[johnward]

I don't know. I work for an enterprise company and we're coming around to the idea of putting things in the cloud. I actually think the people running cloud hosted software are more of an expert in the software and devops than the people inside your organization in a lot of cases. Plus large enterprises have so much bloat that it can be way more expensive and time consuming to launch something internally. The biggest issue seems to be that these companies are still afraid of who controls their data.

[ProAm]

Sometimes. All I can speak about is my personal experiences with a handful of enterprise customers and the times we moved things to the cloud. Communication is always an issue, we find that instead of spending time in house developing, deploying, administering, etc... we spend that same amount of time either one the phone or writing emails and documentation on what we need or what is wrong or what we need done.

We also find that the what the cloud team finds as a sufficient level of quality or service often does not match what we require or expect. And fixing that is a major PITA because it comes down to culture, and suddenly you are not dealing with your company's culture but a 'cloud' culture.

And on top of all that there is the issue of who controls your data. Is it secure? is it safe? What's your uptime, downtime, maintenance? Often we get promised good things (sales people are good at what they do), but it rarely works out as such.

The answer to this is find another cloud provider, but I dont want to spend months RFI, RFP, migration, integration, etc....again because the first cloud people were terrible. It's often just better in the long term to do it yourself.

It's a pay me now or pay me later scenario and I'll live by the words if you want something done right, do it yourself, especially for enterprise.

[stephenr]

Self hosted software generally tends to play better with others in my experience.

SaaS apps seem to be about lock in wherever possible with just the barest lip service given to standards and true interoperability.

[stephenr]

>these companies are still afraid of who controls their data

You make this sound somehow irrational.

For a large number of companies, business data is the key to the running of the business. Why would you ever let someone else control this data, much less someone who themselves doesn't have full control?

[johnward]

I wasn't trying to say it's irrational. I realize why companies would be afraid of putting proprietary data into someone else's hands. I still think the idea that it's going to be stolen or leaked from a cloud provide is not likely to happen. I'd be willing bet most of the time IP is stolen it's someone inside the company doing it. So much easier for a disgruntle worker to do it.

[stephenr]

Who says it's about theft?

Do you not remember what happened with Codespaces?

How many times are there posts to HN: "AWS is down in <FOO>" with dozens of comments "yep, XYZ doesn't work right now"

How many service based companies have been bought out by a bigger fish only for the service to be shut down or changed in some dramatic way?

For the majority of businesses I very much doubt that theft is the primary concern with using SaaS. Control, visibility, access to your own data regardless of the app/system author's current situation, etc.

Even if theft is your primary concern - and I will grant you that for most small companies where it's targeted theft, the finger more likely points to an insider - using SaaS, especially if it's one builds on a third party provider's stack, means you are increasing the potential for breaches, and you don't even know what that increased potential is, and potentially you may not even know if a breach occurred.

Imagine a company that runs a service on Heroku (who in turn have built on AWS). So by using this service, you suddenly have great potential for individuals at three other corporations to heavily influence your ability to do business and remain profitable, either through data loss, downtime, or the aforementioned security breach.

I haven't even mentioned the issue of data privacy here - it seems quite common for modern SaaS startups to rely on VC funding to offset the costs of providing their service, with the vague notion of "if you build it, they will come... and then we can somehow turn them/the information we hold on them into a profit"