robchahin / sso-wall-of-shame

A list of vendors that treat single sign-on as a luxury feature, not a core security requirement.
https://sso.tax
Apache License 2.0
619 stars 288 forks source link

Add Directus's Cloud Hosting #401

Closed ironiridis closed 1 year ago

ironiridis commented 1 year ago

Modeled after kubecost.md which also does not disclose the pricing for the enterprise level.

Cc: @benhaynes

benhaynes commented 1 year ago

Hey, @ironiridis — I really appreciate you pinging me here... it's important to keep all vendors honest about not pay-walling security features. I would like to offer a few quick comments on this. Not trying to dissuade you from adding us, just helping you understand our position.

In any event, I just want to make sure you and other developers are aware of why this is the case. It's a bummer, and we look forward to a time when we can offer all ENV configurations (including SSO) in all of our offerings. ❤️

Leichesters commented 1 year ago

Oh wow @benhaynes it really takes some nerves trying to defend yourself and immediately lying again.


it's important to keep all vendors honest about not pay-walling security features.

You say that your service is "designed to be self-hosted for free" - it is obvious that self-hosted software can be hosted for free, it shouldn't be something you need to mention, it should be the norm.

our SSO is not paywalled... you can get and deploy it completely free.

Well your SSO is paywalled. You meant to say:

your SSO is not paywalled when you host it yourself.

So it doesn't seem to be as if you were that "honest about not pay-walling security features". But no worries, if you add a heart at the end everything feels much better, doesn't it? :heart:

ironiridis commented 1 year ago

But no worries, if you add a heart at the end everything feels much better, doesn't it? ❤️

Come on, let's stay civil please.

Leichesters commented 1 year ago

But no worries, if you add a heart at the end everything feels much better, doesn't it? heart

Come on, let's stay civil please.

Nothing against you, just wanted to show @benhaynes what it feels like to us when people lie in our face and try to let it seem as if they were nice.

benhaynes commented 1 year ago

Not sure why you're so upset, @Leichesters. This is a conversation being had in public, what benefit is there for me to lie? Probably not worth a response, since you clearly aren't here to discuss, but...

You say that your service is "designed to be self-hosted for free" - it is obvious that self-hosted software can be hosted for free, it shouldn't be something you need to mention, it should be the norm.

Sorry to be so blunt, but you are incorrect here. I was making two points:

1. Our software can be self-hosted — many pieces of software are cloud-only, so you have no other option than to use the cloud option (which may be paywalled). So I wanted to point out that our software has the option to be self-hosted, which has no paywall (technically or via a license). 2. Our self-hosted option is free — saying something can be self-hosted doesn't mean it's free... so it is indeed worth clarifying. Hasura, Strapi, Kirby CMS, OracleDB, and many others, can be self-hosted but you still need to pay for a commercial license.

Saying something "should be the norm" is subjective and doesn't really add much beyond your own opinion.

Well your SSO is paywalled. You meant to say:

your SSO is not paywalled when you host it yourself.

Sure, if you want to be pedantic... I've updated my original comment to change "our" to "your". It's our SSO offering that enables your SSO. This doesn't change my statement.

Nothing against you, just wanted to show @benhaynes what it feels like to us when people lie in our face and try to let it seem as if they were nice.

First off, I am nice... and I'm not lying.

There's a lot I could say about this... but I'll leave it at: I've spent 20 years building and maintaining this free and open-source software that benefits the users of 20M+ installs... all paying zero dollars. I find it frustrating when entitled trolls pick a fight about things like this. You want SSO for free? Download Directus from npm and spin up your own hardware to do it. It's as easy as that... full stop.

We're building a fairly-priced Cloud service to ensure we can keep this project alive, and the technical limitations of that service are that the lower cloud tier can't have custom ENV files. I don't care if people like you want to make binary claims that we're pay-walling security features. I'm stating what we're doing (and why) here so that the more considerate users following along can better understand our reasoning... and know that there's a self-hosted option of our platform with all the SSO/security config available for free. ❤️

Leichesters commented 1 year ago

@benhaynes Thanks for updating your comment (can't see the updated comment yet, but I guess it's because of GitHub's cache).

You stated again that your service offers SSO - if you self host it - You still don't have SSO, which this PR is about. This PR was made because you do not offer SSO for free - a security aspect that should not be pay-walled.

I'm also not a troll, I may be a bit rough in my wording, but to be honest I just hate it when people put on their "Nice-Mask" and pretend to be better than they are. In this case you pretended originally to be offering SSO for free, which is what annoyed me. And it's pretty obvious that you are pretending to be nice, just because you added a heart emoij to my comment.


Our self-hosted option is free — saying something can be self-hosted doesn't mean it's free... so it is indeed worth clarifying. Hasura, Strapi, Kirby CMS, OracleDB, and many others, can be self-hosted but you still need to pay for a commercial license.

That was actually new to me and I must say that I'm very happy and proud to see you offering your self-hosted service for free without a license restriction. I'm honest, I didn't know that there is such thing as a license preventing you from offering self-hostable services. This is truly a shame and I hope companies that force people to buy a license to use their already open source projects go bankrupt.

benhaynes commented 1 year ago

@Leichesters — appreciate the quick and considerate reply...

You stated again that your service offers SSO - if you self host it - You still don't have SSO, which this PR is about. This PR was made because you do not offer SSO for free - a security aspect that should not be pay-walled.

This is very true. The PR is about our Cloud offering, and I agree that we should be on this list until that is corrected. Again, as I stated in my OP: "Not trying to dissuade you from adding us, just helping you understand our position."

And it's pretty obvious that you are pretending to be nice, just because you added a heart emoij to my comment.

Yup... this was a little jab because you said some (IMHO) insensitive things in your comment. I am just trying to keep things civil here... though, I'm not wearing a "nice mask", I just believe in a "kill them with kindness" approach.

That was actually new to me and I must say that I'm very happy and proud to see you offering your self-hosted service for free without a license restriction. I'm honest, I didn't know that there is such thing as a license preventing you from offering self-hostable services. This is truly a shame and I hope companies that force people to buy a license to use their already open source projects go bankrupt.

Just wanted to mention that I truly appreciate this response and share this sentiment. I understand (more than most) that everyone needs to make their projects sustainable... which requires some monetization. But there are good and bad ways to go about this.

We'll continue research ways to get our multitenant cloud (Standard tier) to support custom ENVs... which would unlock SSO, as well as everything else under the sun. Until then, I appreciate the motivation that this list provides, and am thankful these comments are here to clarify free/non-cloud options. ✌️

Leichesters commented 1 year ago

@ironiridis why did you close this issue?

ironiridis commented 1 year ago

This repo is abandoned and I deleted my fork. Feel free to pick up my patch if you like.

Leichesters commented 1 year ago

Yes unfortunately it rellay seems like its abandoned. Do you know any alternatives?

scottIXP commented 1 year ago

There is a small thread in the Issues section, and it seems like this hasn't been an active project for a while.

@robchahin , the owner doesnt appear to be very active this year. It would be cool if they could hand this off, as it is a great idea and one of my simple pleasures ;)