5 ms·

It's interesting that the article touches on the reasons why end users might not want to run servers but doesn't mention at all one of the ones that comes to my

It's interesting that the article touches on the reasons why end users might not want to run servers but doesn't mention at all one of the ones that comes to my mind most quickly, which is security. Running a production server on your home network is a risky thing to do as, if there's a vulnerability in the code (and historically this has been quite common, especially when products are new), it allows attackers into home networks which are very likely to have a load of easily compromised unpatched consumer IT products. Obviously it's possible to do this securely, if you have the right technical knowledge and the time and dedication to apply it, but I'd guess that it's a very small percentage of people who fall into that camp.

masterofmisc 5y ago
Your right. Ive been saying for years that routers should come with 2 networks (vlans) out of the box (colour coded red and blue) to make it easier to seperate out kit/appliances. One side for IoT stuff that you dont trust and the other side for our own equipment. But as you mention, even then consumers need to know how to set the networks up etc. As the old adage goes, you dont know what you dont know.
- sofixa 5y ago
  The issue with two networks is that many IoT things work by interacting with other things/users. A Philips Hue bridge or a Chromecast need to be accessible from the network you're on. And they rely on things like multicast and UPnP to function, which are hard if not impossible to do cross-vlan ( i looked into putting my Chromecasts on a different vlan and the setup was quite heavy).
  - mg74 5y ago
    Agree. I even gave up on keeping the christmas light IoT device on the other network, because the whole point was to be able to control the lights with the phone, and having to switch my phone between networks was just too much. What needs to happen here is that my master devices (my phone, my laptop) need to be able to stay connected to many networks at the same time, and then I have to be able to assign different apps to different networks.
    - sofixa 5y ago
      It depends on how they work. IIRC the Hue bridge connection can be statically configured with an IP, and then some firewall rules should be enough ( authorise your main network to talk to the Hue IP).
      - luma 5y ago
        That still doesn't fix the fact that it relies on network broadcasts for many core functionality (app discovery of the hub, etc). Putting your IoT devices on their own VLAN sounds like a good idea, but they usually aren't designed to work in that sort of situation and you're likely to create a bunch of usability and management problems that won't be solved with firewall rules.
- mopsi 5y ago
  Many routers already come with two networks separated with vlans. It's a common feature on TP-Link devices, among many others. They call it "Guest network", which makes it really easy to understand.
mike_hearn 5y ago
There are lots of reasons why people don't do it today, I didn't list all of them because it's easy to come up with them as indeed you've done here. But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones, and most servers don't ever do that. If servers are less secure than web browsers it's a matter of effort put into the implementations, not something fundamental about human nature or computers.
- fauigerzigerk 5y ago
  >But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones... But isn't that in fact the fundamental problem we're talking about? You get security without knowledge exactly if you give up all control over the device. What's the point of "running" your own server if all control you have left is that you can physically smash it to pieces? Yes you can take control, but only to the degree to which you acquire the knowledge to keep it secure. I think this is a very fundamental trade-off.
  - mike_hearn 5y ago
    I don't think giving up control is necessary to achieve security. Modern web browsers are pretty secure (even if web apps themselves aren't) and yet I can browse to whatever websites I want. There's a competitive marketplace of browsers to ensure that if one provider goes nuts I can switch to another. There are lots of different angles through which to make progress here. I don't think we should be defeatist about it.
    - dmitriid 5y ago
      > There's a competitive marketplace of browsers There isn't. There are exactly three independent browser vendors: - Google with Chrome. Chrome dominates the market to such an extent that Google pushes through its internal APIs as "standards" - Apple with Safari. They flat out refuse to implement many of Chrome's shenanigans, and also have issues with priorities and funding - Mozilla with Firefox. Much like Safari, they are increasingly refusing to implement Chrome's shenanigans. But Firefox is rapidly declining in relevance, and will be on the brink of extinction within a few years (it already has at best ~150-199 million users)
cbsmith 5y ago
> Obviously it's possible to do this securely, if you have the right technical knowledge and the time and dedication to apply it, but I'd guess that it's a very small percentage of people who fall into that camp. I think there's an underlying subtext that is missed in the article and this comment. Like, I don't disagree with the quoted bit above, but at the same time, I can't help but recognize that its truth is a consequence of design choices rather than an inevitability. Americans happily own cars, which are themselves quite dangerous, laborious to manage, expensive to operate, have to be insured, and require an extensive and constantly updated training to maintain. They are companies that offer rental models, rather than ownership models, but they are mostly used by urban dwellers with limited income and travelers. Most people would tell you they'd prefer to own one. It's just a cultural context. The same applies to servers. We could have servers that were well designed for people to self-manage with perhaps some basic training (certainly no more difficult than what is required than to pass a driving test), regular servicing, recalls, service stations spread throughout the nation, legal adjusted to favour ownership, etc. Really, from a practical standpoint, the difference between a server and so many other computers deployed in homes (routers, mobile phones, IoT devices, cars, laptops, etc.) is far more subtle than we're willing to acknowledge... and frankly we actually introduce a lot of systemic risk by NOT requiring basic skills, regular servicing, insurance, etc. for these "pseudo-servers".

