Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The future is not self-hosted

drewlyton.com

Post reply on HN
Print view View original

441–450 of 459 posts

Re: The future is not self-hosted

#441

Post by _-_-__-_-_- »

slightwinder wrote: post #80
bambax wrote: post #74

Earlier quoted context omitted.

> most people never had any need or ability for this control in the first place Regarding need: strong disagree. I want to be able to re-read a book, to open it in any an ebook reader on my desktop to search / copy from it, etc. I want to re-watch good movies any time. I certainly don't want to lose my photos or any media I produce because of some corporate policy or quota, or politics. I self host everything. I only…

> Regarding need: strong disagree. I want to be able to re-read a book, to open it in any an ebook reader on my desktop to search / copy from it, etc. I want to re-watch good movies any time. That's your demand, not everyone's demand. And it seems are also indirectly assuming here that this is impossible without self-hosting, which also is not necessarily true. The problem, is, we don't know. Self-hosting is like bac…

I like having my media locally, non-drm and under my control as well. I've grown-up in an era when media flowed freely on the Internet (music, tv, movies, books, academic papers, games and software). It takes a minimum of effort, but it's also not sorcery. It's just a collection of files sitting on a hard drive. I then have layers of software (docker containers) to serve those files and keep databases with metadata listings up-to-date. I also enjoy cataloguing and maintaining my own media. It's a passion and a pastime. That's why I continue to save media.

Re: The future is not self-hosted

#442

Post by MisterSandman »

chris_engel wrote: post #410
MisterSandman wrote: post #389

Earlier quoted context omitted.

Why do you claim that Hetzner won’t screw you over with your data? What you’re doing with Hetzner is just a few less layers of abstraction compared to AWS or Azure. They can still theoretically take down the machine or steal your data, if they wanted to. I don’t know what the correct definition of self hosted is, but there is a big ideological difference between what you’re doing and self-hosting actual, physical har…

Sure, in theory Hetzner could pull the plug or access the data on my VPS. But that’s true of any infrastructure... just like someone could break into my house and steal my self-hosted server. In fact, I’d argue the physical risk of loss, theft, or data compromise is much higher at home than in a professional datacenter with power redundancy, security controls, and constant uptime monitoring. It’s a bit like saying, "…

I never said any of those things, you’re literally arguing with made up points I didn’t make?

But my point Hetzner isn’t self-hosted. Similar to how storing money in a bank isn’t self-banking. Self-hosting means you host your content yourself in a server room that you have physical access to. Hetzner isn’t that.

And that’s fine, self-hosting is pretty silly for most use cases nowadays. And all of the positives you mentioned are true. But I hate how we’ve turned “self-hosting” into a political dog-whistle for hosting with companies that seem more trustworthy than the big guys. And there’s nothing wrong with not wanting to trust GCP or Azure - just don’t call it self hosting.

Re: The future is not self-hosted

#443

Post by LeonM »

gerdesj wrote: post #437
drew_lytle wrote: post #327

Earlier quoted context omitted.

Haha! "Showing a lot of ankle" – I've never heard that before! Thanks for reading and commenting – very cool that you've managed to successfully host email. I'm sad advertisers and spammers have turned that into essentially an unusable technology. Definitely a proud self hoster, but the main point is really that I don't think we're going to live in a world where self-hosting is the dominant method of using internet-b…

Self hosting email will always be niche and frankly it was pretty niche in the noughties too. I do find that if you carefully curate an IP address ... now that's the real problem. Most IP blacklists aggregate and generally end up roll up to cover entire AS ranges and allocations instead of actual individual perpetrators. However, if you can grab a "corporate ISP" static IP address, you are normally OK, at least in th…

I work in the email industry, so I might be a bit biased on this one, but in my experience self-hosting email has actually gotten better, or at least for the outbound part, funnily enough. But I won't go into why IP-reputation is a thing of the past, for the risk of having to write a very long post that'll be downvoted anyway.

