4 ms·

This article is a bit delusional and oblivious to market dynamics. 1. Privacy: Self hosting is not necessarily more private than cloud services. The security o

This article is a bit delusional and oblivious to market dynamics. 1. Privacy: Self hosting is not necessarily more private than cloud services. The security of self hosted services is only as good as the effort put into maintaining it. Who do you think invests more in security: the giant corporation or a free open source project? Even if the project is well maintained, there are many ways your server can be compromised. It’s only as safe as you’re willing to make it. The best way to be safe for me is not self hosting, but cloud hosting with E2E encryption. 2. Longevity: even though self hosting technically means nobody can discontinue your service, everything eventually gets discontinued. Your server will be out of date at some point. You will need to update it. You might be too busy to do it and your server will become a security risk. Again, middle path and ideal way for me here is: use cloud services, encrypted, AND save the data locally as well. 3. Usability & market dynamics: John Doe doesn’t have the time or knowledge to self host, which makes self hosting dangerous for him for the reasons mentioned above. If you’re going to self host, you need to know what you’re doing. If you do it half way, you’re better off staying with a cloud service. The cloud will always win because it’s easier for everyday people. And because it wins, there will always be more money and development happening in it. We need more cloud services that use encryption by default, and provide data migration tools. The more this becomes a standard, the more the “big cloud giants” will have to step up and match this new standard. For me, THIS is the way not just nerds but everybody benefits from a safer, more reliable Internet.

pjerem 5y ago
1. I don’t understand why you conflate security with privacy. Or to be more precise, it depends on your threat model. A badly secured self hosting will make yourself vulnerable to targeted attacks over your privacy. While it’s an issue you should consider, those attacks are pretty unlikely. However traditional cloud services will harvest every bit of what they get about you with a frightening efficiency but they’ll never automatically scan your server for vulnerabilities to read your mails.
- ziml77 5y ago
  Security is necessary to maintain privacy. If someone gains access to your systems, nothing you had on there is private anymore.
- louison11 5y ago
  I think there needs to be clarity about what is harvested and how. Most centralized services actually respect people’s privacy to the extent that they’re not asked to infringe it by law order. Most major tech cos have encryption at rest and highly regulated access checks. It’s also not clear that they actually do harvest every bit of data they can. They might for the purpose of better UX within the service, but Google ads doesn’t collaborate with gmail or Google photos for example. There are, however, botnets all around the world scanning the web for security flaws. This is why, in this sense, I argue that most people are actually better off using a safe, centralized service with encryption than try to reinvent the wheel at home and be more exposed.
  - southerntofu 5y ago
    > Most centralized services actually respect people’s privacy to the extent that they’re not asked to infringe it by law order. cough cough
superkuh 5y ago
Your response to this post is a bit oblivious to motivations other than profit and metaphors other than markets. Additionally, re: (1), static sites are more secure with no maintanence than using a browser with Javascript enabled. (2) HTML and files lasts forever. There is nothing to update. (3) You keep assuming the needs and complexity of a for-profit business and the risks associated with that. But human persons don't have those complex needs or the associated risk of complex, dynamic setups that enable entire teams of people to work on something and constantly move it around.

pjerem 5y ago

1. I don’t understand why you conflate security with privacy. Or to be more precise, it depends on your threat model. A badly secured self hosting will make yourself vulnerable to targeted attacks over your privacy. While it’s an issue you should consider, those attacks are pretty unlikely. However traditional cloud services will harvest every bit of what they get about you with a frightening efficiency but they’ll never automatically scan your server for vulnerabilities to read your mails.

ziml77 5y ago
Security is necessary to maintain privacy. If someone gains access to your systems, nothing you had on there is private anymore.
louison11 5y ago
I think there needs to be clarity about what is harvested and how. Most centralized services actually respect people’s privacy to the extent that they’re not asked to infringe it by law order. Most major tech cos have encryption at rest and highly regulated access checks. It’s also not clear that they actually do harvest every bit of data they can. They might for the purpose of better UX within the service, but Google ads doesn’t collaborate with gmail or Google photos for example. There are, however, botnets all around the world scanning the web for security flaws. This is why, in this sense, I argue that most people are actually better off using a safe, centralized service with encryption than try to reinvent the wheel at home and be more exposed.
- southerntofu 5y ago
  > Most centralized services actually respect people’s privacy to the extent that they’re not asked to infringe it by law order. cough cough

superkuh 5y ago

Your response to this post is a bit oblivious to motivations other than profit and metaphors other than markets. Additionally, re: (1), static sites are more secure with no maintanence than using a browser with Javascript enabled. (2) HTML and files lasts forever. There is nothing to update. (3) You keep assuming the needs and complexity of a for-profit business and the risks associated with that. But human persons don't have those complex needs or the associated risk of complex, dynamic setups that enable entire teams of people to work on something and constantly move it around.