8 ms·

Exactly. I'm constantly surprised how many companies carelessly upload all their internal documents to Google Docs, S3, Dropbox, GitHub, Slack et al. I'd sugges

by ghgr 6y ago

Exactly. I'm constantly surprised how many companies carelessly upload all their internal documents to Google Docs, S3, Dropbox, GitHub, Slack et al. I'd suggest that anything that's not supposed to be public never be uploaded to such services, specially if you are not from the US. The way to go even for small tech companies is self hosting, except maybe for email, due to GMail marking your emails as spam from what I've heard.

fluffything 6y ago
And doing this is so simple. Just host your own gitlab server, and version all your company's IP on git. For chat we use Zulip, which we also self-host. And honestly moving to these tools from slack, confluence, etc. has been awesome. Zulip threading model is great. So much better than slack. And using markdown and jupyter notebooks for documentation on gitlab? Damn awesome.
- CyanBird 6y ago
  I got to use zulip for a big project last year, I do very much recommend it, lots of emotes too which was pretty fun
- ZuLuuuuuu 6y ago
  A few questions: - Is your company mainly a software company? - How much time do you spend on a week on maintaining your servers? - How do you make sure that your servers are secure? Maybe you are being hacked every night, does your company have the means to check if there has been a security breach? - Do you follow/apply the security patches for the OS you are using on the server and all the software you are using on the server? - Do you have regular offline backups? What would happen if there is a fire in your offices? These are some of the reasons to go for a cloud solution, especially when you are not a software company (hence you don't have many people who have the knowledge for setting up/maintaining such stuff) or when you don't have the resources to hire dedicated sysadmins.
  - fluffything 6y ago
    > Is your company mainly a software company? Mostly yes. We obviously have sales, marketing, etc. as well. > - How much time do you spend on a week on maintaining your servers? I don't do devops. There is a team of people that works full-time on IT infrastructure. No idea how time they spend. Gitlab and Zulip servers are updated every couple of weeks. No idea how much time these cost. > - How do you make sure that your servers are secure? Maybe you are being hacked every night, does your company have the means to check if there has been a security breach? There is a team of people that work on cybersecurity monitoring. No idea what they do. Normal IT people just make sure that everyone's computer is encrypted, setting up people's credentials, etc. > Do you follow/apply the security patches for the OS you are using on the server and all the software you are using on the server? I don't do anything, somebody does this for me. > Do you have regular offline backups? What would happen if there is a fire in your offices? We have multiple locations and the backups are replicated across our own locations.
    - ZuLuuuuuu 6y ago
      Thanks for the answers. The reason I asked these questions was because your previous reply started with "And doing this is so simple.". But having full-time teams of devops, cybersecurity and IT is not so simple or cheap after all.
      - paulryanrogers 6y ago
        SAAS it's increasingly requiring security experts in house anyway. Yes the cloud providers can help, but they may also be an unknown liability. Obviously we're not all going to build our own CPUs from sand at a local beach. So there is a balance between DIY and vetted suppliers
postpawl 6y ago
I think you’re really overestimating the ability of most small tech companies to self-host reliably and securely.
- fluffything 6y ago
  I'm not devops, but how hard is it to properly set up VPN / ssh ? We have a gitlab server, and connecting requires being on VPN, which requires 2FA, and then ssh, which requires your keys to be properly set up.
  - postpawl 6y ago
    Parent comment is talking about self hosting “Google Docs, S3, Dropbox, GitHub, Slack“. Running all those things (and more) instead of focusing on your core business is probably a mistake for most companies.
    - fluffything 6y ago
      Ah, gotcha, agree that makes no sense. We only self-host gitlab and zulip.
    - PeterStuer 6y ago
      You could still host it in a country with a less bad track record of industrial espionage.
      - hulitu 6y ago
        > You could still host it in a country with a less bad track record of industrial espionage. Good luck finding one. The world is divided in 3 spheres of influence: US, China and Russia. To make business you must obey one of them.
        marcusjt 6y ago
        Plus the EU, surely?
ornornor 6y ago
My company self hosts everything. They’re so bad at it. Something is always down and we waste so much time with our shorty tooling. We even had this amazing idea that we could implement our own version of GCP from scratch. The result is dismal, we dread using it because it’s very unreliable, and it costs double or triple what GCP costs. We’re not a small company, we have about 1k employees and our business is software.
- brobdingnagians 6y ago
  I've come to appreciate the value of a really good, dedicated sysadmin. I used to think I was pretty good at it and that was fine, but I've come to realize that the skillset for an awesome sysadmin are quite a bit different than a developer, even though there is some overlap. And there is definitely a range.
  - nix23 6y ago
    >quite a bit different than a developer Exactly! I'm a sysadmin (sometimes a Dev), but sysadmin is what i'm really good at. The most important thing is to see a solution from another perspective.
    - nicoburns 6y ago
      As a developer I completely agree. I have some knowledge of system administration, but I much prefer with dedicated professional where possible. It's partly just a different set of expertise, but I think it's partly also why it's best to have dedicated people doing QA work. The attitude required to do the work is completely different to dev work, and it's hard for one person to wear both hats.
      - phist_mcgee 6y ago
        Seconded. A sysadmin dedicates their professional life to deeply understanding systems, networks, and their interconnection. I am lucky if I can keep up with changes to my languages and frameworks as a programmer! Thank goodness there are sysadmins out there who can help us poor programmers out when our relatively basic understanding knowledge of linux fails us.
marvin 6y ago
I work in banking in Europe, one of the internet-only ones. We have super rigid governance routines regarding cloud storage. You can’t store a single byte on any cloud service, even incidentally, without a thorough review ensuring that no customer data is present. Meaning, e.g. there are specific, rigid rules regarding how Postman can be used while developing backend services, to avoid that customer info is inadvertently transmitted during testing. Of course, it’s a PITA, but it serves its purpose.
- joelhaasnoot 6y ago
  Yeah, Postman has gotten dirty. Why the hell should a REST client/testing tool transmit everything to the cloud?
  - agustif 6y ago
    Postwoman might be enough for you if looking for a replacement and it's FOSS
    - thdrdt 6y ago
      Or Insomnia https://insomnia.rest/ https://insomnia.rest/
    - raverbashing 6y ago
      Depending on what you're doing, just use curl
      - thoughtleader31 6y ago
        Just like you could just use nano in place of IntelliJ. But the idea that Postman is actually git in that analogy is hogwash and a way to wrest data out of people.
Cthulhu_ 6y ago
And that's official policy; in a lot of places I've worked at, there's a lot of bring-your-own-device things; self-employed, consultants, etc who are quite casual about using things like dropbox and co to share company data. I mean I like to think the data has no value to e.g. the US or competitors, and that the sheer volume makes it worthless, but I suspect that's just a lack of imagination on my part.
oliwarner 6y ago
But you have to follow through. You can't stop at the cloud and happily use closed source software from (eg) Microsoft or Apple. Or letting people carry Google-powered microphone arrays into meetings in their pockets.
- esperent 6y ago
  I think there's big a difference between using Windows (with local account only) and using Amazon cloud services, in terms of data safety.
junyoon 6y ago
you can encrypt. In face isn't it best practice to encrypt in storage and in transit?
- robertlagrant 6y ago
  This is way too high level a statement, only good for satisfying an auditor. For actual security, it's much harder.
867-5309 6y ago
surely encrypting at source would solve that? wouldn't matter where it's stored so long as it's unintelligible to prying eyes
- kuschku 6y ago
  As the recent court ruling on privacy shield decided: no, it's not, you have to treat encrypted user data just like unencrypted user data, and giving it to US hosters violates EU privacy laws.

