5 ms·

I think you’re really overestimating the ability of most small tech companies to self-host reliably and securely.

fluffything 6y ago
I'm not devops, but how hard is it to properly set up VPN / ssh ? We have a gitlab server, and connecting requires being on VPN, which requires 2FA, and then ssh, which requires your keys to be properly set up.
- postpawl 6y ago
  Parent comment is talking about self hosting “Google Docs, S3, Dropbox, GitHub, Slack“. Running all those things (and more) instead of focusing on your core business is probably a mistake for most companies.
  - fluffything 6y ago
    Ah, gotcha, agree that makes no sense. We only self-host gitlab and zulip.
  - PeterStuer 6y ago
    You could still host it in a country with a less bad track record of industrial espionage.
    - hulitu 6y ago
      > You could still host it in a country with a less bad track record of industrial espionage. Good luck finding one. The world is divided in 3 spheres of influence: US, China and Russia. To make business you must obey one of them.
      - marcusjt 6y ago
        Plus the EU, surely?
        webmaven 6y ago
        > Plus the EU, surely? For most practical purposes, the EU is nested within the US sphere of influence.
        rat9988 6y ago
        US sphere of influence.
  - f1refly 6y ago
    I don't think so. The company I work for is really focused on digital independence. Their core business is industrial electronic component design. The whole supporting office runs on libreoffice, thunderbird, mattermost and nextcloud, all hosted on company premise. They employ two full-time admins, one for the windows clients, the other one for the linux clients (which one can ask for) and servers. This whole setup is, according to them, surprisingly easy to manage and maintain, you just have to find a boss who's willing to try it. Maybe it's different when you're a software shop and really need s3 or something
    - znpy 6y ago
      Indeed. As long as you have decent hardware (cpu/ram mostly) and reliable storage (netapp or something similar) you can get stuff done very easily. Also, most people seems to not have noticed how fast computers and disks got recently and how resources you can pack into a single physical machine: you can nowadays fill a 2u, 2socket machine with 128c/256t (2x amd epyc) and literally terabytes of ram...
  - pilsetnieks 6y ago
    Parent comment is also talking about small companies. Below a certain size all those things (well, equivalent services, not those exactly) don't need more than a single server which is fairly painless. When you grow to a size where you need it at scale, that's where the pain starts.
- msh 6y ago
  It might not be hard, but now you need a number of skilled sysadmin devops people who can also be availble oncall. Thats not a insignificant cost.
- raxxorrax 6y ago
  You have to do some planning, but it isn't too hard. The most issues arise from compromises between security and convenience. Cloud services can offer both in the best case, but aside from O365, which is really sluggish, we are actually in the process of migrating back to on premise solutions. Nobody attacks code repositories of non-software companies anyway, people are after CRM and ERP data. There is the occasional issue with malware from mails and special users, but a backup solution with 15min snapshots solves that issue. Although the latter can cost a bit and might be too expensive for smaller companies.
gigatexal 6y ago
You’d be surprised. We had security that rivaled even the standards required by the banks. Truly crazy high multiple physical key paired with vault and some faraday cage protected offline signing thing — I wasn’t privy to it all just saw bits of it while it was being implemented. Suffice to say it can be done and by going off cloud you get the flexibility to do things like this but... in the end it’s overkill
- postpawl 6y ago
  For every 1 of those crazy high security companies, there’s probably 1000’s that couldn’t secure MongoDB instances.
  - foolmeonce 6y ago
    And they will host it on Amazon, Google or Azure where their firewall admin won't possibly notice..
  - teknopaul 6y ago
    Perimiter security is not vouge but its better than publicly accessible on the Internet. I would argue if are not comfortable with security take it off the Internet and put it in a dmz. You still need security, but it's a more forgiving environment if you get it wrong between setup and pen test.
  - walshemj 6y ago
    They could if the spent the $ and recruited experienced people.
  - dr-detroit 6y ago
    Even the high security ones are stuck using trash products that have to be "behind the firewall" to be "secure" because they run statistical analysis on your HR data (why?????) using peopletools with passwords and logins saved in plaintext .ini files
Cthulhu_ 6y ago
I work for a relatively small company (about 15-20 odd people) and we've got a server rack in the office. It's positioned in a very specific angle (with tape on the floor) along an AC unit because of cooling, but we self-host a lot of our stuff. It's done on a budget as well so we're kinda forced to use open source software. Weirdly enough we use Skype for work chat and Zoom for video meetings, so it feels a bit inconsistent.
- deanCommie 6y ago
  So you're one fire away from a complete company collapse, got it.
rtx 6y ago
This is a new thing. Earlier tech companies use to start with an on premise server.
phkahler 6y ago
What do you think they did before the cloud?
- Frost1x 6y ago
  This is what amazes me. I suspect there's an entire generation of developers and technologists that don't realize we used to manage infrastructure and deploy applications ontop of it. It's like as if somehow, in many eyes, that's impossible now. Depending on your scale, it may be impractical given external hosting options but it's certainly not impossible. Lots of data centers rose and started automated processes of shared hosting and co-locating hardware which was a step forward. I remember working with Rackspace, Equinix, The Planet, etc. which further automated quicker server deployment, had applications for UPS resets/interrupts, etc. The more you moved towards a specific business's automation services, the less portable your infrastructure was outside that environment. That continued on until you now have more sophisticated hosting like what AWS and GC provide. Now, abstractions exist for about everything in a data center and the trade off is that you now have to manage all that complexity through proprietary APIs, consoles, and so forth. In addition, the tradeoff here is the more complex the infrastructure, the less easy it is to shift it to another provider. That may be fine for you, it may also not be. It's all definitely possible though.

