6 ms·

Self-hosting is time-consuming and potentially dangerous with respect to security. You need to know what you are doing. x—————- Example: Dropbox is open to t

by aborsy 5y ago

Self-hosting is time-consuming and potentially dangerous with respect to security. You need to know what you are doing. x—————- Example: Dropbox is open to the world. You can share files with everyone. Can you properly secure a nextcloud instance? VPN may not be applicable, because you have to share files with others. Even then, you need to have fair amount of knowledge about networking, protocols, security, current software, vulnerabilities, etc. Even with SSH, you need to be careful. And this is only the security part, I am not getting into a dozen of other concerns. Overall, as software complexity grows, self-hosting will be increasingly harder. Encrypting client-side and using a managed solution is a compelling option.

kilroy123 5y ago
This is my issue with self-hosting. I am so damn paranoid. I'm not a sysadmin or a security expert. I don't keep vital or sensitive stuff on anything I'm hosting but it's still frighting.
api 5y ago
Until we have self hosting as simple as app installation and without having to fiddle with security, it will be a niche thing.
- stewbrew 5y ago
  It's not much more difficult. Many hosting companies provide installers like e.g. cPanel that allow you to set up a Nextcloud instance within a minute.
- input_sh 5y ago
  Plenty of home/SMB NAS offer that. Plus there are projects like https://www.freedombox.org/ https://www.freedombox.org/. On top of that, many hosting providers offer to set up popular open source projects for you.
  - abdullahkhalids 5y ago
    https://sandstorm.io/ https://sandstorm.io/ as well
- bsenftner 5y ago
  Look at the Uniform Server, a complete WAMP stack pre-hardened for placement on a public server. Just run the installer, it is that easy.
- grishka 5y ago
  Even if it's "as simple as an app installation", you still need to have a public IP address that isn't behind a NAT. How many residential ISPs offer that?
  - Saris 5y ago
    NAT isn't an issue, but CGNAT is a problem and becoming more common as IPv4 space gets more expensive.
ekianjo 5y ago
> Self-hosting is time-consuming and potentially dangerous with respect to security. When you see that large companies get hacked all the time with you sensitive info and password released in the wild, it makes you think twice about "security" when your data is not in your hands. I'd say both are dangerous anyway, and certainly trusting a third party with any kind of data is a big gamble (plus, they may be spying on you as well).
- gruez 5y ago
  It depends on what the third party is. The chances that your google account gets hacked because of lax security practices on google's part, is probably orders of magnitude lower than your typical F500 company getting hacked because they forgot to patch their machines.
  - JetSpiegel 5y ago
    They just roll over all government requests for data, so that's a lot of APT that are neutralized.
fossuser 5y ago
This is one reason I think urbit is cool - it makes self hosting way easier. I run mine in digital ocean, but if you want to run it off your home network it’s basically just figuring out the vpn bit to safely get on your home network and everything else is good to go. You can also use something like tail scale or zero tier to skip the vpn part (but I know less about those things). Hopefully in time even this will get easier with UI that guides you through the process.
bsenftner 5y ago
"you need to know what you're doing" -Mr. Obvious There are pre-packaged solutions such as the Uniform Server - a complete WAMP stack fully hardened for placement on a public server. This is an EXTREMELY COMMON PROBLEM and PEOPLE HAVE OPEN SOURCE PACKAGED SOLUTIONS. This constant "it's too hard, waaa!" bullshit is just lies.
xg15 5y ago
> Even then, you need to have fair amount of knowledge about networking, protocols, security, current software, vulnerabilities, etc. ... > Encrypting client-side and using a managed solution is a compelling option. You need a similar amount of expert knowledge to properly configure your client-side encryption, ensure the algorithm wasn't cracked, the implementation you're using doesn't have any severe vulnerabilities, etc. If we're in a situation where we can trust no one, not even ourself, then we have a problem.
- the_rectifier 5y ago
  You can trust a Linux distribution to provide reasonably secure software out of the box, like Debian / Freedombox
Omniusaspirer 5y ago
The other side of this is that unless you're a very important individual nobody is going to blow zero days on your self-hosted server, and you're pretty unlikely to get focused by individual human (non-automated) attention/exploitation. I've been self hosting for over a decade with no intrusion to my knowledge, although I'm sure some state-level actor has access. On the flip side I've had many of my login credentials stolen over the years due to a wide range of companies getting hacked- haveibeenpwned currently lists 11 breaches for just one of my emails. It's probable I'll get owned eventually, but I've got some catching up to do.
- freedomben 5y ago
  I mostly agree with your post, except using a zero day on a small (especially self-hosted) server is very rarely blowing it. In fact I would bet the majority of self-hosted or small-time servers wouldn't have the first clue about how to figure out how you got in, let alone parsing logs to figure out the exploit. Assuming they even log sufficiently, hiring a forensics expert is almost certainly out of the question financially.
