8 ms·

Another reason to self host https://rohanrd.xyz/posts/why-start-self-hosting/ https://rohanrd.xyz/posts/why-start-self-hosting/

mrtksn 4y ago
The problem with self hosting is that it quickly becomes very insecure and unreliable because it needs to be managed and most people don't like managing it. Even if you are fine with managing it, strange errors will occur and you will solve those errors by following tutorials and you(maybe not you specifically, but most people) wouldn't know what you are doing and you will introduce security holes. Self hosting will be possible only when there is a software which doesn't have settings and runs on a box which also doesn't have settings beyond wi-fi settings. Plug it into the wall and forget about it. Which is actually what WD is trying to do but apparently your setup can go down for days because it has an intermediary component which needs to be managed, can get compromised and can go down.
- dannyw 4y ago
  > Self hosting will be possible only when there is a software which doesn't have setting and runs on a box which also doesn't have settings beyond wi-fi settings. Plug it into the wall and forget about it. Buy a Synology DiskStation, and you get an easy-to-use yet customisable OS, that receives security updates for up to a decade. Also comes with checksums/data scrubbing (btrfs; like zfs), Docker support, snapshots, E2E diff-based backups to your choice of cloud provider, an optional cloud-based NAT-puncher if you don't like/know to set up port forwarding, etc. Sure, the hardware has a markup, but you're paying for a nearly-Apple-like experience that's still crazily customisable. I've had zero complaints.
  - fulafel 4y ago
    I've had tech savvy friends have good brand (don't remember if qnap or synology) NAS devices compromised. OS patches help but for example the 3rd party stuff you install might be a risk, or things that are patched too slowly in the os, etc. In the end you still need to manage and monitor it. It seems a lot of guidance about securing your NAS (eg [1]) starts with "it's bad if it's directly connected to the internet". So if you want to use the internet, it may be a better bet to use a managed service (or maybe look for a more security focused product?). [1] https://www.backblaze.com/blog/recent-qnap-and-synology-security-alerts-how-to-protect-your-nas/ https://www.backblaze.com/blog/recent-qnap-and-synology-secu...
    - jhugo 4y ago
      I usually turn off all "cloud" / Internet-accessible features of everything (and, where possible, even block things from Internet access), and then have a Wireguard VPN back to my home network. I think this is a better balance of security and usability than trusting that all of the NAS/camera/doorknob/printer/etc vendors are any good at securing these things.
      - fulafel 3y ago
        The use of VPNs to mitigate iffy security in self-hosted stuff is common but comes with its own problems, simultaneously it makes your self-hosted services harder to access (or impossible from some contextx), and it hurts security by making your system more complex (harder to understand & manage & monitor). They're also seemingly going out of fashion as zero-trust/beyondcorp/identity-aware proxies gain mindshare. Of course if you (along with friends and family) are all-in on a overlay network like tailscale it can be a different story.
        jhugo 3y ago
        Actually, I find that a simple wireguard tunnel giving boring old IP routing to my home network is a far simpler setup than every device having its own opaque tunnel back to its vendor which I have to use a vendor-specific method of connecting to. Tailscale is also more complex, though a nice product. So far I haven't encountered any context where I couldn't connect to my wireguard tunnel, but YMMV.
    - darkwater 3y ago
      That's not self-hosting, that's giving direct access to your LAN to yet another corporation. Self-host ought to be 100% owned by you. (Yeah, it can be harder like this, I know)
  - function_seven 4y ago
    Does the $200 model still support all of that? I know I need to get my ass in gear and fix my storage and backups. I’d also like to start replacing my Wyzecams with and IP NVR. But I’ve been in a frugal mood lately, I find it hard to spend over $500 on an item like this.
    - rcarmo 3y ago
      They all run the same software.
      - dannyw 3y ago
        However, the cheaper models don't necessarily have all the features. I believe the $249 DS223 does indeed support all of the features I mentioned above.
        YurgenJurgensen 3y ago
        But does it do them all at once with its available RAM? I got bit by this by buying a low-end QNAP NAS that only had a gig of RAM and found that it was non-upgradable and severely limited the number of services it could run at once.
        dannyw 3y ago
        I run a bittorrent client, a light web service docker, Video Station, Photoprism, and a VPN on a 2GB Synology fine; along with HyperBackup, data scrubbing, snapshots, etc. The official Synology services are pretty RAM-optimised. It does get pretty tight, I probably wouldn't want to be adding any more services, but it's fine for my use cases.