by ghgr 6y ago

fluffything 6y ago

And doing this is so simple. Just host your own gitlab server, and version all your company's IP on git. For chat we use Zulip, which we also self-host. And honestly moving to these tools from slack, confluence, etc. has been awesome. Zulip threading model is great. So much better than slack. And using markdown and jupyter notebooks for documentation on gitlab? Damn awesome.

CyanBird 6y ago
I got to use zulip for a big project last year, I do very much recommend it, lots of emotes too which was pretty fun
ZuLuuuuuu 6y ago
A few questions: - Is your company mainly a software company? - How much time do you spend on a week on maintaining your servers? - How do you make sure that your servers are secure? Maybe you are being hacked every night, does your company have the means to check if there has been a security breach? - Do you follow/apply the security patches for the OS you are using on the server and all the software you are using on the server? - Do you have regular offline backups? What would happen if there is a fire in your offices? These are some of the reasons to go for a cloud solution, especially when you are not a software company (hence you don't have many people who have the knowledge for setting up/maintaining such stuff) or when you don't have the resources to hire dedicated sysadmins.
- fluffything 6y ago
  > Is your company mainly a software company? Mostly yes. We obviously have sales, marketing, etc. as well. > - How much time do you spend on a week on maintaining your servers? I don't do devops. There is a team of people that works full-time on IT infrastructure. No idea how time they spend. Gitlab and Zulip servers are updated every couple of weeks. No idea how much time these cost. > - How do you make sure that your servers are secure? Maybe you are being hacked every night, does your company have the means to check if there has been a security breach? There is a team of people that work on cybersecurity monitoring. No idea what they do. Normal IT people just make sure that everyone's computer is encrypted, setting up people's credentials, etc. > Do you follow/apply the security patches for the OS you are using on the server and all the software you are using on the server? I don't do anything, somebody does this for me. > Do you have regular offline backups? What would happen if there is a fire in your offices? We have multiple locations and the backups are replicated across our own locations.
  - ZuLuuuuuu 6y ago
    Thanks for the answers. The reason I asked these questions was because your previous reply started with "And doing this is so simple.". But having full-time teams of devops, cybersecurity and IT is not so simple or cheap after all.
    - paulryanrogers 6y ago
      SAAS it's increasingly requiring security experts in house anyway. Yes the cloud providers can help, but they may also be an unknown liability. Obviously we're not all going to build our own CPUs from sand at a local beach. So there is a balance between DIY and vetted suppliers

postpawl 6y ago

I think you’re really overestimating the ability of most small tech companies to self-host reliably and securely.

