Milly may have heard about Heartbleed recently. She doesn't understand public key cryptography, SSL, servers, configuration files, or the command line. She does understand that all of her information being leaked to bad guys is not optimal. How would you go about advising Milly on what the consequences of Heartbleed are for her self-hosted SaaS product?

I get that cloud storage people think of themselves as the utility providers of the future, after all it makes instinctive sense to want to own something which consumers will spend their whole lives on. I've been in meetings where SaaS people gave presentations saying stuff like "...and in the near future the average person will spend 60% of their total income on cloud services; let's make that future happen!"

The difference is of course that after a power outage or after changing your utility providers, everything is back to normal - but after a little "cloud accident", all your stuff is simply gone. Worse, suppose in that glorious cloud future a person might end up in a situation where they can't make those substantial payments to their cloud providers for a time. All their stuff will be gone, as well. It turns out, we're being re-educated to accept a world where everything is just rented, not only including the stuff we "bought", but also the right to keep our very own creative output. Let the severity of that sink in for a minute.

We're drifting into a setting where basic properties of our digital lives are taken and then rented back to us at a horrendous markup.

It makes sense for the utilities to be centralized generating electricity for every house separately is inefficient and has only become recently viable with solar panels. Where possible people tend to switch to that for independence or a combination of both.

Getting water to every house in a city is impossible without it being centralized.

SAAS on the other hand is not necessary. We can do the same thing without requiring constant connectivity or by building and app that requires connectivity only when absolutely necessary for it to work.

However we can't ask for rent if it's not a service. I for one avoid all SAAS like the plague.

I don't mind one time payments hey if i get enough value from the product I wouldn't mind the option of donating extra however monthly payments make me look twice at how much value I'm getting or if i can get it from a product that requires a one time payment instead.

http://nymote.org/blog/2013/introducing-nymote/

There should be some sort of process for this, akin to safety deposit boxes. Image the machines to tape, store for a year or two. You may need to work in something to ensure you don't turn into long-term data storage (maybe only offer the download once, or add in a 30 day "thaw from storage" buffer, or maybe a fixed fee to retrieve that data).

This is exactly what creeps me the hell out about these subscription plans, and I don't see it discussed enough.

1. https://www.gnu.org/philosophy/words-to-avoid.html#SaaS

And I don't need banking 24/7 to do my job. I don't need water 24/7 to live, especially if an outage is made public in advance. I am (too) dependent on electricity -- but there are alternatives if I need them (eg: rent/buy a generator and gasoline -- probably not viable in a massive blackout, though. At any rate it is certainly easy to plan for (and not too expensive)).

So most of these fall squarely in the "viable alternative" or not-essential (24/7) category.

That's just propaganda. I'm sure there's places where water and electricity are under government control and it still sucks, and i bet there's places where they aren't and everything works great.

It weakens the rest of your argument.

Utilities and telcos are a weird industry, with issues of natural monopolies and last-mile issues. I don't know what the right way to handle them is, but the case against government intervention is much weaker.

Yes, you can usually pick your own retailer for you utilities. But you cannot pick the distributor (downstream of the retailer, owns cables or pipes in your street) or transmission (upstream of the retailer, owns the cables or pipes providing your city).

The sales/distribution company usually doesn't own anything, they are just sales and marketing office. Everything is physically provided by companies, that you cannot choose.

With non-power utilities, even this isn't an issue - water or gas are never randomly shut off without warning.

[1] There is a small deficit of generation capacity under some conditions, primarily due to recent underinvestment in nuclear energy, so power is purchased from France routinely, who have a large surplus due to their much stronger generation infrastructure, but even if this became unavailable, the capacity is enough to prevent US-style grid failures.

I'd wager that Nokia provides equal, if not - arguably - better quality than Google maps and I don't need to incur insane roaming charges when using a map abroad.

Granted, there are a few functions, that require a net connection, but basic map functionality and navigation works very well without being on-line.

Maps are only one example. I can't think of many applications, which I would prefer as a "cloud" based service as opposed to native.