    - inconceivable 3y ago
      you can run synology software on generic hardware https://xpenology.org/#What_is_Xpenology https://xpenology.org/#What_is_Xpenology having said that i bought the $200 model (220j) with a steep discount with points on amazon and it works fine but is a little slower than the others. i just use it for rsync (which never-deletes by default) and as an SMB server. note the 220j unit doesn't do btrfs. the nas software seems pretty good but i don't use much of it. it takes some configuring to setup proper user home directories to rsync with but it only took me a few minutes of googling to figure it out. also their macos backup agent software kind of sucks but if you're using it for rsync or as a NAS volume it seems to work great. i don't use any of synology cloud or public cloud features.
  - TaylorAlexander 3y ago
    > Buy a Synology DiskStation I did that, and I have to say it does NOT play with linux very nicely. I had to change the UID and GID on my desktop for my default user and all of my files because Ubuntu starts with UID 1 and Synology starts with UID 26, so after you figure out how to mount the disk as nfs it says you don't have permission to access it (because your UID does not match the UID of the device). Solving this was one of those problems where you go back 10 years and so many people have posted forum posts and the answer was always some weird hack, and Synology has never fixed it. Changing the UID of my user on my desktop was the easiest hack. Then I installed another OS to dual boot and had to change the UID for that one too, so I could access my files, and somehow the "easy" NAS option has made me jump through lots of hoops. Turns out self hosting is not easy even when you buy a Synology.
    - rcarmo 3y ago
      Your choice of NFS is the issue here. I use SMB (with one or two shares where I remap UIDs and masks), and it has worked well for nearly 15 years across Linux, Mac and Windows clients.
      - nier 3y ago
        [flagged]
        JustSomeNobody 3y ago
        Are you sure? To me it came off as factual. They very simply stated that NFS was the issue.
        CoastalCoder 3y ago
        FWIW I didn't sense any disrespect, although I can see what you read it that way. I'm guessing you saw "your choice ... was the problem", whereas I see "... NFS was the problem".
        hunter2_ 3y ago
  - nerdjon 3y ago
    I love my Synology NAS, enough that I now have 2 for different use cases. My only issue with them was when I emailed them to confirm that I could have it connected to my network but not have internet access (people calling "wifi" or "ethernet" internet still drives me up the wall) since I was going to block its internet access on my router. First I had issues getting support to understand the distinction between "network" and "internet". Second once I finally did get someone who understood I was asked "Why" or "what was I trying to accomplish". It almost put me off purchasing it that I would be asked why I would want a device like a NAS to have zero internet connectivity. That aside I would agree and it does feel like a very apple like experience (maybe a bit more technical). I mean it isn't as easy as the time capsule was years ago, but its up there.
    - burntwater 3y ago
      Asking "why" or "what are you trying to accomplish?" is standard and good practice - a good person (technician, manager, or many other roles) wants to get at the root of the question so they can provide a genuine solution. I'm sure we've all experienced times where someone asks you an odd question, you ask what they're trying to do, and you come up with a much better solution (or better/more accurate way of asking the question) than what would have been provided in simply answering the first question. Granted, it's frustrating when you are a well-informed person that knows exactly what they're looking for. I just accept it as a cost of dealing with other people.
      - nerdjon 3y ago
        TBH maybe it was the fact that it took a few emails to get there that it felt annoying? I mean I recognize that they may be dealing with far less technical people and maybe that is a valid question. I get what your saying but wouldn't "I don't want my NAS to have an internet connection but I want to make sure it still works locally" be mostly self explanatory? Maybe that is me putting more faith in other people than I should, like obviously it won't be able to update, sync with a cloud, or any other number of things. Maybe thats not obvious? But also to be clear the bad taste it gave me was seeing products that should have no need for an active internet connection and yet are paper weights without it. So when a company seems to be pushing me to connect something to the internet, especially something as sensitive as a NAS... it sets off alarms.