- scottydelta 5y ago
  You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn. Hackers wont even know if your self-host server exists. I self-host Bitwarden and that's how I am able to sleep at nights. [1] https://github.com/pritunl/pritunl https://github.com/pritunl/pritunl
  - XCSme 5y ago
    What if your self-hosted app must be accessible on the web? (eg. a blog or analytics platform) Would all that traffic still have to go through the VPN tunnel?
    - scottydelta 5y ago
      No, only the traffic of the self-host server you whitelist on Pritunl using the self-host server IP goes through VPN. Rest of the internet traffic works as usual.
Saris 5y ago
Most self hosted things don't need to be on the internet, the only things I have on the internet are a webserver, a game server or two, and an openvpn server. The rest of my stuff is all local/vpn only.
- visiblink 5y ago
  This is my solution too. My server with private data is only accessible via my LAN. I'm home often enough that syncing isn't a problem. I kind of treat it like the old Palm desktop, where you had to sync regularly by USB. The nice thing is that the sync is automatic in this case. I know that kind of punctuated syncing wouldn't work for everyone, but it works for me. My public server has a couple of ports open to the internet, but SSH, SFTP, etc., are only accessible on the LAN with access by key (no passwords). It does things like XMPP (hashed passwords, no locally-stored chat data), public websites, and the like.
mmphosis 5y ago
> Overall, as software complexity grows, self-hosting will be increasingly harder. Setting up self-hosting is not easy, except that it can be, as I see in the responses to this comment. I am not sure I understand what "as software complexity grows" means. My observation is that "as software complexity grows" it eventually (and hopefully) fails, and we go back to simpler software, albeit using a few things we've learned along the way. "As software complexity grows" is not a desirable trait. I hope that there is no need for such software, but I can't predict the future.
brian_cunnie 5y ago
This. I'm keenly aware of how time-consuming self-hosting is. - A FreeBSD firewall (requires continuous patching) - 6 DNS/NTP servers (don't ask!), most of which are in the cloud - 2 VMware ESXi hosts - 3 ethernet switches (an 8-port 10Gbe, 24-port 1GBe, 8-port 1GBe) - 2 WiFi Access Points - 12TB TrueNAS server - 2 laptops, 1 desktop - countless VLANs, countless VMs. Effectively I run my own AWS. But it comes at a cost: countless evenings & weekends. Endless updates (OS, BIOS, firmware), periodic hardware failures. Also, as pointed out, security. My unpatched DNS server was compromised, and the intruder managed to get root on my server (this was back in '99, before BIND was heavily re-vamped for security). Self-hosting is a labor of love, but I'd be hard-pressed to recommend it to anyone who didn't enjoy it.
- ziml77 5y ago
  I like seeing people acknowledge the problems that come with self-hosting. I tried to self-host a few years back ended up lasting only a handful of months before going back to letting others host the services I use. I didn't run into any specific issues, but instead I ended up realizing that I had to monitor the services myself to ensure that they were still functioning properly and that they had security patches applied. That's not a responsibility I want to deal with. And as strange as it sounds, I also noticed that there actually were privacy advantages to not hosting stuff myself. Maintaining multiple identities when self-hosting is only possible with a domain per identity and not reusing the same machine for services across identities.
- lenkite 5y ago
  Wow, you really need to write a how-to book and sell it on leanpub. I would buy it!
- benou 5y ago
  It is only time consuming if you let it be: I have been there too, hosting each service in a different OpenVZ jails (before containers were a thing) and doing hyper complex stuff... Nowadays I simplify to the extreme (refrain to run something I do not need, always using the simplest solution) and it works pretty well for me:https://benou.fr/www/ben/14-years-of-self-hosting.html https://benou.fr/www/ben/14-years-of-self-hosting.html
scottydelta 5y ago
> VPN may not be applicable, because you have to share files with others. You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn. [1] https://github.com/pritunl/pritunl https://github.com/pritunl/pritunl
heavyset_go 5y ago
Nothing you care about should have access to the open web. If your self-hosted services can be accessed by anyone with a web browser or curl, you're doing it wrong.
jesterson 5y ago
That's the statement I wholeheartedly disagree with. It is INCOMPARABLY more secure in a broad sense just because you control your infrastructure. Yes, you need to know what you are doing, but this is applicable to everything, does it not? Of course, mindlessly subscribing to bazillion of services is much simpler, but it's plainly not professional. On a side note, do you think Dropbox is any more secure than any other service, including self hosted? Or any other service? After years of seeing how those companies are made from inside I am personally quite free from those illusions.

