CNCF accepts Kubescape as its first security and compliance scanner project

Re:CNCF accepts Kubescape as its first security and complian... by ariehkovler on Wednesday January 11, 2023 @02:25PM (#34343245)

This seems to be an increasingly popular model: Make an open source project on the one hand and selling a hosted, managed version of the open source product on the other.

[ Parent | on HN ]

Re:CNCF accepts Kubescape as its first security and complian... by Bombthecat on Wednesday January 11, 2023 @02:44PM (#34343527)

Well, it makes sense, you can outsource bug fixing and reporting for free.

You can test and use the software for free

Companies can outsource the responsibility of hosting.

[ Parent | on HN ]

Re:CNCF accepts Kubescape as its first security and complian... by ariehkovler on Wednesday January 11, 2023 @02:57PM (#34343741)

> Well, it makes sense, you can outsource bug fixing and reporting for free.

In the long term, maybe. In the short to medium term, most of the development ends up being done by the company who created the project.

I guess for simple stuff like typo bugs, people will submit PRs, and maybe organisations with weird use-cases will merge their integrations etc into the project, though.

[ Parent | on HN ]

Re:CNCF accepts Kubescape as its first security and complian... by candiddevmike on Wednesday January 11, 2023 @02:54PM (#34343700)

I don't think the model has existed long enough, especially through hard times, to make a judgement on if it's effective or not.

[ Parent | on HN ]

Re:CNCF accepts Kubescape as its first security and complian... by ariehkovler on Wednesday January 11, 2023 @03:17PM (#34344011)

Yeah, I tend to agree. I guess we'll see which companies can make it work and what happens to the projects if they don't.

[ Parent | on HN ]

Re:CNCF accepts Kubescape as its first security and complian... by asciimike on Wednesday January 11, 2023 @03:30PM (#34344220)

Open Core (https://en.wikipedia.org/wiki/Open-core_model) has existed for a while and has definitely proven itself to be viable, albeit for a limited number of folks.

IMO the key to doing it right is ensuring that your hosted solution actually provides value: either because its difficult to operate at scale, there are certain regulatory/compliance requirements that need to be met, because certain features are restricted to a hosted product or under an enterprise license, etc.

I've seen a decent number of people create a hosted version of their product, slap SAML/SSO behind an "enterprise" plan, and wonder why nobody their successful OSS product doesn't translate to meaningful hosted revenue.

[ Parent | on HN ]