  - ksec 3y ago
    >Buy a Synology DiskStation Synology doesn't update their Kernel. Only the latest release model in 2023 comes with 5.10. The others are on 4.x, and if you bought any before 2020 you may be on 3.x. On the 2023 model You would have thought they would at least be on 5.15, no. All Entry level model doesn't come with BTRFS. But apart from that, it is still the best in the market right now.
- archerx 4y ago
  I’ve been self hosting a nextcloud instance for many years and its been great without any issue. I love it and I use it everyday.
  - benatkin 4y ago
    I gave NextCloud a shot and didn't like it. For one thing whatever I had set up for it was sending too many notifications on Android. So YMMV.
    - archerx 3y ago
      The app sucks, I have been using the web interface exclusively even on mobile.
- throwaway2056 4y ago
  This. Plus: people here calling for Raspberry or Synology do not know 'average' users - People dont know what is ethernet - Most people cant navigate GUI of synology or other stuff - Some of the hn gurus need to work as CS for a week. People get confused what USB-A or USB-C cable. - For hn-gurus with Rpi/nextcloud: These products are sold to average joe that has no clue about tech. - for average joe people, google is internet, facebook is family and whatsapp is chat. - The sales guy that sold it just works for commission. Capitalism. - Same is for WD. They sold the product for $100 8TB so that is the quality one expects.
  - quaintdev 4y ago
    Then we need to work on it to make self hosting as ubiquitous as a TV. Imagine a future where all your photos, videos stay at your house on a box and others who have access can view them from anywhere. The corporations are working in direction where this is never possible but given how they all deal with data this is the only future that will be secure and makes sense.
    - Dalewyn 4y ago
      >Imagine a future where all your photos, videos stay at your house on a box and others who have access can view them from anywhere. We are slowly working towards such a future and common users by and large will appreciate it, but it's not going to be the future most tech nerds envision it to be.
      - copper-float 3y ago
        What are you referring to?
        Dalewyn 3y ago
        Basically: Convenience and customizability are mutually exclusive. We as tech nerds value our ability to power user, but this is quite simply at odds with the interests of common users. Things like further and further abstractioning of file systems, further and further integrations of operating systems with online accounts and other internet services, further and further "appliance"ing of computer systems, etc.
- CapsAdmin 4y ago
  Although the consequences of failure are not as severe, you could make a similar argument against cooking your own food as the outcome can be unreliable and time consuming. Some enjoy doing it, some just purchase microwave food and some just pay or get someone else to do it for them. Then there are chefs in the media that try to make cooking more accessible with the message that it's not as difficult as people make it out to be. However some pushback/warning against self hosting because we don't yet have a good alternative to reliable "microwave food" is good I guess.
  - bon00r 3y ago
    [flagged]
- mihaaly 3y ago
  "it quickly becomes very insecure and unreliable" As anything else! As the above picture shows. With the added bonus that you are cluless of the state of a Cloud (no insights of its real state, its actual practices, also kept in darkness, only over confident corporate statements). (actually there are quite fine self hosted products with maintainance updates and help where you do not have to be an IT practitioner to use, equal to the level required from Cloud services, just look around)
- qwertox 3y ago
  While I self-host everything, I fully agree with this. If it works and has no internet access, you'll just leave it there, running for a year, two years, when suddenly something changes. Either you need to upgrade the underlying OS to a new major version or some 3rd-party client changes, and you're confronted with a wall of stuff you must do. Or even if it's something as simple as MongoDB, after a patch (not even a minor version bump), no longer being supported on the Raspberry Pi 4 even though MongoDB themselves posted a blog post a couple of months before that change showing how to easily install it on this device.
- Bender 3y ago
  I've been self hosting openssh sftp for decades and not run into any problems with security as of yet but it could be I am just lucky. I do not expose any services to IP's that I do not control with exception to my public SFTP servers but there is nothing sensitive or important on those. The boxes auto-update OS patches but I manually reboot them just to ensure they come back in a happy state. This is just to say that a chroot SFTP server and the lftp client is all one really needs to push backups to wherever with functionality similar to rsync but with slower directory enumeration because there isn't a corresponding sync client on the remote end. That's fine with me since I can be asleep when this occurs. For cell phone backups one of the many SFTP clients is AdminHands but I find anything for cell phones is mediocre at best.