by aborsy 5y ago

kilroy123 5y ago

This is my issue with self-hosting. I am so damn paranoid. I'm not a sysadmin or a security expert. I don't keep vital or sensitive stuff on anything I'm hosting but it's still frighting.

api 5y ago

Until we have self hosting as simple as app installation and without having to fiddle with security, it will be a niche thing.

stewbrew 5y ago
It's not much more difficult. Many hosting companies provide installers like e.g. cPanel that allow you to set up a Nextcloud instance within a minute.
input_sh 5y ago
Plenty of home/SMB NAS offer that. Plus there are projects like https://www.freedombox.org/ https://www.freedombox.org/. On top of that, many hosting providers offer to set up popular open source projects for you.
- abdullahkhalids 5y ago
  https://sandstorm.io/ https://sandstorm.io/ as well
bsenftner 5y ago
Look at the Uniform Server, a complete WAMP stack pre-hardened for placement on a public server. Just run the installer, it is that easy.
grishka 5y ago
Even if it's "as simple as an app installation", you still need to have a public IP address that isn't behind a NAT. How many residential ISPs offer that?
- Saris 5y ago
  NAT isn't an issue, but CGNAT is a problem and becoming more common as IPv4 space gets more expensive.

ekianjo 5y ago

> Self-hosting is time-consuming and potentially dangerous with respect to security. When you see that large companies get hacked all the time with you sensitive info and password released in the wild, it makes you think twice about "security" when your data is not in your hands. I'd say both are dangerous anyway, and certainly trusting a third party with any kind of data is a big gamble (plus, they may be spying on you as well).

gruez 5y ago
It depends on what the third party is. The chances that your google account gets hacked because of lax security practices on google's part, is probably orders of magnitude lower than your typical F500 company getting hacked because they forgot to patch their machines.
- JetSpiegel 5y ago
  They just roll over all government requests for data, so that's a lot of APT that are neutralized.

fossuser 5y ago

This is one reason I think urbit is cool - it makes self hosting way easier. I run mine in digital ocean, but if you want to run it off your home network it’s basically just figuring out the vpn bit to safely get on your home network and everything else is good to go. You can also use something like tail scale or zero tier to skip the vpn part (but I know less about those things). Hopefully in time even this will get easier with UI that guides you through the process.

bsenftner 5y ago

"you need to know what you're doing" -Mr. Obvious There are pre-packaged solutions such as the Uniform Server - a complete WAMP stack fully hardened for placement on a public server. This is an EXTREMELY COMMON PROBLEM and PEOPLE HAVE OPEN SOURCE PACKAGED SOLUTIONS. This constant "it's too hard, waaa!" bullshit is just lies.

xg15 5y ago

> Even then, you need to have fair amount of knowledge about networking, protocols, security, current software, vulnerabilities, etc. ... > Encrypting client-side and using a managed solution is a compelling option. You need a similar amount of expert knowledge to properly configure your client-side encryption, ensure the algorithm wasn't cracked, the implementation you're using doesn't have any severe vulnerabilities, etc. If we're in a situation where we can trust no one, not even ourself, then we have a problem.

the_rectifier 5y ago
You can trust a Linux distribution to provide reasonably secure software out of the box, like Debian / Freedombox

Omniusaspirer 5y ago

The other side of this is that unless you're a very important individual nobody is going to blow zero days on your self-hosted server, and you're pretty unlikely to get focused by individual human (non-automated) attention/exploitation. I've been self hosting for over a decade with no intrusion to my knowledge, although I'm sure some state-level actor has access. On the flip side I've had many of my login credentials stolen over the years due to a wide range of companies getting hacked- haveibeenpwned currently lists 11 breaches for just one of my emails. It's probable I'll get owned eventually, but I've got some catching up to do.

freedomben 5y ago
I mostly agree with your post, except using a zero day on a small (especially self-hosted) server is very rarely blowing it. In fact I would bet the majority of self-hosted or small-time servers wouldn't have the first clue about how to figure out how you got in, let alone parsing logs to figure out the exploit. Assuming they even log sufficiently, hiring a forensics expert is almost certainly out of the question financially.
scottydelta 5y ago
You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn. Hackers wont even know if your self-host server exists. I self-host Bitwarden and that's how I am able to sleep at nights. [1] https://github.com/pritunl/pritunl https://github.com/pritunl/pritunl
- XCSme 5y ago
  What if your self-hosted app must be accessible on the web? (eg. a blog or analytics platform) Would all that traffic still have to go through the VPN tunnel?
  - scottydelta 5y ago
    No, only the traffic of the self-host server you whitelist on Pritunl using the self-host server IP goes through VPN. Rest of the internet traffic works as usual.

