Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running an open source app: Usage, costs and community donations

spliit.app

Post reply on HN
Print view View original

161–167 of 167 posts

Re: Running an open source app: Usage, costs and community donations

#161

Post by Vegenoid »

mrngm wrote: post #149
wonger_ wrote: post #129

Earlier quoted context omitted.

Could you continue on about security and availability? This is exactly the gentle intro I've been looking for. I'm guessing rate limiting, backups, and monitoring are important, but I'm not sure how to go about it.

I'm not entirely on the same page as the parent comment regarding "[t]hat's what you're paying a good PaaS for" in terms of security and availability. If the platform is down, having a service level agreement (SLA) is nice, but worthless because your application is also unavailable. Depending on how integrated your application is with said platform, migrating to another platform is difficult. If the platform cut corn…

> I'm not entirely on the same page as the parent comment regarding "[t]hat's what you're paying a good PaaS for" in terms of security and availability. If the platform is down, having a service level agreement (SLA) is nice, but worthless because your application is also unavailable.

> If the platform cut corners regarding customer data separation (you know, because you can be cheaper than the competition), your users' passwords may be next on HIBP (haveibeenpwned.com).

This all applies to running on a VPS in the cloud too. You have to own much more of the stack to avoid this than is usually realistic for one person running a free web app.

What I mean about the security and availability being provided for you is that you don't have to worry about configuring a firewall, configuring SSH and Nginx, patching the OS, etc.

Re: Running an open source app: Usage, costs and community donations

#162

Post by Vegenoid »

wonger_ wrote: post #129
Vegenoid wrote: post #75

Earlier quoted context omitted.

Yes, I believe a Droplet or VPS (virtual private server) from some other provider would be sufficient. Digital Ocean isn't the cheapest, but it's pretty frictionless, slick, and has a lot of good tutorial articles about setting up servers. You'd have a Linux machine (the VPS) that would have at least 3 programs running (or it is running Docker, with these programs running inside containers): - Node.js - the database…

Could you continue on about security and availability? This is exactly the gentle intro I've been looking for. I'm guessing rate limiting, backups, and monitoring are important, but I'm not sure how to go about it.

TBH there's more that goes into it than I really want to type out here. LLMs are a good resource for this kind of thing, they generally give correct advice. A quick overview:

Security looks like:

- Ensure SSH (the method by which you'll access the server) is secured. Here is a good article of steps to take to secure SSH on a new server (but you don't have to make your username 16 random characters like the article says): https://hiandrewquinn.github.io/til-site/posts/common-sense-...

- Have a firewall running, which will prevent incoming network connections until you explicitly open ports on the firewall. This helps prevent lack of knowledge and/or misconfiguration of other programs on the server from burning you. The easiest firewall is ufw ("uncomplicated firewall"). Here is a DigitalOcean article that goes into more depth than you probably need at first, or ask Claude/ChatGPT some questions about ufw: https://www.digitalocean.com/community/tutorials/how-to-set-...

- Keep the OS and programs (esp. Nginx/Apache and Node) up to date.

Availability looks like:

- Have a backup of important data (the database). You can set up a 'cron job' that will run a shell script on a schedule that dumps the database to a file (ex. mysqldump) and then copies that file into your backup destination, which could be some cloud storage or another VPS. If you can, backing up to 2 separate destinations is better than one, keeping a history of backups is good, and doing "health checks" of the backup system and the backups is good (meaning periodically check that the backup system is working as intended and that you could restore from a backup if needed)

- Ability to respond to outages, or failure of the host (the server/VPS). This means either having another machine that can be failed over to (probably overkill if you don't have paying customers and an SLA), or you are able to spin up a new server and deploy the app quickly if the server gets borked somehow and goes down. To do that you have some options: have a clear list of instructions that you can manually perform relatively quickly (slowest and most painful), or have automated the deployment process. This is what something like Ansible is for, or you can just use shell scripts. Using Docker can speed up and simplify deployment, since you're building an image that can then be deployed on a new server pretty simply. You will of course also need the backup of the data that you've hopefully been taking.