Browsing offline maps is a breath of fresh air, it's so much quicker. Obviously you wouldn't download the whole world, only your home city or whatever. But it's lightning fast to zoom and pan around an offline map compared with connecting over mobile bandwidth.

Browsing maps in Airplane mode should be possible. It's a map after all, not a website.

Here's a great tool for getting a feel:

http://tools.geofabrik.de/calc/#type=geofabrik_standard&bbox...

Z=18 is rarely used, so for Z<=17 you're looking at roughly 300MB for raster tiles a city the size of Calgary. You also don't get routing information with purely raster data.

You could try vector data which would be smaller, but then you have to display it, which can be computationally expensive if you want it to look pretty, and you'd lose the snappiness you're seeking.

Actually, you could fit the entirety of the state of Washington in <50% of my phone's storage.

I'm not seeing a problem.

Well, most people don't want to lose even 20% of their phone's storage in a single app, much less 50%.

And that's just for those satisfied to only have info for one state. What about people regularly travelling between 1-2 states?

That said, I question the OP storage math. At least with vector information, I know that something like Navigon's GPS/map app, can store the whole of US (including the smallest of towns and cities) in around 1GB.

If you're traveling regularly between two states, you'd want your origin city, destination city, and your route with maybe a couple miles on either side. Say a 250-mile route, and 200 square miles at either end. I bet it fits in <2GB.

There is an option "Save map to use offline". Alas, it has an expiry period of 30 days.

SAAS is inferior in:

* games

* text editors

* photo editors

* IDEs

Backup storage is okay, but I live in a country with tight bandwidth caps so I can't really use things, plus I don't want Google or Dropbox or MeGa snooping at what I upload.

So I would never pay to use any of the above things, and I would certainly NEVER pay Adobe for anything. I'm fortunate that I don't need to use their products.

> * games

Isn't steam like this? The bits get downloaded to your machine, but if Steam goes offline your SOL.

What steam could use is better download management. If they moved over to an on-demand streaming architecture it'd be really huge. The days you'd need to preload software could be over. This sort of thing has been solved many times before, so it's technically possible. In fact, as I type this I wonder why they haven't done it already.

It does have an "offline mode" where it will pre-decrypt the games or whatever it does behind the scenes.

Why would on-demand streaming be a good thing? Now you have to worry about ISPs and bandwidth, it doesn't solve the problem.

I need to worry about ISPs and bandwidth before, it's just that now I can be more frivolous with what I have installed on my machine (no sense leaving something installed "just in case").

Funny you mention Mappoint. It's exactly what I use when I'm navigating for my wife on trips. It works fine in areas with poor wireless data coverage. (We supplement with Waze to get traffic reports, but "self-hosted" Mappoint guarantees we won't lose map coverage because of radio issues.)

Not necessarily true. I'd argue that banking is much less centralized (clearing behind the various banks you might choose from is, of course, but in the meanwhile I can get most of what I need done if their independent system is up), and I grew up on a property at the edge of my town of ~50K with only electricity and phone as centralized services. We were on our own for everything else, water from a well, sewage treatment with a septic tank, heating from a big propane tank, which can be filled by various vendors, although the systems behind them are centralized, but there's plenty of reserves so that short term outages aren't an issue, we even burned our trash....

A lot of us believe in having a greater degree of self-reliance, e.g. I do backups to disk and LTO tape (some tapes of which live in a safe deposit box), and use rsync.net, a very low level SaaS provider for further redundancy.

I'd never allow my livelihood to depend on 24x7 external services except for electricity (no electricity == no modern civilization, which would eventually kill me for medical reasons).

Sure you can self-host, but who do you trust more: some guy on your team who has other things to do, or a team that does only that? And a team whose livelyhood depends on uptime/data protection.

