5 ms·

I feel like everybody is overestimating the cost of self hosting. I run my own instance of GitLab, but the "costly" part was setting it up and making backups. S

I feel like everybody is overestimating the cost of self hosting. I run my own instance of GitLab, but the "costly" part was setting it up and making backups. Since then I just "apt-get upgrade" and there is a new version and that's it. Since I set it up, I haven't touched any of the configuration files. The availability guarantees are much easier to keep for a small team than for thousands, so you don't really have to worry about that either.

themacguffinman 8y ago
You're ignoring the cost for community projects where the community now needs to invest in learning and using your own self-hosted repo, which may or may not have a good UX. This is a barrier to entry.
- Walkman 8y ago
  I agree with this, but the cost is centralization and single point of failure.
  - sametmax 8y ago
    Sure. No free lunch. It's just important to understand the nature and size of the costs, so that you can make the trade off adapted to your context.
sametmax 8y ago
Don't you forget a little something ? Buying the server, reading the docs, setting it up, buying an URL domain, binding it to the server, getting the backup server, setting it up, testing that everything works, training the team on the new UI, documenting the whole things for when you are not available or it's not your job anymore, blocking one team of 5 devs from working for 2 hours (or a man day of work) because something went wrong just once... It's not just resources you spend on useless things. It's resources you take __from__ useful things. Or worst, you are in a company. Now you have to REQUEST a server, ask a sysadmin to set it up, the security team to approve your software, the budget to validate the payment and the blessing of your network authorities. Then, you change job/client/whatever. What do you do ? Do it again ?
- erichurkman 8y ago
  Isn't that why GitLab (and others) publish things like AMIs where config is easy and takes 10 minutes? https://about.gitlab.com/aws/ https://about.gitlab.com/aws/
  - sametmax 8y ago
    Aaaah, the infamous "10 minutes" sale pitch. I think it's getting 10 minutes years old to this day.
    - macromaniac 8y ago
      It doesnt take long to set up iirc, the problem when I used gitlab was it was resource intensive. It somehow takes a 10$mo instance when it should be able to run as a side process on a 2.50$mo server imo. 10$mo was the same pricing as github so it didn't make sense to use.
      - stealthmodeclan 8y ago
        Which place sells server for 2.50?
        macromaniac 8y ago
        There are a few but I use vultr
        sametmax 8y ago
        ovh
      - 0x6c6f6c 8y ago
        Honestly for resource efficient Git service people should use (and I've seen it shared places lately) Gitea or Gogs. Gitea is a fork of Gogs but picked up pace and has multiple maintainers who care a lot for it. It uses minimal resources and looks good. $2.50 server on Vultr with 512MB RAM should cover it.
MBCook 8y ago
How often do you test your backups? How many places (physical) do they exist? How often are they taken? What’s your server’s uptime? Is it highly available? How often do you patch? Do you test them first? How do you keep up with security updates from other software on the machine(s). How is your security team in general? Do they monitor for stolen credentials? Do pen-tests? Watch for network scans and attacks? Look for weird traffic patterns? Do you have redundant network links? Backup generators? Do you test them? Sure your datacenter SAYS they have them, but remember when Intuit went down for 2 days a few years ago? I bet they had told their bosses they had generator backups. Is someone always on call? What are they experts in? How do you get support? GitHub provides a TON of stuff above a cheap VPS or EC2 instance. And that’s not including the network effects of having so many projects in the same site.
- hueving 8y ago
  Yet github has still had outages from being the target of nation-state attacks. The bigger the service, the worse the enemies.
  - sametmax 8y ago
    I have the simplest self hosted wordpress blog. That's not really what I'd call "critical infra". It still goes down a few time a year. My non self hosted blog ? Maybe a few hours a year, and I don't have to do anything to restore it.
- Walkman 8y ago
  > What’s your server’s uptime? Is it highly available? Who cares about uptime, when you use a server alone or with a small team? It can be down for 10 hours and you would not even notice. You don't understand what you need. > How often do you patch? I patch the machine multiple times a week with some "apt update && apt upgrade" which takes literally less then a couple of minutes a week. > Do you test them first? I don't need to because I'm using ZFS and make a snapshot before upgrades, so in case of a disaster (which already happened multiple times) I can roll back within minutes, which happened multiple times, once when the machine didn't even booted. > How is your security team in general? Do they monitor for stolen credentials? Do pen-tests? Watch for network scans and attacks? Look for weird traffic patterns? You don't need any of that. If you think you do, you think you are far more important than you really are. Maybe framework authors or super-popular library writers would need to worry about that, but self-hosting makes you an order of magnitude lower chance of being a target. > Is someone always on call? What are they experts in? How do you get support? We might not talk about the same thing... > And that’s not including the network effects of having so many projects in the same site. This is the only valid point you came up with.

themacguffinman 8y ago

You're ignoring the cost for community projects where the community now needs to invest in learning and using your own self-hosted repo, which may or may not have a good UX. This is a barrier to entry.

