Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A faster heart for F-Droid

f-droid.org

Post reply on HN
Print view View original

71–80 of 231 posts

Re: A faster heart for F-Droid

#71

Post by kube-system »

lrvick wrote: post #45
Aurornis wrote: post #35

> this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access. I can’t be the only one who read this and had flashbacks to projects that fell apart because one person had the physical server in their basement or a rack at their workplace and it became a sticking point when an argu…

400K would go -fast- if they stuck to a traditional colo setup. Donations like this are rare and it may be all they get for a decade. Personally I would feel better about round robin across multiple maintainer-home-hosted machines.

For a server? The going rate for a 1/4 cabinet is $300-500/month.

Re: A faster heart for F-Droid

#72

Post by LoganDark »

0x1ch wrote: post #65
1f60c wrote: post #62

Earlier quoted context omitted.

> a $400,000 grant IDK if they could bag this kind of grant every year, but isn't this the scale where cloud hosting starts to make sense?

You have two options. Colo if you still want physical access to your devices, or cloud, where you get access to nothing beyond some online portals.

Colo is when you want to bring your own hardware, not when you want physical access to your devices. Many (most?) colo datacenters are still secure sites that you can't visit.

Re: A faster heart for F-Droid

#74

Post by anthk »

Good. But I wish PostmarketOS supported more devices. On battery, tons of kernel patches could be set per device plus a config package in order to achieve the best settings. On software and security...you will find more malware in Play Store than the repos from PmOS/Alpine. I know it's not a 100% libre (FSF) system, but that's a much greater step towards freedom than Android, where you don't even own your device.

Re: A faster heart for F-Droid

#75

Post by briffle »

Aurornis wrote: post #35

> this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access. I can’t be the only one who read this and had flashbacks to projects that fell apart because one person had the physical server in their basement or a rack at their workplace and it became a sticking point when an argu…

The OSU Open Source Lab gives machines to groups in their datacenter: https://osuosl.org/services/hosting/

It has hosted quite a few famous services.

Re: A faster heart for F-Droid

#76

Post by Aurornis »

LoganDark wrote: post #73
Aurornis wrote: post #53

Earlier quoted context omitted.

Yes, but that’s not the last or only donation they’re receiving either.

Don't bet on receiving money in the future.

It's a community donation-supported project. That's kind of the whole deal.

Regardless, the ongoing interest on $400K alone would be enough to pay colo fees.

Re: A faster heart for F-Droid

#77

Post by cyberax »

Aurornis wrote: post #52
cyberax wrote: post #41

Earlier quoted context omitted.

I read it a bit differently: you don't need to be a mega-corp with millions of servers to actually make a difference for the better. It really doesn't take much! Also, even 12-year-old hardware is wicked fast.

The issue isn’t the hardware, it’s the fact that it’s hosted somewhere private in conditions they wont name under the control of a single member. Typically colo providers are used for this.

Eh. It's just a different set of trade-offs unless you start doing things super-seriously like Let's Encrypt.

With f-droid their main strength has always been replicable builds. We ideally just need to start hosting a second f-droid server somewhere else and then compare the results.

Re: A faster heart for F-Droid

#78

Post by wtallis »

tcfhgj wrote: post #67
wtallis wrote: post #63

Earlier quoted context omitted.

At the very least, it's reasonable to expect the maintainers of such a project to be open about their situation when it's that precarious. Why wouldn't you take every opportunity to let your users and downstream projects know that the dependency you're providing is operating with no redundancy and barely enough resources to carry on when things aren't breaking? Why wouldn't they want to share with a highly technical…

> when it's that precarious assumptions

They're building all the software on a single server, and at best their fallback is a 12 year old server they might be able to put back in production. I'm not making any unreasonable assumptions, and they're not being forthcoming with any reassuring details.

Re: A faster heart for F-Droid

#79

Post by fruitworks »

kube-system wrote: post #56
valgaze wrote: post #4

Hmm: “F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.”

Yikes. They don't need a "special arrangement" for those requirements. This is the bare minimum at many professionally run colocation data centers. There is not a security requirement that can't be met by a data center -- being secure to customer requirements is a critical part of their business. Maybe the person who wrote that is only familiar with web hosting services or colo-by-the-rack-unit type services where re…

A super duper secure locked cabinet acessible only to them or anyone with a bolt cutter.

You want to host servers on your own hardare? Uh yikes. Let's unpack this. As a certified AWS Kubernetes professional time & money waster, I can say with authority that this goes against professional standards (?) and is therefore not a good look. Furthermore, I can confirm that this isn't it chief.

Re: A faster heart for F-Droid

#80

Post by fruitworks »

lukan wrote: post #24
mcsniff wrote: post #13

Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I underst…

"I understand this is a volunteer effort, but it's not a good look." I would agree, that it is not a good look for this society, to lament so much about the big evil corporations and invest so little in the free alternatives.

You can't just host servers in your own basement! You need to pay out the ass to host servers in some big company's basement!
Post reply on HN