Looks cool, but you lost me at the SSO Tax on your pricing page.
1,684 karma · joined January 19, 2012
[1] https://www.hackneys.com/docs/in-the-beginning-was-the-comma...
Product 1 was a coding tool for a low/no code system that is really very good and provides amazing functionality, but most devs (the target audience, really) are - unsurprisingly - put off by the GUI based approach. We built a tool that allows developers to drive the platform using a DSL we developed. This was built based off the IntelliJ community edition platform.
The majority of the two years time we worked on this was spent on polish, and there was no end in sight. It is functional and really fills a solid niche, but the product is not something I would consider ready for production use by other developers. Given the amount of work left to be done, the possibly imited target market even when finished, and the growing realisation that to make this profitable we’d have to go enterprise B2B (again a massive hurdle) we left it at that, and started looking at something else to build. We spent a year on product 2, think saltstack, but better, but my partner was already on their last legs, emotionally and financially, and they called it quits a few weeks before v1.0 of product 2, leaving me in a position where the product is nearly there, but we are unable to cross the finish line on account of me not being able to quit my job and work on this full time. It is beyond frustrating.
In hindsight, there are many things I could have done different or better, but bootstrapping is hard for anything but the simplest products. I have two major products that are totally cool but unfinished due to the need for polish, life altering bills left over from this adventure, and I am facing a job/project market that is aggressively ageist (I’m officially an Old) and no outlook on better professional and financial prospects (boo-hoo, poor me, I know).
I am genuinely upset, as up until now, their lighting products have been excellent, easily better quality over alternatives in terms of physical build and capabilities. I have been a staunch Hue supporter since I first bought one of their products.
Some of the better functionality, such as the ease-in and ease-out instead of a hard on/off as well as the gradual dimming —> off for motion-sensor controlled lamps are really hard, if not impossible, to manage with the various 3rd party tools. Node-red can do a mostly-decent job, but that requires a level of work that few people are willing to invest, for results that are still not that great.
It is a real pity, but i’ll be looking for alternatives now.
Thats not what I said.
> it's hard to argue that they haven't hit on something that works better than the known alternatives.
Does it work better though? Barring some statistical outliers such as unicorns, VC backed startups from accelerators don’t measurably do better at all for the founders.
> What if you want to be an actor, or a comic, or a filmmaker? You basically have to move to LA or NY.
So, actors only work in […checks notes…] LA or NY?
This kind of egregious reductionism as support for the idea that a startup can only be successful if you dedicate your entire life to it to the exclusion of literally everything else (family, hobbies, “routines” - whatever that may mean) is not giving me the feeling that you are interested in a meaningful discussion, this is more like reddit point-scoring, which is not interesting, so I’m leaving it at this.
Comparing “move to another city (or country) for three months” with “there is a limited amount of time in everyone’s day” is a rather disingenuous way to frame the discussion. You make it sound like it _must_ be a zero-sum game when it doesn’t have to be.
The YC (and by extension, all YC-like) model comes across more as a system of selection and control for a specific demographic that has little to do with potential for success.
This is an incredibly long time to be away from your family for many people.
> Before cellphones went mainstream.
Yeah, and before we had antibiotics people would die from simple infections, that doesn’t mean we should “rough it out” or somesuch nonsense.
So yeah, it isn’t possible for many, if not most people. I’m not a fan of the model.
The Hue app surfaces functionality that isn’t available on plain zigbee, such as soft on/off and motion sensor programs. It is possible to mimic this to an extent but the native implementation is superior.
I also have a lot of different lamps that are either plain Zigbee or IKEA, and no matter the approach - node-red, home assistant, homekit - the “integrated” experience sucks compared to the Hue.
That response comes across as disingenuous. The lack of a unified backend makes a lot of monetisation models hard, but should pose zero problems for native mobile apps. Point at an API and done.
Redbull has to pay 13 million dollars, so possibly not stupid.
Anyway, TFA is about “Mango Dragonfruit Starbucks Refreshers are missing mango, Strawberry Açaí Starbucks Refreshers lack açaí and Pineapple Passionfruit Starbucks Refreshers have no passion fruit.”
So not entirely without merit, also according to a judge.
Unless the end-to-end, from the CA to the final certs, are managed by yourself or your immediate team, the scale would be irrelevant, and some ceremony would be required, as would be some processes that are internal to the team. My personal approach to avoid much of this is to use really short-lived certs to avoid the revocation theatre, but that doesn’t avoid the need to ensure that the CA is fundamentally secure.
> If that CA gets compromised, I can just re-run the template to generate and deploy a new one! No ceremony. Just press play.
Indeed! That, and re-distribute and implement trust for your CA Chain to all machines that need it. Your examples work fine (and I agree with) for small-scale use-cases, but if you run PKI for anything except yourself, you have to take care of the P for the KI.
Look, I am no fan of the rent-seeking bullshit the big public PKI vendors make us go through, and the incredibly high cost per certificate model. Charge me a reasonable fee for verification, and charge me a reasonable fee to set up my certificate vending endpoint, and be done. The same goes for internal use-cases. But the fact remains that verification and process are required. Fortunately, ACME for internal use and sane APIs and workflows such as Vault or smallstep provide make things very easy and cost effective. As for $400 per month for Azure certificates? Run your own instance, with your own (supposed) management processes, and see how it tallies up…
Ceremony, as in “a well established, rigorously implemented, meticulously documented, and diligently audited process” is required to establish and maintain trust. A CA promises that folks showing up bearing their certificate _are who they say they are_ - this doesn’t mean it is perfect (there are plenty of cases where public CAs went wrong) and some random person can place their trust in that assertion.
The whole _point_ of a PKI is trust, and why would this be any different for internal systems?
Go ahead, run an internal secret store that issues properly trustworthy internal certificates. It isn’t hard, but neither is it cheap not. You oversimplify and gloss over a few _really_ important aspects of why and how certificates work. A certificate _acting like a password_ in some cases doesn’t mean it actually _is_ a password, and if you don’t really need the additional functionality to the point where the cost outweighs the delivered value, you are using the wrong tool for the job.
Running a CA is not at a technical challenge. Running a _trustworthy_ (there is that word again) CA is process heavy and it involves quite a few people doing work on a regular basis, and without those processes you may as well just something else - like an untrusted CA, or some kind of token issuing service (which, shockingly, also costs money to run properly).
A few really good options around DIY CAs were mentioned in this discussion, smallstep is pretty good for example. Nothing (except possibly your $org’s security policies) prevents you from throwing that up somewhere and start vending certs.
The fact that it is an internal CA to be used for internal purposes makes no difference, unless you believe that “everything internal is trusted because it is internal” in which case many other discussions on a very wide variety of subjects is due.
Either your shit works, or it doesn’t. You do monitor, don’t you?
There is the calculus that the PR and legal costs are not entirely predictable and could be higher, so why the the risk if we have the cash.
If you are at a megacorp, you are a number, and a variable in a bunch of spreadsheets. Nobody cares about you beyond that.
That fine specimen of humanity goes on to say, in the same breath “we are fine, we have money” so clearly they were not pushing bankruptcy, and would have been in a position to help out those they screwed over so brutally.
I’m making it my mission to figure out the combined business interests of their board and c-suite, and make sure that I’ll not use those products if at all possible.