4 ms·
no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown im
by Xylakant 10y ago
no, he hasn't. If he hosts the app on a central server he gets to keep data that needs to be reachable via the internet and may be of varying, to him unknown importance. He's a single developer with no ops team.
Anybody using it may either have an organization that can support hosting or may be in a position to host it on a secure, internal network or may have data that is of low importance anyways. The user of the app is in a much better position to assert the value and evaluate the damage of a breach/loss.
- scotu 10y agoI may have read the comment I was quoting wrong but what I read was: if I, as a developer, create this software and centralize it/sell it as a service, I will have to deal with making sure data is secure (otherwise I get sued), while if I distribute with sandstorm, no need to care about securing the data, it's on the user! I hope we can agree that having software available outside a private network is something of value, so I really hope that if I use sandstorm the apps contained are not designed to rely on being deployed on an internal network... Note: I extended my previous comment's quoted text for better context on that reply
- kentonv 10y agoNo, Sandstorm does not rely on being behind a firewall. Sandstorm sandboxes apps and enforces access control on them such that security bugs in the apps themselves are almost entirely mitigated. See: https://docs.sandstorm.io/en/latest/using/security-non-events/ https://docs.sandstorm.io/en/latest/using/security-non-event... Meanwhile Sandstorm itself is designed to manage its own security, e.g. by automatically updating, relying on hard-to-do-wrong authentication mechanisms (i.e. not passwords), etc., so that users running their own server do not need to know about server security.