4 ms·

Ok, I’m SUPER into self hosting, but this article? No way. 1) Duck out isn’t a thing, just stop it. 2) Half the articles cited as examples of corporate abuse we

Ok, I’m SUPER into self hosting, but this article? No way. 1) Duck out isn’t a thing, just stop it. 2) Half the articles cited as examples of corporate abuse were later revealed to be mistakes by the user or easily avoidable pitfalls. 3) Self hosting still requires trust (software you’re running, DNS, domains, ISP, etc...) The line of who to trust and how far is a tough one to answer, even for the informed. How I solved it: 1) I use well vetted cloud services for things that are difficult/impossible to self host or have a low impact if lost. (Email, domains, github, etc...) 2) I self host things that are absolutely critical with cloud backups. (Files, Photos, code, notes, etc..)

ziml77 6y ago
I am perpetually confused about why people think that self-hosting on a VPS solves their privacy and security problems. While I'm sure there are controls in place at reputable VPS providers, it wouldn't be too difficult for them to grab absolutely anything they want. Even disk encryption doesn't save you. You're in a VM, they can watch the memory if they need to. Using a VPS can also make you more identifiable. Your traffic isn't as easily lost in the noise. The worst thing that I know of people doing is using a VPS for VPN tunneling. While it can have its uses, privacy certainly isn't one of them. You're the only one connecting into it and the only traffic coming out of it.
- judge2020 6y ago
  A setup that probably works is vps -> tor -> vpn or some other order of these three, but I couldn't find any sort of blog that detailed setting up something like this so I imagine very few people are doing it.
- lisper 6y ago
  VPS doesn't solve privacy and security, it solves getting locked out of your account because some algorithm decided you were peddling child porn. If you want privacy and security and you don't trust your provider, then you have to build your own hardware and compile everything you run on it from vetted source, including your kernel. You can do it, but most people decide that on balance its better to trust someone.
  - kmonsen 6y ago
    Howso? The VPS can shut you down as well? You might say the migration path is easier, but there will be a weak link somewhere. Even if you put up a datacenter in the basement you need to connect to the internet somehow which can be taken away.
    - lisper 6y ago
      > Howso? The VPS can shut you down as well? Yes. but VPS is a standardized commodity. If one provider shuts you down you can just switch to another.
  - reaperducer 6y ago
    VPS doesn't solve privacy and security, it solves getting locked out of your account Does it really? It just seems like instead of trusting a big company that everyone knows, you trust a smaller company that not everyone knows that involves more work for you. I'm pretty sure I've seen articles on HN where VPS companies (maybe DO?) have kicked people off their infrastructure with zero notice. So, not at all different from being locked out of Apple/Google/Amazon.
    - lisper 6y ago
      > Does it really? Yes. VPS is a standardized commodity. If one provider shuts you down you can just move to another.
      - imwillofficial 6y ago
        Perhaps, depends on your needs, risk model, pricing etc... I use DO but couldn’t use AWS due to price for example. Hoping platforms whenever you catch the ire of the gods is a bad CX for this problem space.
        lisper 6y ago
        You're the second person to mention DO. I have no idea what that is. But here is a list of 20 VPS providers: https://techjury.net/best/vps-hosting/ https://techjury.net/best/vps-hosting/ As you can see, AWS is far from the only game in town. If you can't find two or three from that list that will meet your needs then perhaps you should reassess your quality metric. (I note in passing that my preferred provider, Linode, is not even on that list.)
- imwillofficial 6y ago
