Ask HN: How do you get developers to trust your product? | Hacker News Reader

Ask HN: How do you get developers to trust your product?

2 pointsAlwaysNewb236 comments

I'm a developer advocate at Doppler (https://doppler.com), and we are a secrets (API keys, certs, etc.) management platform. I create content that's aimed at informing readers about our product. One of the biggest challenges I've encountered is convincing developers to trust our platform in a world of zero trust. Since we store important and sensitive data, we are often asked about how we encrypt data and what we have access to internally (nothing). What hesitations do you have when using a new tool? What do you look for to feel comfortable?

View on HN

I would feel comfortable with a solution that can be self hosted. Every cloud service will be hacked, they deny it first, then they blame the customer, and finally they go under, with half data already on the internet and the other half going to the shredder irrecoverably.

I don't need to this hassle, really. If I self host your cool stuff, I can avoid all of this blame-game.

"Every cloud service will be hacked" - I totally get this. It's the reason it's hard to build trust for a cloud service.

I don't think most developers care about the flashiness of the website, and in some cases I think it's off-putting. Like the sandwich menu, that could (should) be a menu across the top of the screen. You've got that (massive and wasteful) bar up there with nothing on it except a logo and a sandwich menu, and then when you use the menu it takes up as much vertical space as possible (the entire screen, plus some). That means it was designed solely for phones, and that turns me off for reasons I'm struggling to put into words. Like it's not in the right "realm" of software.

Is it even open source? I noticed you have a GitHub, but all the things on your GitHub are only tangentially related to the main program. Just a bunch of CI/CD stuff and whatnot. I might be wrong, but I can't see any way in heck a bunch of developers are going to choose a proprietary password manager. This alone makes me think you've totally locked your product out of this demographic.

Overall I get a product vibe from it. Makes me feel like it's designed to generate profits for a company, I mean you even have a customer testimonials page for crying out loud! I'm pretty sure everyone has realized by now that customer testimonials are just a bunch of brainwashing bullshit, and nobody with an IQ over 7 would fall for them. The security page, which literally has a heading that says "security productized", seals the deal for me, I'm too scared to try it now.

Speaking of security, it doesn't mention whether it's self-hosted or a cloud platform (or maybe I just missed it). Personally, and a lot of other devs are like this too, I absolutely refuse to use a security service that's hosted on the cloud. A password manager should always allow storing locally without any cloud shenanigans.

Thanks for taking the time to write this up. You shared some interesting opinions to consider.

"I absolutely refuse to use a security service that's hosted on the cloud." - I run into this a lot.

Open sourcing it?

Paid version is hosted?

I've always liked this model for my own projects. However, I'm not sure it really builds trust, especially from a security standpoint. Open sourcing could mean more eyes on the code, potentially leading to better security through community audits. Yet, it also means exposing the inner workings to everyone, including those with malicious intent. A hosted version does offer a layer of professional oversight, which is reassuring, but I wonder about the implications for users who opt for the self-hosted route. How would you ensure they feel confident in the security and reliability of the software, knowing that they have the same access to the code as anyone else?

I would love to hear more thoughts on balancing these aspects to build and maintain trust with users.

Reply on news.ycombinator.com