The biggest problem that I personally see with self-hosting, email in particular, is that most resources you find online are outdated, based on superstition, or simply plain wrong. There is a lot of heated debate around running email services, and many bitter comments from people who tried once and got burned.

Self-hosting a personal email service, or any kind of service for that matter, isn't impossible. The internet is still based on free and open standards (the RFCs). But it is free like speech, not beer. Running your own services will cost you resources. Most of which is your time, but some may also be money (for example: ML-capable hardware, certificates, licenses, etc.).

You'll have to be willing to learn, and more importantly: willing to accept that it is a lot of work to setup and maintain any self-hosted services, not just email. You have got to be willing to read through the RFCs, study the errata, read the documentation of your software, be willing to spend time in configurations, being sure you understand your settings, set up lab environments to study both ends of the service (for example: the inbound and outbound service in an email transaction).

Self-hosting is a great learning experience, a fun hobby even if you enjoy such things. It'll allow you to explore all sorts of tech throughout the entire networking stack. But due to the amount of work it takes to setup and maintain, it'll never make financial sense to self-host, at least not in a professional setting. Cloud-hosted solutions, email being a good example in particular, have the benefit of scale: they are dirt-cheap and work really well. It makes zero financial sense to self-host any email service beyond personal use. Unless hosting is your core business, don't be tempted to self-host anything, focus on your actual business instead.

Re: The future is not self-hosted

#444

Post by jcgl »

fsflover wrote: post #434
jcgl wrote: post #356

Earlier quoted context omitted.

The size of the whole pie has grown, and, yes, so have P2P networks. However, centralized networks of various kinds have grown too. From application-level networks (e.g. networks messengers from Signal to Discord; payment networks from Visa to AliPay) to transport- and network-layer networks (e.g. cloud-oriented client-server topologies; Tailscale), you see growth in the centralized world too. While I don’t have hard…

> When he weighed the tradeoffs for making Signal, he came down on the side of a centralized architecture. And as a result, Signal has a single point of failure and hacker/governments attacks.

Due to its (afaik) unrivaled privacy-preserving architecture, the Signal servers have systematically less info on you than, e.g. a Matrix server. The risks of an attack should therefore be much lower.

Oversimplifying a little bit here, but I believe the most likely outcome of a Signal hack would be downtime, rather than a data leak. Contrast that with e.g. matrix.org (where the majority of Matrix users are).

Re: The future is not self-hosted

#445

Post by bayindirh »

palata wrote: post #114
bayindirh wrote: post #66

Earlier quoted context omitted.

> One disadvantage is that they have access to your data, but at least you choose the cloud provider (maybe you want one that is in your country). You can apparently encrypt your Nextcloud data at rest at Hetzner. I host my own Nextcloud, and I know it supports encryption, but apparently Hetzner also allows you to do so. On the other hand, if you want a standard cloud provider, pCloud provides good encryption support…

> You can apparently encrypt your Nextcloud data at rest at Hetzner. Doesn't it mean that they can still access your data while the server is running? I mean, they run the server, they must have access to it, right? > pCloud provides good encryption support You mean e2ee? If it's about sending files to an untrusted server, I use restic. Works with pretty much everything (including pCloud) :-). > BTW, keeping a Nextcl…

> Doesn't it mean that they can still access your data while the server is running?

If you use "at rest" encryption, they might get the key from memory, yes. But if you use E2E (or client to client as Nextcloud says), nothing on the server would be readable, so using cryptomator/restic becomes unnecessary [0].

> You mean e2ee?

Unfortunately no, pCloud doesn't use E2EE. It's at rest AFAIK. Technical details are at [1].

> Sure, but what I was saying is that either you do it at home and it makes it harder...

If you want to expose your NextCloud to the world, 80/443 is enough for everything, plus Nextcloud comes with layered defenses by default (like brute force detection, etc.), and they can do your security audit, against their best practices [2].

If you don't want it to be completely visible, you can always tuck it behind a VPN.

If you want to host it on a VPN, then you can enable E2EE in NextCloud, but web part becomes unusable. Instead, you can use Syncthing with untrusted folders in that case.

