Many governments, at least the ones that matter, are bankrupt. Quick google shows all G8 countries run a deficit.
My "smart play" wasn't on the merits of idea, largely the game theory aspect of moving forward to their policy goals after decades of having no traction. It's a unique idea, policy wise. Don't know if it will be effective. Neither do you.
It's a smart play for a flat tax. Baseline at 15-20% on imports (proxy for flat tax on income). Then push to eliminate income tax. It's very much aligned with conservative view points on income tax and it's progressive nature.
For niche products, I think it makes sense. For example, we had a need for a tool to generate AWS/Azure diagrams automatically. There are a ton of SaaS options in this space, some of which just leverage opensource projects to generate the diagrams. In the gov space, I can't touch it if they aren't FedRAMP'ed. I've gone through that process as a CSP, and it's near a million dollar investment. Or the vendor can just release their product as an Atlassian App and avoid that headache. Yes, you'll never be the next billion dollar SaaS vendor but could you make a 7 figures? I'm confident you could.
Rephrased, I think an agency or company that follows the AWS model of "borrowing" open source projects and converting them to a paid service would work would do well. Wrap a open source solution around an Atlassian or similar PaaS app/module.
Slightly off topic, I'm surprised why more tool or SaaS vendors don't run as Atlassian apps. It solves so many enterprise gatekeeping issues for most tools:
1. Usually integrated with the Enterprise IDP
2. apps/modules usually are part of the security boundary of Atlassian, meaning little compliance headaches if any.
3. Out of the box scaling of per user licenses since individual apps can't have their own independent user limits, they use the whole Atlassian user count. So, if your customer needs just 10 licenses but their Atlassian suite has 500 users, they must purchase at 500 user cal.
4. Atlassian Jira/Confluence are very sticky at the enterprise level. Yes, teams may move to Gitlab, but most customers prefer to stick to Jira/Confluence.
LOL. Maybe the professional class (doctors, lawyers) but most real working-class people do not bucket themselves in the category as the professional class. Yes, you are all salaried, but they don't get 6 figure RSU's or bonuses.
I know not the same use case, but nginx will serve near 100K requests per second of a static site on a moderately powerful server. Server side generated SPA empowered by K8 solution drops that to a dozen. Those number discrepancies are comical.
I must be too old to enjoy recent resume building architectures....
1. Engineer costs - A PaaS at the high baseline will likely implement 300+ controls. It's been a while since I looked at an IaaS CSP's FedRAMP package, but they typically implement roughly 100 fully implemented controls. The rest is on the customer to fully implement or engineer completely. Likely 300K-500K worth of engineering costs.
2. Assessment - 3PAO assessor will likely be 100K-200K. Most first time CSP's may require more than 1 assessment as the process is usually (1) Assess (2) Submit to FedRAMP PMO (3) they provide feedback (4) limited time to implement. If you cannot implement in sufficient time, you'll have to reassess. Note, unless you are AWS, Azure, Google, FedRAMP PMO may not prioritize you without sufficient customer support. As a result, your contract with your 3PAO may be expired. You'll need to bring them in again.
3. Documentation experts – There’s an art to generating the FedRAMP package. Engineers typically aren’t good at it, and it often requires one level of abstraction above internal technical documentation. Having technical writing experts that know how to communicate the security implementation without diverging too much is a skill set. You share the bear minimum to get compliance. As there’s business risk from sharing too much (sharing implementation details with a competitor or untrusted source). Also, the more technical details there are, the more audit questions often arise.
4. Control Implementation SME’s – Often time your engineers don’t know how to implement a required security control or don’t know what the compliance people really want. Many CSP’s hire a 3PAO assessor to advice you how to implement. This cannot be the same 3PAO assessor that audits you.
5. Conflict between product/feature value versus control implementation - Sometimes a value or feature of your product directly conflicts with a control requirement. A good example is a CMS PaaS (WP as a service or Drupal as a Service). Those CMS's often support user code or user code to spawn processes. The high baseline requires process whitelisting. Solving this problem while not destroying that feature can be difficult or expensive.
I've worked in this field, as well. Both implementing a FedRAMP'ed PaaS and sponsoring a CSP from the customer side where FedRAMP compliance was required. One thing that is often missing in these articles are compliance costs. Most don't realize that FedRAMP compliance at a High baseline is likely a $750K - 1M investment.
Good. I've started purchasing Birthday cards here. I've noticed Birthday cards costing 4-6 dollars at grocery stores. They are 50 cents to a dollar at the Dollar Store. Between family birthdays and kid birthdays, I think I spend close to 100-150 dollars a year on birthday cards. That's expense is now down to 20 dollars from Dollar Store.
The quality of education is dictated innate ability, parents, and school system. I like to think of as a three leg stool. If one leg is missing, it's possible to balance. If two are missing, no amount of money will solve the problem.
Amazon wants to open up S3 API for now. I guess my point is launching products with S3 API combability I feel is a legal liability if Oracles wins the case.
I was specifically implying block storage solutions that offer S3 API combability (i.e. use our AWS S3 competitor with matching S3 API).
If Oracle wins the Supreme Court case against Google, aren't all these "like S3" or S3 API compatible solutions (whether block storage competitors or file systems) at risk?
Many governments, at least the ones that matter, are bankrupt. Quick google shows all G8 countries run a deficit.
My "smart play" wasn't on the merits of idea, largely the game theory aspect of moving forward to their policy goals after decades of having no traction. It's a unique idea, policy wise. Don't know if it will be effective. Neither do you.