Here people can't work, but imagine the amount of work if there was a data failure on your machine? Your example (laptop being stolen) means you probably don't even have access to your data.

in the event of a theft, I can walk into an apple store, purchase an in stock macbook, let time machine recover for ~30 minutes, and get back to work

edit: just to be clear, I bet the vast majority of users will, even after this 24+ hours, experience less net downtime. Nonetheless, when I need to hit a deadline, with installed software, I have a viable plan b. The viable plan b here appears to be to grovel before clients whose deadlines you've blown...

[1] http://www.bombich.com/

Design tools are definitely a different category than some other enterprise-y software though. At least Evernote still allows me to use it if the servers were down.

Err.. what? I confess I've not looked into Adobe too closely, but why would you keep your data (only) on their servers? You'd need backup -- just as you'd have to have backup in place for your personal machines.

A typical scenario is a photographer that edits images -- you have maybe a terabyte of data you need access to, and have backed up, in the day-to-day -- and you need access to editing software.

Also, you seem to misunderstand -- I'm not saying I won't use or pay for SaaS (be that Software or Storage as-a-service) -- I'm saying I want a viable self-host alternative -- where self-host might mean that I can pay someone -- anyone -- to get things up and running quickly if I need it, and not be limited to whatever support any one vendor is willing/able to provide.

Now, personally, I'd probably take self-hostable to mean there's a tested ansible recipe that I can plug into a fresh vps, and be up and running. But not everyone wants to, or knows how to, be their own sysadmin -- but having someone guarantee that, yes, if you need it, this and that company can get you up and running in an hour for $amount.

> Here people can't work, but imagine the amount of work if there was a data failure on your machine? Your example (laptop being stolen) means you probably don't even have access to your data.

Ok, so lets say we're a small team of 5 non-technical designers, and I've lost my laptop. I have yesterdays backup, and my team mates can work. I'll have to spend an hour installing Photoshop on a new macbook pro I went to the store and got. Maybe an hour restoring backups or whatever. Lets say I loose 4 hours of work, and make up 2 in the evening. So we've lost one quarter of a total of 5 work-days today, due to catastrophic failure.

Now consider this outage: the whole team is down, and we've lost (more than) 5 work-days. If there was a viable self-host option, maybe we could've all squeezed in 6 hours of work after throwing dollars at Whomever Inc to set up a fallback solution for us. Also much better than all eggs in one basket.

I think this is the fundamental fallacy that SaaS companies are promoting.

Objectively, the answer is quite obvious in my experience: self-hosted systems are much more reliable than external ones, as soon as you have a reasonably competent person to run them and a second person with basic competence who can take over in an emergency if the first person is not around.

For a start, one of the most consistently unreliable things in many business environments I've worked in was the Internet connection. Workmen cut through underground cables while they're building the new office block down the road. Someone at your ISP accidentally disconnects you while they're in the cabinet hooking up their new customer. Someone moves in across the street with a badly configured wireless router and screws up the wireless frequency for everyone until the regulatory agency gets someone on-site to track down the problem and make them fix their router a week later. Relying on any Internet-based service for something you need full-time adds one more potential point of failure with a demonstrable risk that it will actually fail from time to time.

That is quite separate to the unfavourable track record of many large cloud/SaaS/PaaS companies, including almost all of the big names, compared to running systems in-house. I was genuinely surprised by some of the comments when GitHub was down the other day, where some people were complaining about not even being able to push changes to production because they were so entangled in dependencies on GH and related on-line services like CI systems that they couldn't extricate themselves.

I'm building a POS app for the invoice. One of the main requirements (self impose) is that the data is local-first and sync with the cloud. THIS point is one of the hardest to implement for me, and I still have not figured how do it well.

But still can't release this app without this. I believe that have a exit strategy for the app data is too important (the data is stored in a sqlite database, with decent naming and very simple structure).

I think Adobe CC is an example of useless cloud service. In fact I think the only reason Adobe insist on providing a cloud service is to avoid piracy.

As a user I hope they fail. As a traditional desktop software vendor I hope they succeed.

I pay a yearly subscription for my IDE so I can get major updates.

If I stop paying the software doesn't stop working.