Saris 5y ago

Most self hosted things don't need to be on the internet, the only things I have on the internet are a webserver, a game server or two, and an openvpn server. The rest of my stuff is all local/vpn only.

visiblink 5y ago
This is my solution too. My server with private data is only accessible via my LAN. I'm home often enough that syncing isn't a problem. I kind of treat it like the old Palm desktop, where you had to sync regularly by USB. The nice thing is that the sync is automatic in this case. I know that kind of punctuated syncing wouldn't work for everyone, but it works for me. My public server has a couple of ports open to the internet, but SSH, SFTP, etc., are only accessible on the LAN with access by key (no passwords). It does things like XMPP (hashed passwords, no locally-stored chat data), public websites, and the like.

mmphosis 5y ago

> Overall, as software complexity grows, self-hosting will be increasingly harder. Setting up self-hosting is not easy, except that it can be, as I see in the responses to this comment. I am not sure I understand what "as software complexity grows" means. My observation is that "as software complexity grows" it eventually (and hopefully) fails, and we go back to simpler software, albeit using a few things we've learned along the way. "As software complexity grows" is not a desirable trait. I hope that there is no need for such software, but I can't predict the future.

brian_cunnie 5y ago

This. I'm keenly aware of how time-consuming self-hosting is. - A FreeBSD firewall (requires continuous patching) - 6 DNS/NTP servers (don't ask!), most of which are in the cloud - 2 VMware ESXi hosts - 3 ethernet switches (an 8-port 10Gbe, 24-port 1GBe, 8-port 1GBe) - 2 WiFi Access Points - 12TB TrueNAS server - 2 laptops, 1 desktop - countless VLANs, countless VMs. Effectively I run my own AWS. But it comes at a cost: countless evenings & weekends. Endless updates (OS, BIOS, firmware), periodic hardware failures. Also, as pointed out, security. My unpatched DNS server was compromised, and the intruder managed to get root on my server (this was back in '99, before BIND was heavily re-vamped for security). Self-hosting is a labor of love, but I'd be hard-pressed to recommend it to anyone who didn't enjoy it.

ziml77 5y ago
I like seeing people acknowledge the problems that come with self-hosting. I tried to self-host a few years back ended up lasting only a handful of months before going back to letting others host the services I use. I didn't run into any specific issues, but instead I ended up realizing that I had to monitor the services myself to ensure that they were still functioning properly and that they had security patches applied. That's not a responsibility I want to deal with. And as strange as it sounds, I also noticed that there actually were privacy advantages to not hosting stuff myself. Maintaining multiple identities when self-hosting is only possible with a domain per identity and not reusing the same machine for services across identities.
lenkite 5y ago
Wow, you really need to write a how-to book and sell it on leanpub. I would buy it!
benou 5y ago
It is only time consuming if you let it be: I have been there too, hosting each service in a different OpenVZ jails (before containers were a thing) and doing hyper complex stuff... Nowadays I simplify to the extreme (refrain to run something I do not need, always using the simplest solution) and it works pretty well for me:https://benou.fr/www/ben/14-years-of-self-hosting.html https://benou.fr/www/ben/14-years-of-self-hosting.html

scottydelta 5y ago

> VPN may not be applicable, because you have to share files with others. You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn. [1] https://github.com/pritunl/pritunl https://github.com/pritunl/pritunl

heavyset_go 5y ago

Nothing you care about should have access to the open web. If your self-hosted services can be accessed by anyone with a web browser or curl, you're doing it wrong.

jesterson 5y ago

That's the statement I wholeheartedly disagree with. It is INCOMPARABLY more secure in a broad sense just because you control your infrastructure. Yes, you need to know what you are doing, but this is applicable to everything, does it not? Of course, mindlessly subscribing to bazillion of services is much simpler, but it's plainly not professional. On a side note, do you think Dropbox is any more secure than any other service, including self hosted? Or any other service? After years of seeing how those companies are made from inside I am personally quite free from those illusions.