Successful Software

So I came up in the post-retail days of software, but I sold CDs (once upon a time) and have had a coffee or hundred with folks who came up a few years before I did, including ones who operated spiritually similar businesses with retail components. (My CD sales were over the Internet.)

Retail math is absolutely brutal. Consider software sold at a MSRP of $30, which might be squarely in the Scrappy Small Software Company Making A Go Of It range.

The retail store itself practices "keystoning" -- it won't pay more than $15 for that SKU. It also generally won't (and certainly not if it is a Best Buy / CompUSA) pay when one expects it to pay, before receiving the product. Nope, it pays after (depending on the contract) sell-thru or sell-thru plus return window expiry.

So who got the $15? Was it the software company? No, because CompUSA has better things to do than to talk to software companies, unless your company rhymes with Microsoft or Intuit. Instead, CompUSA purchased the software from a distributor. The distributor purchased it from a publisher; the publisher from the software house.

Suppose your software company self-published, to capture the margins. Bully on you. You make about $10 per unit.

Now let's return to that CD bit. Permit me to handwave, because it has been many years, but in quantity, shipped to your distributor, assume CD plus printed insert plus jewel case costs you $4.

So, when everything works out correctly, you make $6 on a $30 sale. You…

It's not that curl isn't so bad, but that the lack of notarization is really bad. Distributing software safely is still a pain.

Linux distributions have this kinda figured out a long time ago with signed packages - almost a requirement if you want to distribute your software on mirrors that you don't control. This is why it's safe to download a package from a Debian HTTP mirror and install it. The thing afaik any of them still don't do, and is really important too, is checking the signature with a revocation policy.

I actually started writing about how I distributed a CLI for macOS, Linux, and Windows a few years ago but never finished it.

If you are writing Go code you want to take a look at Equinox.

I used it to distribute a CLI in my previous job, and it worked like a charm. One of the things I liked most was that I was finally able to push safe updates because I authenticated every release with my private key, and only allowed users to update if the key matched. If you have a primary and a secondary key, and a strategy to revoke it, this means you have a quite safe release…

You're quite right -- Next is nowhere near complete, and still very much a beta. We're working on the "release early, iterate often" approach. (See http://www.codinghorror.com/blog/2009/12/version-1-sucks-but-ship-it-anyway.html http://successfulsoftware.net/2007/08/07/if-you-arent-embarrassed-by-v10-you-didnt-release-it-early-enough/)

The main reason is quite obviously for feedback. SoundCloud is a community-driven site, and we want to get really early feedback about features, design, etc. Another part of the feedback is exactly what's happening here with sharing our techniques and seeing the results. Hopefully the outcome of this blog post is that some other people will learn something, but also that some people will point out things so that we ourselves can learn.

> there are many bugs, most features are not implemented,

We're definitely aware of the features not yet implemented, but if you find bugs (or are really missing a particular feature), please do use the feedback form to let us know!

Cheers,
Nick

Have you seen this 2007 thing about the awards scam?

(http://successfulsoftware.net/2007/08/16/the-software-awards-scam/)

> I put out a new product a couple of weeks ago. This new product has so far won 16 different awards and recommendations from software download sites. Some of them even emailed me messages of encouragement such as “Great job, we’re really impressed!”. I should be delighted at this recognition of the quality of my software, except that the ‘software’ doesn’t even run. This is hardly surprising when you consider that it is just a text file with the words “this program does nothing at all” repeated a few times and then renamed as an .exe. The PAD file that described the software contains the description “This program does nothing at all”.

I have an OV cert for Windows, which is expensive enough. I just make sure to do a snapshot release using the new certificate to existing customers (through my newsletter and forum) a while before using it for new customers. That way there is time for the scary warnings to go away before any new customers see them.

Digital certificates providers are basically checking your id (mostly automted) and multiplying 2 prime numbers together. Then charging you several hundred dollars. A 1 year Sectigo certificate EV with USB key is $431.99. Nice work if you can get it.

I wrote this back in 2008:

https://successfulsoftware.net/2008/02/27/the-great-digital-certificate-ripoff/

But it has got much worse since then.

Yep. And I'm not advising people take an air of knowing it all when doing something like this. Sharing an opinion doesn't mean preaching an opinion.

This was an interesting article to find above this one:
http://successfulsoftware.net/2007/08/07/if-you-arent-embarrassed-by-v10-you-didnt-release-it-early-enough/

Most of your opinions and ideas are the same way. If you don't get them out there to be acted on and dented and molded and "bought", you don't get the feedback you need.

You should probably be a bit embarrassed by ideas and opinions you have constantly. But iterating on them with others in the wild, like software, is a good way to improve them.