Walkman 8y ago
I agree with this, but the cost is centralization and single point of failure.
- sametmax 8y ago
  Sure. No free lunch. It's just important to understand the nature and size of the costs, so that you can make the trade off adapted to your context.

sametmax 8y ago

Don't you forget a little something ? Buying the server, reading the docs, setting it up, buying an URL domain, binding it to the server, getting the backup server, setting it up, testing that everything works, training the team on the new UI, documenting the whole things for when you are not available or it's not your job anymore, blocking one team of 5 devs from working for 2 hours (or a man day of work) because something went wrong just once... It's not just resources you spend on useless things. It's resources you take __from__ useful things. Or worst, you are in a company. Now you have to REQUEST a server, ask a sysadmin to set it up, the security team to approve your software, the budget to validate the payment and the blessing of your network authorities. Then, you change job/client/whatever. What do you do ? Do it again ?

erichurkman 8y ago
Isn't that why GitLab (and others) publish things like AMIs where config is easy and takes 10 minutes? https://about.gitlab.com/aws/ https://about.gitlab.com/aws/
- sametmax 8y ago
  Aaaah, the infamous "10 minutes" sale pitch. I think it's getting 10 minutes years old to this day.
  - macromaniac 8y ago
    It doesnt take long to set up iirc, the problem when I used gitlab was it was resource intensive. It somehow takes a 10$mo instance when it should be able to run as a side process on a 2.50$mo server imo. 10$mo was the same pricing as github so it didn't make sense to use.
    - stealthmodeclan 8y ago
      Which place sells server for 2.50?
      - macromaniac 8y ago
        There are a few but I use vultr
      - sametmax 8y ago
        ovh
    - 0x6c6f6c 8y ago
      Honestly for resource efficient Git service people should use (and I've seen it shared places lately) Gitea or Gogs. Gitea is a fork of Gogs but picked up pace and has multiple maintainers who care a lot for it. It uses minimal resources and looks good. $2.50 server on Vultr with 512MB RAM should cover it.

MBCook 8y ago

How often do you test your backups? How many places (physical) do they exist? How often are they taken? What’s your server’s uptime? Is it highly available? How often do you patch? Do you test them first? How do you keep up with security updates from other software on the machine(s). How is your security team in general? Do they monitor for stolen credentials? Do pen-tests? Watch for network scans and attacks? Look for weird traffic patterns? Do you have redundant network links? Backup generators? Do you test them? Sure your datacenter SAYS they have them, but remember when Intuit went down for 2 days a few years ago? I bet they had told their bosses they had generator backups. Is someone always on call? What are they experts in? How do you get support? GitHub provides a TON of stuff above a cheap VPS or EC2 instance. And that’s not including the network effects of having so many projects in the same site.

hueving 8y ago
Yet github has still had outages from being the target of nation-state attacks. The bigger the service, the worse the enemies.
- sametmax 8y ago
  I have the simplest self hosted wordpress blog. That's not really what I'd call "critical infra". It still goes down a few time a year. My non self hosted blog ? Maybe a few hours a year, and I don't have to do anything to restore it.
Walkman 8y ago
> What’s your server’s uptime? Is it highly available? Who cares about uptime, when you use a server alone or with a small team? It can be down for 10 hours and you would not even notice. You don't understand what you need. > How often do you patch? I patch the machine multiple times a week with some "apt update && apt upgrade" which takes literally less then a couple of minutes a week. > Do you test them first? I don't need to because I'm using ZFS and make a snapshot before upgrades, so in case of a disaster (which already happened multiple times) I can roll back within minutes, which happened multiple times, once when the machine didn't even booted. > How is your security team in general? Do they monitor for stolen credentials? Do pen-tests? Watch for network scans and attacks? Look for weird traffic patterns? You don't need any of that. If you think you do, you think you are far more important than you really are. Maybe framework authors or super-popular library writers would need to worry about that, but self-hosting makes you an order of magnitude lower chance of being a target. > Is someone always on call? What are they experts in? How do you get support? We might not talk about the same thing... > And that’s not including the network effects of having so many projects in the same site. This is the only valid point you came up with.