- IG_Semmelweiss 3y ago
  Hello, can you please expand on how using syncthing out of the box would be deemed insecure? Genuinely concerned ive missed something
rwalle 3y ago
Try sending this URL to your uncle. Hacker news is not the entire world.

mrtksn 4y ago

The problem with self hosting is that it quickly becomes very insecure and unreliable because it needs to be managed and most people don't like managing it. Even if you are fine with managing it, strange errors will occur and you will solve those errors by following tutorials and you(maybe not you specifically, but most people) wouldn't know what you are doing and you will introduce security holes. Self hosting will be possible only when there is a software which doesn't have settings and runs on a box which also doesn't have settings beyond wi-fi settings. Plug it into the wall and forget about it. Which is actually what WD is trying to do but apparently your setup can go down for days because it has an intermediary component which needs to be managed, can get compromised and can go down.

dannyw 4y ago
> Self hosting will be possible only when there is a software which doesn't have setting and runs on a box which also doesn't have settings beyond wi-fi settings. Plug it into the wall and forget about it. Buy a Synology DiskStation, and you get an easy-to-use yet customisable OS, that receives security updates for up to a decade. Also comes with checksums/data scrubbing (btrfs; like zfs), Docker support, snapshots, E2E diff-based backups to your choice of cloud provider, an optional cloud-based NAT-puncher if you don't like/know to set up port forwarding, etc. Sure, the hardware has a markup, but you're paying for a nearly-Apple-like experience that's still crazily customisable. I've had zero complaints.
- fulafel 4y ago
  I've had tech savvy friends have good brand (don't remember if qnap or synology) NAS devices compromised. OS patches help but for example the 3rd party stuff you install might be a risk, or things that are patched too slowly in the os, etc. In the end you still need to manage and monitor it. It seems a lot of guidance about securing your NAS (eg [1]) starts with "it's bad if it's directly connected to the internet". So if you want to use the internet, it may be a better bet to use a managed service (or maybe look for a more security focused product?). [1] https://www.backblaze.com/blog/recent-qnap-and-synology-security-alerts-how-to-protect-your-nas/ https://www.backblaze.com/blog/recent-qnap-and-synology-secu...
  - jhugo 4y ago
    I usually turn off all "cloud" / Internet-accessible features of everything (and, where possible, even block things from Internet access), and then have a Wireguard VPN back to my home network. I think this is a better balance of security and usability than trusting that all of the NAS/camera/doorknob/printer/etc vendors are any good at securing these things.
    - fulafel 3y ago
      The use of VPNs to mitigate iffy security in self-hosted stuff is common but comes with its own problems, simultaneously it makes your self-hosted services harder to access (or impossible from some contextx), and it hurts security by making your system more complex (harder to understand & manage & monitor). They're also seemingly going out of fashion as zero-trust/beyondcorp/identity-aware proxies gain mindshare. Of course if you (along with friends and family) are all-in on a overlay network like tailscale it can be a different story.
      - jhugo 3y ago
        Actually, I find that a simple wireguard tunnel giving boring old IP routing to my home network is a far simpler setup than every device having its own opaque tunnel back to its vendor which I have to use a vendor-specific method of connecting to. Tailscale is also more complex, though a nice product. So far I haven't encountered any context where I couldn't connect to my wireguard tunnel, but YMMV.
  - darkwater 3y ago
    That's not self-hosting, that's giving direct access to your LAN to yet another corporation. Self-host ought to be 100% owned by you. (Yeah, it can be harder like this, I know)
- function_seven 4y ago
  Does the $200 model still support all of that? I know I need to get my ass in gear and fix my storage and backups. I’d also like to start replacing my Wyzecams with and IP NVR. But I’ve been in a frugal mood lately, I find it hard to spend over $500 on an item like this.
  - rcarmo 3y ago
    They all run the same software.
    - dannyw 3y ago
      However, the cheaper models don't necessarily have all the features. I believe the $249 DS223 does indeed support all of the features I mentioned above.
      - YurgenJurgensen 3y ago
        But does it do them all at once with its available RAM? I got bit by this by buying a low-end QNAP NAS that only had a gig of RAM and found that it was non-upgradable and severely limited the number of services it could run at once.
        dannyw 3y ago
        I run a bittorrent client, a light web service docker, Video Station, Photoprism, and a VPN on a 2GB Synology fine; along with HyperBackup, data scrubbing, snapshots, etc. The official Synology services are pretty RAM-optimised. It does get pretty tight, I probably wouldn't want to be adding any more services, but it's fine for my use cases.