I'm not devops, but how hard is it to properly set up VPN / ssh ? We have a gitlab server, and connecting requires being on VPN, which requires 2FA, and then ssh, which requires your keys to be properly set up.

postpawl 6y ago
Parent comment is talking about self hosting “Google Docs, S3, Dropbox, GitHub, Slack“. Running all those things (and more) instead of focusing on your core business is probably a mistake for most companies.
- fluffything 6y ago
  Ah, gotcha, agree that makes no sense. We only self-host gitlab and zulip.
- PeterStuer 6y ago
  You could still host it in a country with a less bad track record of industrial espionage.
  - hulitu 6y ago
    > You could still host it in a country with a less bad track record of industrial espionage. Good luck finding one. The world is divided in 3 spheres of influence: US, China and Russia. To make business you must obey one of them.
    - marcusjt 6y ago
      Plus the EU, surely?
      - webmaven 6y ago
        > Plus the EU, surely? For most practical purposes, the EU is nested within the US sphere of influence.
      - rat9988 6y ago
        US sphere of influence.
- f1refly 6y ago
  I don't think so. The company I work for is really focused on digital independence. Their core business is industrial electronic component design. The whole supporting office runs on libreoffice, thunderbird, mattermost and nextcloud, all hosted on company premise. They employ two full-time admins, one for the windows clients, the other one for the linux clients (which one can ask for) and servers. This whole setup is, according to them, surprisingly easy to manage and maintain, you just have to find a boss who's willing to try it. Maybe it's different when you're a software shop and really need s3 or something
  - znpy 6y ago
    Indeed. As long as you have decent hardware (cpu/ram mostly) and reliable storage (netapp or something similar) you can get stuff done very easily. Also, most people seems to not have noticed how fast computers and disks got recently and how resources you can pack into a single physical machine: you can nowadays fill a 2u, 2socket machine with 128c/256t (2x amd epyc) and literally terabytes of ram...
- pilsetnieks 6y ago
  Parent comment is also talking about small companies. Below a certain size all those things (well, equivalent services, not those exactly) don't need more than a single server which is fairly painless. When you grow to a size where you need it at scale, that's where the pain starts.
msh 6y ago
It might not be hard, but now you need a number of skilled sysadmin devops people who can also be availble oncall. Thats not a insignificant cost.
raxxorrax 6y ago
You have to do some planning, but it isn't too hard. The most issues arise from compromises between security and convenience. Cloud services can offer both in the best case, but aside from O365, which is really sluggish, we are actually in the process of migrating back to on premise solutions. Nobody attacks code repositories of non-software companies anyway, people are after CRM and ERP data. There is the occasional issue with malware from mails and special users, but a backup solution with 15min snapshots solves that issue. Although the latter can cost a bit and might be too expensive for smaller companies.

gigatexal 6y ago

You’d be surprised. We had security that rivaled even the standards required by the banks. Truly crazy high multiple physical key paired with vault and some faraday cage protected offline signing thing — I wasn’t privy to it all just saw bits of it while it was being implemented. Suffice to say it can be done and by going off cloud you get the flexibility to do things like this but... in the end it’s overkill

postpawl 6y ago
For every 1 of those crazy high security companies, there’s probably 1000’s that couldn’t secure MongoDB instances.
- foolmeonce 6y ago
  And they will host it on Amazon, Google or Azure where their firewall admin won't possibly notice..
- teknopaul 6y ago
  Perimiter security is not vouge but its better than publicly accessible on the Internet. I would argue if are not comfortable with security take it off the Internet and put it in a dmz. You still need security, but it's a more forgiving environment if you get it wrong between setup and pen test.
- walshemj 6y ago
  They could if the spent the $ and recruited experienced people.
- dr-detroit 6y ago
  Even the high security ones are stuck using trash products that have to be "behind the firewall" to be "secure" because they run statistical analysis on your HR data (why?????) using peopletools with passwords and logins saved in plaintext .ini files

Cthulhu_ 6y ago

I work for a relatively small company (about 15-20 odd people) and we've got a server rack in the office. It's positioned in a very specific angle (with tape on the floor) along an AC unit because of cooling, but we self-host a lot of our stuff. It's done on a budget as well so we're kinda forced to use open source software. Weirdly enough we use Skype for work chat and Zoom for video meetings, so it feels a bit inconsistent.

deanCommie 6y ago
So you're one fire away from a complete company collapse, got it.

rtx 6y ago

This is a new thing. Earlier tech companies use to start with an on premise server.

phkahler 6y ago

What do you think they did before the cloud?

Frost1x 6y ago
This is what amazes me. I suspect there's an entire generation of developers and technologists that don't realize we used to manage infrastructure and deploy applications ontop of it. It's like as if somehow, in many eyes, that's impossible now. Depending on your scale, it may be impractical given external hosting options but it's certainly not impossible. Lots of data centers rose and started automated processes of shared hosting and co-locating hardware which was a step forward. I remember working with Rackspace, Equinix, The Planet, etc. which further automated quicker server deployment, had applications for UPS resets/interrupts, etc. The more you moved towards a specific business's automation services, the less portable your infrastructure was outside that environment. That continued on until you now have more sophisticated hosting like what AWS and GC provide. Now, abstractions exist for about everything in a data center and the trade off is that you now have to manage all that complexity through proprietary APIs, consoles, and so forth. In addition, the tradeoff here is the more complex the infrastructure, the less easy it is to shift it to another provider. That may be fine for you, it may also not be. It's all definitely possible though.