Chiming in here as the cofounder of an 'open core' company:
This obviously wasnt handled as well as it could have been.
On the fundamental issue of building EE features:
If 100% of the code was open source, there would be less incentive for them to continue to maintain, update, upgrade the product. The EE features ensures that there is an incentive for them to continue to work on this project. Infact, the community _should_ want project maintainers to be compensated.
As someone else said, the project is open source, you can always fork and add any specific feature you want. It comes down to how useful is the actual open source project. If it is very limited in features and functioning, then yes - it is against the spirit of the open source. But if its a fully usable, functioning product (not for all but atleast some number of usecases), then it has created value which it is not capturing for itself - which is a net good for society and the industry.
This is a balanced article and I definitely agree about being clear on what constitutes competition. A few questions:
1. Does Gitlab see much competition from hyperscale providers like AWS?
2. Given that Gitlab has a thicker proprietary crust and a relatively smaller open source core (compared to hashi), is Gitlab more insulated from these types of issues?
The metric to measure how expensive equity is sounds flawed. Expected earnings divided by share price is not indicative of actual equity returns - especially over 1 year?
Most of the comments on this thread make it appear that everyone will be affected by this change. The vast majority wont be affected at all.
This only affects people who are directly competing with hashicorp using hashicorps code. That sounds like a reasonable thing to want to prohibit.
Why should hashicorp have to spend tens of millions on product development only for a competitor to spend zero but be able to offer the same product? That sounds like a net negative for the whole industry as it disincentivizes R&D
We wont have all the things you mention but will everything to do with tenant onboarding, identity management, user authentication will be out of the box. So in terms of functionality, it would be comparable to keycloak but easier to extend and integrate monitoring and billing tools.
Also I definitely understand your perspective and it makes sense. SuperTokens still is 100% open source - but you are right, as we evolve into a paid offering, there is scope for improvement
We've raised money every year in the last 3 years. We just dont update crunchbase.
we're being used at scale of millions of monthly active companies by very large companies - which have done deep technical evaluation.
If the company dies or gets acquired (possible with companies of almost all stages), the product is actually open source. You can self host it without any permissions and we provide daily database backups
|| Without qualifying the weight of every feature, it numerically raises a significant challenge to your statement.
Well i think that is the only thing that matters.
If I split all auth methods into the 6 different features it really is, then it becomes 13 free features.
The ones listed as not open source is to indicate what we plan to build for our paid offering. If we removed those and 13/13 were open source, would that change your views? If yes, then that qualification is pretty important.
SAML client and OAuth client are both free. You can add auth with any OAuth 2.0 provider to SuperTokens.
Being an OAuth 'provider' (emphasis) is not open source as it is a feature you need for complex use cases.
You can add 2FA with email or SMS in the open source product too (just requires some customizations and overrides)
We've mentioned the source (if you hover) and it is based on our internal user research and conversations with users of these products. By no means is it perfect and there are many many satisfied customers of each of the other products.
Your point is taken though and maybe we will edit that point out or try to add further nuance.
I do believe however that broadly speaking, that reviews of keycloak lean towards it being relatively harder to use and maintain than Firebase. Arguably the reviews of Cognito are more mixed than "Low"
Many of the core features are open source. Eg all the authentication methods - email password, passwordless, social etc are all in the open source product. You can also use the open source components to implement email based or SMS based 2FA.
RBAC, session management and user management dashboard are open source too. Its several years of an engineering team's work that is all open source.
Our philosophy is to keep features that are broadly required by developers and small companies in the open source version. Things that large companies require, will be source available.
We have several enterprises (more than $100M raised or several hundred employees) that are using SuperTokens at the scale of millions of monthly active users - all using the open source product. We think the open source product is a sufficient alternative (for a large enough population).
Are there any other features you feel should be in the open source version? Happy to hear any feedback and improve