- Rate limiting may not be necessary depending on the popularity of your site, but it can be useful or necessary and the simplest way is to put your website behind Cloudflare: https://developers.cloudflare.com/learning-paths/get-started...

There are "better" techniques to do all of those that require more know-how, which can prevent and handle more failure scenarios faster or more gracefully, and would be used in a professional context.

Re: Running an open source app: Usage, costs and community donations

#163

Post by carlosjobim »

quesera wrote: post #153
carlosjobim wrote: post #144

Earlier quoted context omitted.

> I am unwilling to accept those obligations, in most cases. This is the argument I keep hearing every time a discussion about open source boils down, and I think it is wrong. Because in truth there is no big commitment if you sell some software for $10 or $20. In worst case if it doesn't work for the customer, you give a refund. When you go out to buy a sandwich or a couple of beers for $10, do you think they are wo…

> there is no big commitment if you sell some software for $10 or $20 This ends up not being true. It creates headaches and contracts both explicit and implied. It creates legal requirements and a for-consideration nexus that is far too complicated to contemplate at this level. Also moral obligation, tax liability, _customers_ to serve. No thank you. Money changes everything. I don't need that overhead in my life. I'…

What is the big headache? I'm curious to know, because I can't see it. I started my first business at a very young age, and had a lot of people around me in my life who tore up heaven and earth, really went ballistic, because in their world you work for somebody else - preferably the government - and receive a salary and that's it. To try to start a small business was one of the worst sins, and surely the IRS and competitors and employees would sue me out of existence just for having a business.

I still don't know what it was (is) with these people? Maybe a religious worshipping of the government and a fear of the IRS that are greater than the fear of God? Thinking that if you make a slight mistake, you'll be imprisoned for life. That was the impression they give. And when developers talk about the big headache of charging for a piece of software, I can't help but thin back to that.

The truth is – and you know it also – that if you sell software for $10, $20 or even $100, there is no contract nor much headache. You can give the money back to a customer who isn't satisfied and that's it. You can have your customer service as minimal as you prefer. You can also legally earn quite a lot of money on it as a side business before having to think about taxes or incorporation. And when that day comes, well congratulations, now you're supporting yourself as an independent developer!

The headache is only in your head.

Re: Running an open source app: Usage, costs and community donations

#164

Post by samatman »

immibis wrote: post #156
aniviacat wrote: post #136

Earlier quoted context omitted.

The economy is not a zero sum game. We (non-politicians/non-billionares) have significantly more resources than we had 100 years ago, and we will have significantly more resources in 100 years than we do now. And open source developers are a small part of why.

The economy is not a zero sum game because we produce more stuff. Money, however, is a zero sum game unless you are Jerome Powell. We produce more stuff because we work hard to produce it, not because venture capitalists have larger bank accounts. Especially in relation to open-source software, this should be obvious. Software exists because someone wrote it, not because a company owner was paid for access to it. Pro…

This is straightforwardly, nakedly, embarrassingly illiterate and wrong.

Money has velocity. The faster it moves around, the more there is. If you're a waiter and you get tipped the same serial-numbered twenty dollar bill five times, you've earned a hundred bucks, not twenty.

When economic productivity increases, there's more to buy, and more people doing and making valuable things which others want to pay them for. This increases the velocity of money, it moves around faster, so it isn't zero sum.

This is taught early in any course of study in economics. Since you don't know the most basic and fundamental facts about the subject, it's not surprising that your conclusions make negative sense.

You could spend two weeks of evenings on YouTube and never again reveal your ignorance in such a naked way. I highly recommend this. You're making perpetual-motion class arguments in a place where people know the second law of thermodynamics. Step your game up.