Adobe is just doing what adobe does best - extracting the most amount of money with the worst possible product they can.

I agree CC is a sales experiment, and as both a user and a software developer it's an interesting one. I do wonder how much of any initial success has been a honeymoon period, though. Another interesting dichotomy was seeing that on the one hand there was a related statement from someone at Adobe about how customers had been worried that they would double their price once everyone is locked in but of course they'd never do that because it would be a betrayal of trust, while on the other hand anyone who signed up on the $30/month plan is about to hit the end of their first year's special offer and go up to the normal $50/month (but this is OK with Adobe because the offer was always advertised as limited up-front). That may all be true and legally above board, but I'm not sure how many people who did the maths at the $30 price point are still going to be as happy in their second year as they were in their first.

In other news, our existing installations of boxed CS products cost us nothing extra this month and didn't go down this week, and we're still waiting to meet either the client who we couldn't work with because we didn't have CC or the killer feature that Adobe have rolled out in a CC upgrade over the past year that would have made anything we do significantly more productive.

Ironically, there are plenty of ways Adobe could have got more money from us without going the subscription route. There are several features on our wish list that would have justified the cost of a traditional upgrade alone, even with no other changes. However, since Adobe don't seem to be going in any of those directions with CC, we're quite happy to exercise our choice not to pay them for the (worthless, to us) changes they are making instead.

Edit: It appears from other sources, including Adobe's own FAQ on their site, that CS6 will still be available to individual customers via download, just not in boxed media. It's the volume licensing programmes for perpetual purchases that are being discontinued on 30 May to push business and government users towards CC. There are some other interesting data points mentioned in this write-up:

http://www.pcpro.co.uk/news/enterprise/387724/adobe-to-halt-...

There are alternatives to each of the Adobe products, self hosted and available offline. People going the Creative Cloud route for their daily job are in a situation where the alternative costed too much or doesn't allow them to do their job in a sufficient way, so there was no real viable options from the start.

The problem is not really to trust Adobe or not. Adobe doesnt have any track record of great online services, I don't think they have an image of high quality software either, they do some amazing things and bring killer features, but I harldy heard anyone being loyal to Adobe itself.

I think this whole discussion would have taken a different turn if it wasn't Adobe but Amazon AWS or Google. When S3 is down, I don't remember seeing more than a few comments in the 'you should have self hosted your data' line. Why is it so different for Adobe ?

Having worked with designers I'm going to disagree. For most designers Photoshop or Illustrator are the only tools they'll even consider using because they're so much more powerful than the competition. That's changing a little with things like Pixelmator, but even then people have to learn a new workflow after decades of using Photoshop.

I am not a Photoshop user so my image is from hearsay, feel free to state your opinion. But what I heard was it's bloated, doesn't fully integrate/take advantage of the OS and hardware potential, crashes every once in a while and you'll have nothing to do about it.

To make a parrallel with coding tools, I feel it's on the same league as Eclipse. It's the very obvious choice for some application stacks, has tons of feature and it's plenty powerful. But I don't think most people love working with it (at least I don't), there's just no good enough alternative for the thing they want to do.

In the sense that "trust in a single entity as a single point of failure" - sure. Adobe can cut you off for any number of reasons, an outage being just one.

> When S3 is down, I don't remember seeing more than a few comments in the 'you should have self hosted your data' line .

One of those comments might have been mine. Still, I'm not saying that you should self-host, I'm saying you should use solutions that you could realistically self-host should the need arise.

So if you use s3 for your (non-web-related) data, maybe have riak-cs ready to go as a backup (it's a bit of a contrived example, because you probably either need a "cloud fs" of some sort, or mercurial/git or whatnot, not "s3" to be able to keep working).

I absolutely think one should have an alternative ready if one is heavily based on amazon -- at least have the option to spin up a minimal set of equivalent services as an openstack/nebula solution.

There are many reasons why you might get into trouble with any one provider, not just that their infrastructure goes down. If they hold all your data (and your backups) -- you pretty much have no leverage at all.