  So I agree with your sentiment, your details are a little off. “it wouldn't be too difficult for them to grab absolutely anything they want. Even disk encryption doesn't save you. You're in a VM, they can watch the memory if they need to.” It would be difficult because you’d have to have host access. VM disk encryption is now tied into an HSM or TPM these days, host access wouldn’t help. As for memory, that is now usually encrypted, so no dice there either. The security of a big name public VPS is astoundingly better than what you can do yourself. “Using a VPS can make you more identifiable” I think you have a problem of “threat model” here. You’re mixing up hiding against hackers, governments, etc and just lumping it under “privacy and security” Using a VPS isn’t going to make you more identifiable to google, because you’re not using google now. Using a VPN isn’t going to make you more identifiable to your ISP, because all they can see is that you have a VPN up. Why not use a VPS for VPN? Well you’re only right it would suck if your threat model includes governments or hostile actors, me hiding from my ISP or on a public Wi-Fi? Not a problem. You conflate a few ideas and threat models. Security = The ability to not have your stuff accessed or changed. Privacy = The ability to not have your stuff seen. Anonymity = The ability to not have your stuff linked back to you. Threat model = Who are you protecting yourself from? E.g. The steps I take to not get hacked by the NSA are going to be different then the steps I use to make comments on 4chan or whatever are different than the steps I take to use public Wi-Fi. Ref: I work for Amazon AWS, my opinions are my own insane ramblings.
  - aksss 6y ago
    > Encryption tied to TPM Common on laptops, but I wouldn’t assume that for systems/SANs in a data center, much less their virtual disks. Would love to be corrected.
    - benlivengood 6y ago
      AMD secure memory encryption and secure encrypted virtualization. Intel probably has something in the works, but today you can take a GCE instance from a signed coreboot through bootloader and kernel with logged attestation at each phase resulting in a VM using per-VM disk encryption key (you have to provide it in the RPC that starts the machine; it's supposedly otherwise ephemeral) with SME encrypted RAM (again, ephemeral per-machine key). Google calls it Confidential VM and Secure Boot for now.
- stkdump 6y ago
  With rclone you can encrypt data locally while uploading. This allows you to host everything from home and use the cloud only for backups, basically end-to-end encrypted.
- whatsmyusername 6y ago
  Vultr/Choopa specifically is like the number 2 source of malicious hosting company traffic we see (number 1 is OVH, cisco's written extensively about them). They're blacklisted in every environment I touch along with LACNIC and the usual suspects like China and Russia. Their traffic isn't worth it.
- deleted 6y ago
  [deleted]
paxys 6y ago
I always think of it as – how many examples of "I got locked out of all my data!" would there be if billions of people start following the author's advice? Definitely more than the ~5 they list (whether that is user error or actually Apple/Google/Amazon's fault).
mackrevinack 6y ago
the 'duck it out' thing really made me cringe. we really need to get away from that idea of having a searching verb that is tied to the popular search engines of the day. i use duckduckgo but it might not be around in 10 or 20 years or there might be something better by then so its pointless to expect everyone to keep learning new verbs all the time.
zupa-hu 6y ago
> 1) Duck out isn’t a thing, just stop it. Well, 1) sorry but you don't get to decide this, 2) how would anything ever become a thing if people were not allowed to invent new things? - I'm not favoring the term just opposing your commanding
- imwillofficial 6y ago
  I do get to decide, as a member of popular culture, I get a say. (So do you!) And I say a resounding “no!” To duck it out.

ziml77 6y ago

I am perpetually confused about why people think that self-hosting on a VPS solves their privacy and security problems. While I'm sure there are controls in place at reputable VPS providers, it wouldn't be too difficult for them to grab absolutely anything they want. Even disk encryption doesn't save you. You're in a VM, they can watch the memory if they need to. Using a VPS can also make you more identifiable. Your traffic isn't as easily lost in the noise. The worst thing that I know of people doing is using a VPS for VPN tunneling. While it can have its uses, privacy certainly isn't one of them. You're the only one connecting into it and the only traffic coming out of it.

judge2020 6y ago
A setup that probably works is vps -> tor -> vpn or some other order of these three, but I couldn't find any sort of blog that detailed setting up something like this so I imagine very few people are doing it.
lisper 6y ago
VPS doesn't solve privacy and security, it solves getting locked out of your account because some algorithm decided you were peddling child porn. If you want privacy and security and you don't trust your provider, then you have to build your own hardware and compile everything you run on it from vetted source, including your kernel. You can do it, but most people decide that on balance its better to trust someone.
- kmonsen 6y ago
  Howso? The VPS can shut you down as well? You might say the migration path is easier, but there will be a weak link somewhere. Even if you put up a datacenter in the basement you need to connect to the internet somehow which can be taken away.
  - lisper 6y ago
    > Howso? The VPS can shut you down as well? Yes. but VPS is a standardized commodity. If one provider shuts you down you can just switch to another.
- reaperducer 6y ago
  VPS doesn't solve privacy and security, it solves getting locked out of your account Does it really? It just seems like instead of trusting a big company that everyone knows, you trust a smaller company that not everyone knows that involves more work for you. I'm pretty sure I've seen articles on HN where VPS companies (maybe DO?) have kicked people off their infrastructure with zero notice. So, not at all different from being locked out of Apple/Google/Amazon.
  - lisper 6y ago
    > Does it really? Yes. VPS is a standardized commodity. If one provider shuts you down you can just move to another.
    - imwillofficial 6y ago
      Perhaps, depends on your needs, risk model, pricing etc... I use DO but couldn’t use AWS due to price for example. Hoping platforms whenever you catch the ire of the gods is a bad CX for this problem space.
      - lisper 6y ago
        You're the second person to mention DO. I have no idea what that is. But here is a list of 20 VPS providers: https://techjury.net/best/vps-hosting/ https://techjury.net/best/vps-hosting/ As you can see, AWS is far from the only game in town. If you can't find two or three from that list that will meet your needs then perhaps you should reassess your quality metric. (I note in passing that my preferred provider, Linode, is not even on that list.)
imwillofficial 6y ago
So I agree with your sentiment, your details are a little off. “it wouldn't be too difficult for them to grab absolutely anything they want. Even disk encryption doesn't save you. You're in a VM, they can watch the memory if they need to.” It would be difficult because you’d have to have host access. VM disk encryption is now tied into an HSM or TPM these days, host access wouldn’t help. As for memory, that is now usually encrypted, so no dice there either. The security of a big name public VPS is astoundingly better than what you can do yourself. “Using a VPS can make you more identifiable” I think you have a problem of “threat model” here. You’re mixing up hiding against hackers, governments, etc and just lumping it under “privacy and security” Using a VPS isn’t going to make you more identifiable to google, because you’re not using google now. Using a VPN isn’t going to make you more identifiable to your ISP, because all they can see is that you have a VPN up. Why not use a VPS for VPN? Well you’re only right it would suck if your threat model includes governments or hostile actors, me hiding from my ISP or on a public Wi-Fi? Not a problem. You conflate a few ideas and threat models. Security = The ability to not have your stuff accessed or changed. Privacy = The ability to not have your stuff seen. Anonymity = The ability to not have your stuff linked back to you. Threat model = Who are you protecting yourself from? E.g. The steps I take to not get hacked by the NSA are going to be different then the steps I use to make comments on 4chan or whatever are different than the steps I take to use public Wi-Fi. Ref: I work for Amazon AWS, my opinions are my own insane ramblings.
- aksss 6y ago
  > Encryption tied to TPM Common on laptops, but I wouldn’t assume that for systems/SANs in a data center, much less their virtual disks. Would love to be corrected.
  - benlivengood 6y ago
    AMD secure memory encryption and secure encrypted virtualization. Intel probably has something in the works, but today you can take a GCE instance from a signed coreboot through bootloader and kernel with logged attestation at each phase resulting in a VM using per-VM disk encryption key (you have to provide it in the RPC that starts the machine; it's supposedly otherwise ephemeral) with SME encrypted RAM (again, ephemeral per-machine key). Google calls it Confidential VM and Secure Boot for now.
stkdump 6y ago
With rclone you can encrypt data locally while uploading. This allows you to host everything from home and use the cloud only for backups, basically end-to-end encrypted.
whatsmyusername 6y ago
Vultr/Choopa specifically is like the number 2 source of malicious hosting company traffic we see (number 1 is OVH, cisco's written extensively about them). They're blacklisted in every environment I touch along with LACNIC and the usual suspects like China and Russia. Their traffic isn't worth it.
deleted 6y ago
[deleted]

paxys 6y ago

I always think of it as – how many examples of "I got locked out of all my data!" would there be if billions of people start following the author's advice? Definitely more than the ~5 they list (whether that is user error or actually Apple/Google/Amazon's fault).

mackrevinack 6y ago

the 'duck it out' thing really made me cringe. we really need to get away from that idea of having a searching verb that is tied to the popular search engines of the day. i use duckduckgo but it might not be around in 10 or 20 years or there might be something better by then so its pointless to expect everyone to keep learning new verbs all the time.

zupa-hu 6y ago

> 1) Duck out isn’t a thing, just stop it. Well, 1) sorry but you don't get to decide this, 2) how would anything ever become a thing if people were not allowed to invent new things? - I'm not favoring the term just opposing your commanding

imwillofficial 6y ago
I do get to decide, as a member of popular culture, I get a say. (So do you!) And I say a resounding “no!” To duck it out.