[0]: https://nextcloud.com/encryption/

[1]: https://www.pcloud.com/features/encryption.html

[2]: https://scan.nextcloud.com/

Re: The future is not self-hosted

#446

Post by waldopat »

fsflover wrote: post #405
udev4096 wrote: post #264

Earlier quoted context omitted.

Moxie is wrong, he likes to project his own ideas as wisdom and always factually correct. P2P networks have flourished. Bittorrent, bitcoin, Tor just to name a few successful ones

This. There's a good reply to Moxie's article here: https://news.ycombinator.com/item?id=21936929

Thanks! There's a lot to chew on here, but it's a very important discussion.

Re: The future is not self-hosted

#447

Post by fsflover »

jcgl wrote: post #444
fsflover wrote: post #434

Earlier quoted context omitted.

> When he weighed the tradeoffs for making Signal, he came down on the side of a centralized architecture. And as a result, Signal has a single point of failure and hacker/governments attacks.

Due to its (afaik) unrivaled privacy-preserving architecture, the Signal servers have systematically less info on you than, e.g. a Matrix server. The risks of an attack should therefore be much lower. Oversimplifying a little bit here, but I believe the most likely outcome of a Signal hack would be downtime, rather than a data leak. Contrast that with e.g. matrix.org (where the majority of Matrix users are).

> Contrast that with e.g. matrix.org (where the majority of Matrix users are)

This effectively confirms that federation is important, i.e., you shouldn't use the same server as everyone else, for your security.

> Due to its (afaik) unrivaled privacy-preserving architecture

https://news.ycombinator.com/item?id=29888228

https://news.ycombinator.com/item?id=39445976

https://github.com/signalapp/Signal-Android/issues/13842

https://news.ycombinator.com/item?id=42788647

Re: The future is not self-hosted

#448

Post by scubbo »

pdonis wrote: post #209
scubbo wrote: post #202

Earlier quoted context omitted.

> exposing our services to the public internet You yourself have hand-waved away an important part - security. It's not (just) about the friction of signup (though, I'll get to that later) - it's the fact that you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. And sure, you can give them a login to your VPN, but that doesn't nega…

> you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. You don't have to. The article mentions Tailscale--the whole point of which is to not have any Internet-facing app exposed. Everything is done peer to peer between clients that are behind firewalls. There's nothing listening on an Internet exposed socket for random connections…

Read on in my comment for the more important point about fragmentation. Average non-technical users won't - and shouldn't have to - accept having to switch between different Tailnets to access different instances of similar apps hosted by different people. Heck, most average users would bounce off of the idea of having to install and use Tailscale in the first place.

(I use Tailscale myself for accessing my own private applications while on the go - but I don't believe it's a practical solution for generic widespread access)

Re: The future is not self-hosted

#449

Post by [deleted] »

dzikimarian wrote: post #207
scubbo wrote: post #202

Earlier quoted context omitted.

> exposing our services to the public internet You yourself have hand-waved away an important part - security. It's not (just) about the friction of signup (though, I'll get to that later) - it's the fact that you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. And sure, you can give them a login to your VPN, but that doesn't nega…

Apparently I'm utterly insane for years with no consequences. SaaS/cloud providers propagate this FUD 24/7 and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Relax. Most companies has security team incapable of operating beyond checklist.

[deleted]

Re: The future is not self-hosted

#450

Post by scubbo »

dzikimarian wrote: post #207
scubbo wrote: post #202

Earlier quoted context omitted.

> exposing our services to the public internet You yourself have hand-waved away an important part - security. It's not (just) about the friction of signup (though, I'll get to that later) - it's the fact that you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. And sure, you can give them a login to your VPN, but that doesn't nega…

Apparently I'm utterly insane for years with no consequences. SaaS/cloud providers propagate this FUD 24/7 and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Relax. Most companies has security team incapable of operating beyond checklist.

> [it's fine to expose your services to the Internet, there will be] no consequences.

> and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure.

Pick one. If even the "big boys" can't protect themselves, why do you believe you can?

Post reply on HN