Re: Running an open source app: Usage, costs and community donations

#165

Post by fulafel »

hypeatei wrote: post #142
tmpz22 wrote: post #21

Earlier quoted context omitted.

You're right but I'll play devil's advocate for teaching purposes: * Usage won't be uniformly distributed and you may need to deal with burst traffic for example when a new version is released and all your users are pulling new config data. * Your application data may be very important to your users and keeping it on a single server is a significant risk. * You're users may be geographically distributed such that a u…

> may be geographically distributed such that a user on the other side of the world may have a severely degraded experience. Okay, am I crazy or can you not really solve this without going full on multi-region setup of everything ? Maybe your web server is closer to them but database requests are still going back to the "main" region which will have latency.

Some serverless DB services claim to offer transparent geo replication (eg AWS DynamoDB, and MS Cosmos which known for being expensive though).

But also most apps don't need low latency.

Re: Running an open source app: Usage, costs and community donations

#166

Post by consteval »

majoe wrote: post #139
consteval wrote: post #90

Earlier quoted context omitted.

It's frustrating too because deployment technologies and tools continue to get better and better. It's never been easier to deploy an application + database to some arbitrary computer. You can do it declaratively, no SSH, no random shell scripts, no suspicious fiddling. Also, sidenote: but for small stuff you can just deploy in your home. I've done it before. It's really not that scary, and odds are you have a comput…

>It's never been easier to deploy an application + database to some arbitrary computer. You can do it declaratively, no SSH, no random shell scripts, no suspicious fiddling. May I ask, what you are using?

Ansible + Docker. The only "catch" is you still have to manage the host. It's trivial with Debian stable, and really the goal is to have a little on the host as possible and as much containerized as possible, so you can automate.

Re: Running an open source app: Usage, costs and community donations

#167

Post by crusty »

carlosjobim wrote: post #163
quesera wrote: post #153

Earlier quoted context omitted.

> there is no big commitment if you sell some software for $10 or $20 This ends up not being true. It creates headaches and contracts both explicit and implied. It creates legal requirements and a for-consideration nexus that is far too complicated to contemplate at this level. Also moral obligation, tax liability, _customers_ to serve. No thank you. Money changes everything. I don't need that overhead in my life. I'…

What is the big headache? I'm curious to know, because I can't see it. I started my first business at a very young age, and had a lot of people around me in my life who tore up heaven and earth, really went ballistic, because in their world you work for somebody else - preferably the government - and receive a salary and that's it. To try to start a small business was one of the worst sins, and surely the IRS and com…

You seem to have a very fixed view of the world, including either an inability or strong reluctance to accept the validity of incentivizing interests that differ from your own. What you find easily acceptable may not be for another. And as 'cheap' is relative, what's cheap for you isn't universally so.

I was once on a volunteer project, clearing destroyed buildings after a disaster. One day after work, the entire group was going over the work all the sub-groups had done that day, and an upper-middle-aged man, who had been out clearing the crumbled remnants of a schoolhouse, was indignant because of the perceived lack of respect shown by the head of the school, who showed up to see what was being done but had failed to personally thank the group (him really) for their efforts. Another guy stood up and countered him that they didn't decide to volunteer so that they could collect thank yous and bask in signs of appreciation - that they didn't know how much our how little their efforts meant at the moment to the people they were doing it for - clearing away the pieces of a fallen building, perhaps one that took lives with it, is just completing the process of destruction after all, so seeing it being done might stir feelings of revisiting the horrors of the devastation. That was the end of the 'thank you' crap.

All that's to say, not everyone values their labor the same way you do or feels the need for it to be recognized as you do. Not everyone has the same relationship with money (as a concept and reality) as you do. These are not things of right and wrong.

I doubt there would be many people who would claim the open source ecosystem is perfect, but such is a barely managed, libre system. You don't have to make demands of it; if you are unable to embrace it, you are also completely free to not.

Post reply on HN