masterofmisc 5y ago

Your right. Ive been saying for years that routers should come with 2 networks (vlans) out of the box (colour coded red and blue) to make it easier to seperate out kit/appliances. One side for IoT stuff that you dont trust and the other side for our own equipment. But as you mention, even then consumers need to know how to set the networks up etc. As the old adage goes, you dont know what you dont know.

sofixa 5y ago
The issue with two networks is that many IoT things work by interacting with other things/users. A Philips Hue bridge or a Chromecast need to be accessible from the network you're on. And they rely on things like multicast and UPnP to function, which are hard if not impossible to do cross-vlan ( i looked into putting my Chromecasts on a different vlan and the setup was quite heavy).
- mg74 5y ago
  Agree. I even gave up on keeping the christmas light IoT device on the other network, because the whole point was to be able to control the lights with the phone, and having to switch my phone between networks was just too much. What needs to happen here is that my master devices (my phone, my laptop) need to be able to stay connected to many networks at the same time, and then I have to be able to assign different apps to different networks.
  - sofixa 5y ago
    It depends on how they work. IIRC the Hue bridge connection can be statically configured with an IP, and then some firewall rules should be enough ( authorise your main network to talk to the Hue IP).
    - luma 5y ago
      That still doesn't fix the fact that it relies on network broadcasts for many core functionality (app discovery of the hub, etc). Putting your IoT devices on their own VLAN sounds like a good idea, but they usually aren't designed to work in that sort of situation and you're likely to create a bunch of usability and management problems that won't be solved with firewall rules.
mopsi 5y ago
Many routers already come with two networks separated with vlans. It's a common feature on TP-Link devices, among many others. They call it "Guest network", which makes it really easy to understand.

mike_hearn 5y ago

There are lots of reasons why people don't do it today, I didn't list all of them because it's easy to come up with them as indeed you've done here. But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones, and most servers don't ever do that. If servers are less secure than web browsers it's a matter of effort put into the implementations, not something fundamental about human nature or computers.

fauigerzigerk 5y ago
>But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones... But isn't that in fact the fundamental problem we're talking about? You get security without knowledge exactly if you give up all control over the device. What's the point of "running" your own server if all control you have left is that you can physically smash it to pieces? Yes you can take control, but only to the degree to which you acquire the knowledge to keep it secure. I think this is a very fundamental trade-off.
- mike_hearn 5y ago
  I don't think giving up control is necessary to achieve security. Modern web browsers are pretty secure (even if web apps themselves aren't) and yet I can browse to whatever websites I want. There's a competitive marketplace of browsers to ensure that if one provider goes nuts I can switch to another. There are lots of different angles through which to make progress here. I don't think we should be defeatist about it.
  - dmitriid 5y ago
    > There's a competitive marketplace of browsers There isn't. There are exactly three independent browser vendors: - Google with Chrome. Chrome dominates the market to such an extent that Google pushes through its internal APIs as "standards" - Apple with Safari. They flat out refuse to implement many of Chrome's shenanigans, and also have issues with priorities and funding - Mozilla with Firefox. Much like Safari, they are increasingly refusing to implement Chrome's shenanigans. But Firefox is rapidly declining in relevance, and will be on the brink of extinction within a few years (it already has at best ~150-199 million users)

cbsmith 5y ago

> Obviously it's possible to do this securely, if you have the right technical knowledge and the time and dedication to apply it, but I'd guess that it's a very small percentage of people who fall into that camp. I think there's an underlying subtext that is missed in the article and this comment. Like, I don't disagree with the quoted bit above, but at the same time, I can't help but recognize that its truth is a consequence of design choices rather than an inevitability. Americans happily own cars, which are themselves quite dangerous, laborious to manage, expensive to operate, have to be insured, and require an extensive and constantly updated training to maintain. They are companies that offer rental models, rather than ownership models, but they are mostly used by urban dwellers with limited income and travelers. Most people would tell you they'd prefer to own one. It's just a cultural context. The same applies to servers. We could have servers that were well designed for people to self-manage with perhaps some basic training (certainly no more difficult than what is required than to pass a driving test), regular servicing, recalls, service stations spread throughout the nation, legal adjusted to favour ownership, etc. Really, from a practical standpoint, the difference between a server and so many other computers deployed in homes (routers, mobile phones, IoT devices, cars, laptops, etc.) is far more subtle than we're willing to acknowledge... and frankly we actually introduce a lot of systemic risk by NOT requiring basic skills, regular servicing, insurance, etc. for these "pseudo-servers".