Hacker News new | past | comments | ask | show | jobs | submit | Saaster's comments login

We bought our .com after we became "successful" and had significant revenue, however it just redirects to our non-dot-com, because it's too much of a hassle and SEO risk to change at this point.


If I as a SaaS provider get my SSO SAML integration via a provider like Okta or Auth0, the auth provider pricing itself is also on a "call us" tier, with a per-federation pricing in the low four figures for each individual company connecting to me via SAML.

It's pretty insane, so I'll state it again: To have a company connect to my SaaS via SAML, I as the SaaS provider have to pay my auth provider $X,000 per year for the privilege. Not counting the base enterprise tier pricing for the auth solution itself. So then I have to roll my own solution if I want to provide it for free, and I get the joy of supporting the long tail of broken SAML implementations on both the service and identity provider sides. For free. In a perfect world SSO wouldn't be a shitshow and everyone could have it for free, unfortunately that is not this world.


The SAML world is definitely a fun mess. We’re[1] building out SAML support and are beta testing it with a few customers and it is funny how different even the large IDPs are. Add in things like needing to test the integration, making sure attribute and role mappings are correct, and it’s unfortunate but understandable that companies not specializing in auth wouldn’t want to deal with it except for customers that pay a lot.

[1] Disclaimer, I’m a founder of PropelAuth


Plugging in my startup BoxyHQ here. This is the reason why we open sourced our SAML integration - https://github.com/boxyhq/jackson, it should be commodity.


Fwiw, Amazon offers an sso platform with saml for free. That's not the answer for everyone though, and may not be for you even. Just putting it out there for those looking for a cheap saml identity provider.


The code running in my browser isn't a multi-tenant production server, with access to the filesystem and DBs.


Except that with Deno, everything IO related is turned off by default and has to be granted access before it becomes a process. It's the first bullet point on the landing page.

Here is the page with more detail. https://deno.land/manual/getting_started/permissions

It can even restrict access down to a specific directory or host. This is cool.

Whereas any NPM module can map your subnet, lift your .ssh directory, and yoink environment variables, wily-nily.

It's happened before.


That still doesn't prevent imported modules from yoinking anything you did grant access to, though. For instance, if my service connects to a DB then `uuid` can slurp the contents.

It'd be nice to have some capability model where modules can only access things through handles passed to them, but probably infeasible for a project like this.


You can actually run things as Workers in Deno and get some sandboxing abilities: https://github.com/denoland/deno/blob/master/docs/runtime/wo...


From the article: "Also like browsers, code is executed in a secure sandbox by default. Scripts cannot access the hard drive, open network connections, or make any other potentially malicious actions without permission."


That just means you have to run with the -http -fs, etc. flags. But you are using those when writing any nontrivial Deno app like a webserver anyways.

"web browsers already do this ;)" isn't a good comparison.


"But I have to turn all that stuff on" is also not a good comparison.

Actually, no Deno webserver I've written gets fs access. Some only get --allow-net.


I think that's the main selling point of deno, sandboxing.


Does Deno have some built in way to vendor / download the imports pre-execution? I don't want my production service to fail to launch because some random repo is offline.




You can also use the built in bundle command to bundle all of your dependencies and your code into a single, easily deployable file. https://deno.land/manual/tools/bundler.


Deno caches local copies and offer control on when to reload them. in term of vendoring you can simply download everything yourself and use local paths for imports.


How would this work with transitive dependencies? Sure I can control which parts I import myself, but how do I keep a vendored file from pulling in another URL a level deeper?


Unlike node, recommended deno practice is to check-in your dependencies to the VCS.

> Production software should always bundle its dependencies. In Deno this is done by checking the $DENO_DIR into your source control system, and specifying that path as the $DENO_DIR environmental variable at runtime.

https://deno.land/manual/linking_to_external_code


    du -hs node_modules
    
    1.7G node_modules


> in term of vendoring you can simply download everything yourself and use local paths for imports.

So I basically have to do manually, what NPM/yarn do for me already?


I do not speak for the project, but based on my understanding part of the point was to avoid the magic of npm.

You can use lock-files, bundles, and many other features that makes dependencies management easier.


Ah from that perspective I can see how this might appear to be better. Personally, I like the 'magic' of NPM (which to be honest I don't really think is all that magical, it's quite transparent what's happening behind the scenes). This 'magic' means I no longer have to write 200 line makefiles, so it definitely makes my life easier.


Some of that convenience will still be included, a couple of things that deno will do differently from node will be that there is no standard index.* file to load and import path include the extension.


I assume you would just download the packages and serve them yourself.


Let's keep moving those goalposts 'til the other team can't even see the goal anymore!


If business travel is reduced, you can expect the cost of regular coach class tickets to increase massively as the former pays for the flight and the latter is just there to wring a bit more profit out of the trip.

Business travel right now is non-existent and many companies are finding that things still work just fine without it and will not return to previous spend levels.


Tickets to leisure destinations are not out of line from flights on business routes, so I don’t think it’s right to say airplanes can’t fly profitably without business travelers footing the bill.


Ryanair did fine without a business class


Zoom works great on Linux, it's a proper native app and the quality is excellent. Screensharing is notoriously tricky on Wayland and has been a shifting target that is just now starting to settle, I'm sure it'll eventually work.


> Zoom works great on Linux

And depends on iBus which breaks keyboard input for me.


It's still the exact same potato-cam in every model, from the Air to the $$$ MacBook Pro "16.


How do people WFH with their new $$$ macbooks ? Is there any external cam you would recommend ?


I use a Pixel 3a (rear camera) connected over USB + Droidcam as my webcam.


Droidcam doesn't exist for MacOS?


A primary driver of SaaS sales is trust. Nobody wants to bet on a platform that is going to pivot or shut down within 12 months. It's not about price, it's about disruption to business in both adopting and offboarding from any solution more complex than a todo list. For a lot of established companies, that unfortunately means they won't even consider you until you've been around for 1-2 years. We have a lot of customers who checked us out on day 1, and now 3-4 years later are coming back saying "Cool, you guys are still in business, now we can try you out for real".

If you're building SaaS, go ahead and take that SaaStr article as gospel (and a lot of their other writing as well). Maybe you're a special unicorn where it doesn't apply, but most likely you aren't.


My biggest worry with React is that it has restless developers with idle hands.

I have (a lot of) component code that will never be converted to hooks. Can I rely on you not to flake out and pull an Angular on me?


> My biggest worry with React is that it has restless developers with idle hands.

That’s exactly what I take hooks as a sign of. I read the papers and the code when they came out. I still don’t get why they exist except to provide churn to work on. A half-reimplementation of objects with a super weird syntax in a language that already has objects seems like misguided make-work on a project that’s already basically “done” except for the boring, non-flashy work of maintenance and subtler improvements.


Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: