4 ms·

This is a pokemon fansite that's old enough to drink that was just running on xenforo and wordpress. There probably is no "production vs staging" or immutabilit

by ev1 5y ago

This is a pokemon fansite that's old enough to drink that was just running on xenforo and wordpress. There probably is no "production vs staging" or immutability or ZFS snapshots, or large amounts of engineering going on.

jszymborski 5y ago
They had offsite backups, so I'm just saying however permissions are managed, they should have had them reduced. Idk if they were just pushing to object storage on AWS/Azure/GCS or had another server, but my comment stands. Now, do I blame them? No, like you said it was a fansite. I'm just offering advice on how to avoid this sort of thing in the future for them and sites like them.
- ev1 5y ago
  I'm kind of curious though - what can you do as a non-technical user to prevent this? Let's say you're on shared hosting - you don't know what object storage is, and you upload your PHP themes via FTP (or at best, FTP+implicit SSL, but the default is plaintext). Your backup is probably downloading something over FTP, or creating a backup in cPanel/DirectAdmin/whatever shared hosting panel. Your host doesn't allow SSH. This is the hypermajority of shared hosting. (My apologies, I didn't mean that directed toward you, it was more of a general "this is HN, not everybody will self host GPG backups on immutable redundant cloud storage")
  - deleted 5y ago
    [deleted]
  - sova 5y ago
    "One Way Synchronization" with DropBox might do the trick [https://www.multcloud.com/tutorials/dropbox-one-way-sync-1234.html https://www.multcloud.com/tutorials/dropbox-one-way-sync-123...]
  - jszymborski 5y ago
    Hmm, in this case I might have a local script running on a cronjob or Scheduled Task to FTP(S) into the server and copy the files on the server locally. You can run this on a desktop or a raspi if one knows how to use it. It sounds from the blog like they already had automated off-sites, which makes me feel like they do have (perhaps limited) SSH access? Maybe it's just a cPanel deal though. No troubles, didn't take it personally and hope I didn't come off that way :) I remember as a teenager subscribing to dirt cheap hosting that only allowed uploads via a portal (:S) and trying to upload phpbb file by file, so I get it ahaha... passion often outstrips means/ability :P
    - ev1 5y ago
      Haha, I remember uploading an archive and then uploading a PHP file containing exec("tar zxf phpbb.tar.gz"); and then visiting it in a browser ;)
      - jszymborski 5y ago
        Genius! You would have blown my teenage mind :P

by ev1 5y ago

jszymborski 5y ago

They had offsite backups, so I'm just saying however permissions are managed, they should have had them reduced. Idk if they were just pushing to object storage on AWS/Azure/GCS or had another server, but my comment stands. Now, do I blame them? No, like you said it was a fansite. I'm just offering advice on how to avoid this sort of thing in the future for them and sites like them.

ev1 5y ago
I'm kind of curious though - what can you do as a non-technical user to prevent this? Let's say you're on shared hosting - you don't know what object storage is, and you upload your PHP themes via FTP (or at best, FTP+implicit SSL, but the default is plaintext). Your backup is probably downloading something over FTP, or creating a backup in cPanel/DirectAdmin/whatever shared hosting panel. Your host doesn't allow SSH. This is the hypermajority of shared hosting. (My apologies, I didn't mean that directed toward you, it was more of a general "this is HN, not everybody will self host GPG backups on immutable redundant cloud storage")
- deleted 5y ago
  [deleted]
- sova 5y ago
  "One Way Synchronization" with DropBox might do the trick [https://www.multcloud.com/tutorials/dropbox-one-way-sync-1234.html https://www.multcloud.com/tutorials/dropbox-one-way-sync-123...]
- jszymborski 5y ago
  Hmm, in this case I might have a local script running on a cronjob or Scheduled Task to FTP(S) into the server and copy the files on the server locally. You can run this on a desktop or a raspi if one knows how to use it. It sounds from the blog like they already had automated off-sites, which makes me feel like they do have (perhaps limited) SSH access? Maybe it's just a cPanel deal though. No troubles, didn't take it personally and hope I didn't come off that way :) I remember as a teenager subscribing to dirt cheap hosting that only allowed uploads via a portal (:S) and trying to upload phpbb file by file, so I get it ahaha... passion often outstrips means/ability :P
  - ev1 5y ago
    Haha, I remember uploading an archive and then uploading a PHP file containing exec("tar zxf phpbb.tar.gz"); and then visiting it in a browser ;)
    - jszymborski 5y ago
      Genius! You would have blown my teenage mind :P