3 ms·

> Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it

by scotu 10y ago

> Either I centralize it, in which case I have to deal with data security [...] Instead, with sandstorm, I package up my rails app as a sandstorm app and put it in their app store, and anyone who wants a budgeting app can easily install and run it on their own private server. you just made a case for NOT using a self hosted opensource app EDIT: extended the quoted text for better context

Xylakant 10y ago
no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
- scotu 10y ago
  I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
  - kentonv 10y ago
    No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.

by scotu 10y ago

Xylakant 10y ago

no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team. Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.

scotu 10y ago
I may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
- kentonv 10y ago
  No, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.