  - inconceivable 3y ago
    you can run synology software on generic hardware https://xpenology.org/#What_is_Xpenology https://xpenology.org/#What_is_Xpenology having said that i bought the $200 model (220j) with a steep discount with points on amazon and it works fine but is a little slower than the others. i just use it for rsync (which never-deletes by default) and as an SMB server. note the 220j unit doesn't do btrfs. the nas software seems pretty good but i don't use much of it. it takes some configuring to setup proper user home directories to rsync with but it only took me a few minutes of googling to figure it out. also their macos backup agent software kind of sucks but if you're using it for rsync or as a NAS volume it seems to work great. i don't use any of synology cloud or public cloud features.
- TaylorAlexander 3y ago
  > Buy a Synology DiskStation I did that, and I have to say it does NOT play with linux very nicely. I had to change the UID and GID on my desktop for my default user and all of my files because Ubuntu starts with UID 1 and Synology starts with UID 26, so after you figure out how to mount the disk as nfs it says you don't have permission to access it (because your UID does not match the UID of the device). Solving this was one of those problems where you go back 10 years and so many people have posted forum posts and the answer was always some weird hack, and Synology has never fixed it. Changing the UID of my user on my desktop was the easiest hack. Then I installed another OS to dual boot and had to change the UID for that one too, so I could access my files, and somehow the "easy" NAS option has made me jump through lots of hoops. Turns out self hosting is not easy even when you buy a Synology.
  - rcarmo 3y ago
    Your choice of NFS is the issue here. I use SMB (with one or two shares where I remap UIDs and masks), and it has worked well for nearly 15 years across Linux, Mac and Windows clients.
    - nier 3y ago
      [flagged]
      - JustSomeNobody 3y ago
        Are you sure? To me it came off as factual. They very simply stated that NFS was the issue.
      - CoastalCoder 3y ago
        FWIW I didn't sense any disrespect, although I can see what you read it that way. I'm guessing you saw "your choice ... was the problem", whereas I see "... NFS was the problem".
        hunter2_ 3y ago
- nerdjon 3y ago
  I love my Synology NAS, enough that I now have 2 for different use cases. My only issue with them was when I emailed them to confirm that I could have it connected to my network but not have internet access (people calling "wifi" or "ethernet" internet still drives me up the wall) since I was going to block its internet access on my router. First I had issues getting support to understand the distinction between "network" and "internet". Second once I finally did get someone who understood I was asked "Why" or "what was I trying to accomplish". It almost put me off purchasing it that I would be asked why I would want a device like a NAS to have zero internet connectivity. That aside I would agree and it does feel like a very apple like experience (maybe a bit more technical). I mean it isn't as easy as the time capsule was years ago, but its up there.
  - burntwater 3y ago
    Asking "why" or "what are you trying to accomplish?" is standard and good practice - a good person (technician, manager, or many other roles) wants to get at the root of the question so they can provide a genuine solution. I'm sure we've all experienced times where someone asks you an odd question, you ask what they're trying to do, and you come up with a much better solution (or better/more accurate way of asking the question) than what would have been provided in simply answering the first question. Granted, it's frustrating when you are a well-informed person that knows exactly what they're looking for. I just accept it as a cost of dealing with other people.
    - nerdjon 3y ago
      TBH maybe it was the fact that it took a few emails to get there that it felt annoying? I mean I recognize that they may be dealing with far less technical people and maybe that is a valid question. I get what your saying but wouldn't "I don't want my NAS to have an internet connection but I want to make sure it still works locally" be mostly self explanatory? Maybe that is me putting more faith in other people than I should, like obviously it won't be able to update, sync with a cloud, or any other number of things. Maybe thats not obvious? But also to be clear the bad taste it gave me was seeing products that should have no need for an active internet connection and yet are paper weights without it. So when a company seems to be pushing me to connect something to the internet, especially something as sensitive as a NAS... it sets off alarms.