fluffything 6y ago
I'm not devops, but how hard is it to properly set up VPN / ssh ? We have a gitlab server, and connecting requires being on VPN, which requires 2FA, and then ssh, which requires your keys to be properly set up.
- postpawl 6y ago
  Parent comment is talking about self hosting “Google Docs, S3, Dropbox, GitHub, Slack“. Running all those things (and more) instead of focusing on your core business is probably a mistake for most companies.
  - fluffything 6y ago
    Ah, gotcha, agree that makes no sense. We only self-host gitlab and zulip.
  - PeterStuer 6y ago
    You could still host it in a country with a less bad track record of industrial espionage.
    - hulitu 6y ago
      > You could still host it in a country with a less bad track record of industrial espionage. Good luck finding one. The world is divided in 3 spheres of influence: US, China and Russia. To make business you must obey one of them.
      - marcusjt 6y ago
        Plus the EU, surely?

ornornor 6y ago

My company self hosts everything. They’re so bad at it. Something is always down and we waste so much time with our shorty tooling. We even had this amazing idea that we could implement our own version of GCP from scratch. The result is dismal, we dread using it because it’s very unreliable, and it costs double or triple what GCP costs. We’re not a small company, we have about 1k employees and our business is software.

brobdingnagians 6y ago
I've come to appreciate the value of a really good, dedicated sysadmin. I used to think I was pretty good at it and that was fine, but I've come to realize that the skillset for an awesome sysadmin are quite a bit different than a developer, even though there is some overlap. And there is definitely a range.
- nix23 6y ago
  >quite a bit different than a developer Exactly! I'm a sysadmin (sometimes a Dev), but sysadmin is what i'm really good at. The most important thing is to see a solution from another perspective.
  - nicoburns 6y ago
    As a developer I completely agree. I have some knowledge of system administration, but I much prefer with dedicated professional where possible. It's partly just a different set of expertise, but I think it's partly also why it's best to have dedicated people doing QA work. The attitude required to do the work is completely different to dev work, and it's hard for one person to wear both hats.
    - phist_mcgee 6y ago
      Seconded. A sysadmin dedicates their professional life to deeply understanding systems, networks, and their interconnection. I am lucky if I can keep up with changes to my languages and frameworks as a programmer! Thank goodness there are sysadmins out there who can help us poor programmers out when our relatively basic understanding knowledge of linux fails us.

marvin 6y ago

I work in banking in Europe, one of the internet-only ones. We have super rigid governance routines regarding cloud storage. You can’t store a single byte on any cloud service, even incidentally, without a thorough review ensuring that no customer data is present. Meaning, e.g. there are specific, rigid rules regarding how Postman can be used while developing backend services, to avoid that customer info is inadvertently transmitted during testing. Of course, it’s a PITA, but it serves its purpose.

joelhaasnoot 6y ago
Yeah, Postman has gotten dirty. Why the hell should a REST client/testing tool transmit everything to the cloud?
- agustif 6y ago
  Postwoman might be enough for you if looking for a replacement and it's FOSS
  - thdrdt 6y ago
    Or Insomnia https://insomnia.rest/ https://insomnia.rest/
  - raverbashing 6y ago
    Depending on what you're doing, just use curl
    - thoughtleader31 6y ago
      Just like you could just use nano in place of IntelliJ. But the idea that Postman is actually git in that analogy is hogwash and a way to wrest data out of people.

Cthulhu_ 6y ago

And that's official policy; in a lot of places I've worked at, there's a lot of bring-your-own-device things; self-employed, consultants, etc who are quite casual about using things like dropbox and co to share company data. I mean I like to think the data has no value to e.g. the US or competitors, and that the sheer volume makes it worthless, but I suspect that's just a lack of imagination on my part.

oliwarner 6y ago

But you have to follow through. You can't stop at the cloud and happily use closed source software from (eg) Microsoft or Apple. Or letting people carry Google-powered microphone arrays into meetings in their pockets.

esperent 6y ago
I think there's big a difference between using Windows (with local account only) and using Amazon cloud services, in terms of data safety.

junyoon 6y ago

you can encrypt. In face isn't it best practice to encrypt in storage and in transit?

robertlagrant 6y ago
This is way too high level a statement, only good for satisfying an auditor. For actual security, it's much harder.

867-5309 6y ago

surely encrypting at source would solve that? wouldn't matter where it's stored so long as it's unintelligible to prying eyes

kuschku 6y ago
As the recent court ruling on privacy shield decided: no, it's not, you have to treat encrypted user data just like unencrypted user data, and giving it to US hosters violates EU privacy laws.