher than where Colin is today. Of course, then he'll find himself in competition with homebrew PGP+S3 scripts, just like IDA would quickly be replaced by a web UI on "objdump" if Ilfak jacked the price up to $20,000 (which is kind of where it belongs, value-wise).

I'm also wary of the history of "premium" command-line backup tools; remember Bru?

I don't disagree one bit. I'm not entirely convinced it will be successful, considering it is a pretty niche product as far as backup products go and the security value-add isn't really priced according to what very security-conscious people/organizations would spend on the solution. All I was really pointing out is that Colin and you may have different ideas of who the audience here is, in which case some of your advice isn't relevant (yet, anyway); if it's going to be marketed to people who <3 cli then tarsnap is a perfectly good name. Otherwise, something awesome like "Fort Knox Backup Vault 2008" may be more appropriate ;)

For the record: I'm very bullish on Colin's idea; I just don't think he has the positioning and packaging worked out.

Unless he's not out to make money. Some people aren't. He's a FreeBSD dev, after all. Sucker. :P

Don't worry, I'm in this to make money. :-)

I started with *nix and a command-line interface for two reasons: 1. This is what I know, and 2. a CLI can be far more easily used as a component of a larger system.

I'm following a fairly standard startup course here: Build something people want, then build something more people want. I expect a GUI to happen in the future (probably using Qt). I expect a Windows version to happen in the future. I expect tarsnap to be included in web server management interfaces in the future. The name might change in the future, or "tarsnap" might just end up being one of the names like "google" which start out looking dumb but end up sounding normal.

But that's all "easy" stuff -- the place to start is with a solid and secure foundation, which is what I'm doing.

Reply on news.ycombinator.com