Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Self-Host?

romanzipp.com

Post reply on HN
Print view View original

241–250 of 269 posts

Re: Why Self-Host?

#241

Post by forever_frey »

ikawe wrote: post #112
BinaryIgor wrote: post #71

"Many many years ago I was running an Android phone with Google services like Google Maps. One day I was looking for a feature in my Google account and saw that GMaps recorded my location history for years with detailed geocoordinates about every trip and every visit. I was fascinated but also scared about that since I've never actually enabled it myself. I do like the fact that I could look up my location for every…

One tricky thing about maps, as they relate to privacy, is that the earth is large. Compare that to encrypted email: if I’m sending you an encrypted message, the total data involved is minimal. To a first approximation, it’s just the message contents. But if I want “Google Maps but private,” I first need access to an entire globe’s worth of data, on the order of terabytes. That’s a lot of storage for your (usually mo…

The entire planet's worth reverse geocoding data is ~120gb. The map tiles file for whole planet is also ~120gb, and they both are precompiled, so you don't need hundreds of gbs of RAM to run your local planet. It's easier than you probably think nowadays. Not mobile-size, but local server-size

Re: Why Self-Host?

#242

Post by underlines »

Even though I work as an IT Professional, I was almost always the only person not self hosting anything at home and not having a NAS.

I jumped the hoop and bought a Ugreen nas with 4 bays where the first thing I did was installing TrueNAS CE onto it and then use ChatGPT with highly customized prompts and the right context (my current docker-compose files).

Without much previous knowledge of docker, networking etc. except what I remembered from my IT vocational education from 15 years ago, I now have:

- Dockerized Apps

- App-Stacks in their own App-Network

- Apps that expose web UI not via ports, but via Traefik + Docker labels

- Only Traefik 443 ports reachable from WAN, plus optional port forwarding for non-http services

- Optional Cloudflare Tunnel

- Automatic Traefik TLS termination for LAN and WAN for my domain

- Split-DNS to get hostnames routed properly on LAN and WAN

- CrowdSec for all exposed containers

- Optional MFA via Cloudflare for exposed services

- Local DHCP/DNS via Technitium

- Automatic ZFS snapshots and remote backups

- Separation between ephemeral App data (DBs, Logs) on SSD and large files on HDD

Re: Why Self-Host?

#243

Post by lewiscollard »

mikepurvis wrote: post #103
codegeek wrote: post #21

"start self-hosting more of your personal services." I would make the case that you should also self host more as a small Software/SAAS business and it is not quite the boogeyman that a lot of cloud vendors want you to think. Here is why. Most software projects/businesses don't require the scale and complexity for which you truly need the cloud vendors and their expertise. For example, you don't need Vercel to deploy…

The main thing that gives me anxiety about this is the security surface area associated with "managing" a whole OS— kernel, userland, all of it. Like did I get the firewall configured correctly, am I staying on top of the latest CVEs, etc. For that reason alone I'd be tempted to do GHA workflow -> build container image and push to private registry -> trivial k8s config that deploys that container with the proper port…

> The main thing that gives me anxiety about this is the security surface area associated with "managing" a whole OS— kernel, userland, all of it. Like did I get the firewall configured correctly, am I staying on top of the latest CVEs, etc.

I've had a VPS facing the Internet for over a decade. It's fine.

  $ $ ls -l /etc/protocols 
  -rw-r--r-- 1 root root 2932 Dec 30  2013 /etc/protocols
I would worry more about security problems in whatever application you're running on the operating system than I would the operating system.

Re: Why Self-Host?

#244

Post by carlosjobim »

sksksk wrote: post #197
carlosjobim wrote: post #60

Earlier quoted context omitted.

The custom domain is all you need for complete e-mail sovereignty. As long as you have it, you can select between hundreds (thousands?) of providers, and take your business elsewhere at any time.

You risk losing your historical emails if you don’t back them up somewhere

Of course you use e-mail clients, so that you have your mails on at least one device. And separate backup as well.

Re: Why Self-Host?

#245

Post by mikepurvis »

manmal wrote: post #238
rrix2 wrote: post #212

Earlier quoted context omitted.

a static site is served by a webserver, but the software to generate it runs elsewhere.

Yes. And a web server has an attack surface, no?

I think it’s reasonable to understand that nginx/caddy serving static files (or better yet a public s3 bucket doing so) is way, way less of a risk than a dynamic application.

Re: Why Self-Host?

#246

Post by manmal »

mikepurvis wrote: post #245
manmal wrote: post #238

Earlier quoted context omitted.

Yes. And a web server has an attack surface, no?

I think it’s reasonable to understand that nginx/caddy serving static files (or better yet a public s3 bucket doing so) is way, way less of a risk than a dynamic application.

Of course, that’s true for those web servers. If kept up to date. If not, the attack surface is actually huge because exploits are well known.

Re: Why Self-Host?

#247

Post by moehm »

manmal wrote: post #237
moehm wrote: post #213

Earlier quoted context omitted.

Yes, but the web server is just reading files from disk and not invoking an application server. So if you keep your web server up to date, you are at a much lesser risk than if you would also have to keep your application + programming environment secure.

That really depends on the web server, and the web app you'd otherwise be writing. If it's a shitty static web server, than a JVM or BEAM based web app might be safer actually.

Uh, yeah, I thought about Nginx or Apache and would expect them to be more secure then your average self-written application.

Re: Why Self-Host?

#248

Post by seec »

abdullahkhalids wrote: post #27

20 years ago grandpa could go to limewire.com, download setup.exe and click next->next->next to install a fully functional file hosting server+client. It was so easy that 1/3rd of world's computers had limewire installed in 2007 [1]. ONE FUCKING THIRD! Today, to install even the simplest self-hosted software, one has to be effectively a professional software engineer. Use SSH, Use Docker, use tailscale, understand TL…

I agree, software development has become insane. It's basically people creating problems to justify their existence, very much like the bureaucrats.

The reality is that the vast majority of people don't really need "self-hosting", what they would need is a decent software that they can run on their computer and let others access the data from time to time, mostly locally because global availability is rarely worth the hassle.

But since there is not much money into that and devs are enamored with insane layers of complexities and obtuse use case that are irrelevant for the vast majority we get the server software, that relies on web views and have a large disconnect with the data on a local machine. You just had another layer of stuff to manage on yet another computer when most already have one sitting idle the vast majority of time. I think the laptop craze is also partly to blame.

Even good local Mac apps have dried up and now it's all cloud-based subscription software, and you are supposed to be thankful you can install open-source stuff with a docker image and god knows how many configuration steps and gotchas.

Many of those softwares would be desirable and worth a bit of money if only you could just have a simple installation and management process but instead you have to pay with your time, which is not worth it for most. So, at this point, people just say fuck it and pay someone else, usually one of the big tech providers to take care of the problem and that's that.

As much as I like web technology for interactive documents, the software use case is still largely a pain in the ass.

Re: Why Self-Host?

#249

Post by seec »

j23n wrote: post #190

I've stepped back from self-hosting after realizing that 90% of my use case was to keep calendar/contacts/files/photos/passwords in sync between my laptop and phone. I'm now experimenting with a files-based approach, using syncthing for the p2p syncing, and it works really well. No VPS or home server to setup and maintain, no security worries, no database migrations, no extra backups, no tinkering with Caddy configs.

Yes that's what I think as well.

The problem is that we have all been tricked into cloud syncing because big tech couldn't figure out proper local sync and they actually have incentives not to because they would really like you to pay to their subscriptions for storage on which they have great margins.

Yet for the vast majority of people what would be needed is just very simple syncing between their phone and personal computer. It should work with a cable for speed but also wirelessly for convenience and that's it.

All the crap they add on top is mostly overengineered crap that sometimes doesn't even work and creates interdependence/lock-in.

Re: Why Self-Host?

#250

Post by mikepurvis »

interroboink wrote: post #165
mikepurvis wrote: post #103

Earlier quoted context omitted.

The main thing that gives me anxiety about this is the security surface area associated with "managing" a whole OS— kernel, userland, all of it. Like did I get the firewall configured correctly, am I staying on top of the latest CVEs, etc. For that reason alone I'd be tempted to do GHA workflow -> build container image and push to private registry -> trivial k8s config that deploys that container with the proper port…

> Run that on someone else's managed k8s setup ... this way I'm only responsible for my application and its interface. It's the eternal trade-off of security vs. convenience. The downside of this approach is that if there is a vulnerability, you will need to wait on someone else to get the fix out. Probably fine nearly always, but you are giving up some flexibility. Another way to get a reasonable handle on the "mana…

I think for a normal shlub like me who is unlikely to be on top of everything it’s really more of a cost / convenience tradeoff.

It might take Amazon or Google a few hours or a day to deploy a critical zero-day patch but that’s in all likelihood way better than I’d do if it drops while I’m on vacation or something.

Post reply on HN