- ksec 3y ago
  >Buy a Synology DiskStation Synology doesn't update their Kernel. Only the latest release model in 2023 comes with 5.10. The others are on 4.x, and if you bought any before 2020 you may be on 3.x. On the 2023 model You would have thought they would at least be on 5.15, no. All Entry level model doesn't come with BTRFS. But apart from that, it is still the best in the market right now.
archerx 4y ago
I’ve been self hosting a nextcloud instance for many years and its been great without any issue. I love it and I use it everyday.
- benatkin 4y ago
  I gave NextCloud a shot and didn't like it. For one thing whatever I had set up for it was sending too many notifications on Android. So YMMV.
  - archerx 3y ago
    The app sucks, I have been using the web interface exclusively even on mobile.
throwaway2056 4y ago
This. Plus: people here calling for Raspberry or Synology do not know 'average' users - People dont know what is ethernet - Most people cant navigate GUI of synology or other stuff - Some of the hn gurus need to work as CS for a week. People get confused what USB-A or USB-C cable. - For hn-gurus with Rpi/nextcloud: These products are sold to average joe that has no clue about tech. - for average joe people, google is internet, facebook is family and whatsapp is chat. - The sales guy that sold it just works for commission. Capitalism. - Same is for WD. They sold the product for $100 8TB so that is the quality one expects.
- quaintdev 4y ago
  Then we need to work on it to make self hosting as ubiquitous as a TV. Imagine a future where all your photos, videos stay at your house on a box and others who have access can view them from anywhere. The corporations are working in direction where this is never possible but given how they all deal with data this is the only future that will be secure and makes sense.
  - Dalewyn 4y ago
    >Imagine a future where all your photos, videos stay at your house on a box and others who have access can view them from anywhere. We are slowly working towards such a future and common users by and large will appreciate it, but it's not going to be the future most tech nerds envision it to be.
    - copper-float 3y ago
      What are you referring to?
      - Dalewyn 3y ago
        Basically: Convenience and customizability are mutually exclusive. We as tech nerds value our ability to power user, but this is quite simply at odds with the interests of common users. Things like further and further abstractioning of file systems, further and further integrations of operating systems with online accounts and other internet services, further and further "appliance"ing of computer systems, etc.
CapsAdmin 4y ago
Although the consequences of failure are not as severe, you could make a similar argument against cooking your own food as the outcome can be unreliable and time consuming. Some enjoy doing it, some just purchase microwave food and some just pay or get someone else to do it for them. Then there are chefs in the media that try to make cooking more accessible with the message that it's not as difficult as people make it out to be. However some pushback/warning against self hosting because we don't yet have a good alternative to reliable "microwave food" is good I guess.
- bon00r 3y ago
  [flagged]
mihaaly 3y ago
"it quickly becomes very insecure and unreliable" As anything else! As the above picture shows. With the added bonus that you are cluless of the state of a Cloud (no insights of its real state, its actual practices, also kept in darkness, only over confident corporate statements). (actually there are quite fine self hosted products with maintainance updates and help where you do not have to be an IT practitioner to use, equal to the level required from Cloud services, just look around)
qwertox 3y ago
While I self-host everything, I fully agree with this. If it works and has no internet access, you'll just leave it there, running for a year, two years, when suddenly something changes. Either you need to upgrade the underlying OS to a new major version or some 3rd-party client changes, and you're confronted with a wall of stuff you must do. Or even if it's something as simple as MongoDB, after a patch (not even a minor version bump), no longer being supported on the Raspberry Pi 4 even though MongoDB themselves posted a blog post a couple of months before that change showing how to easily install it on this device.
Bender 3y ago
I've been self hosting openssh sftp for decades and not run into any problems with security as of yet but it could be I am just lucky. I do not expose any services to IP's that I do not control with exception to my public SFTP servers but there is nothing sensitive or important on those. The boxes auto-update OS patches but I manually reboot them just to ensure they come back in a happy state. This is just to say that a chroot SFTP server and the lftp client is all one really needs to push backups to wherever with functionality similar to rsync but with slower directory enumeration because there isn't a corresponding sync client on the remote end. That's fine with me since I can be asleep when this occurs. For cell phone backups one of the many SFTP clients is AdminHands but I find anything for cell phones is mediocre at best.
IG_Semmelweiss 3y ago
Hello, can you please expand on how using syncthing out of the box would be deemed insecure? Genuinely concerned ive missed something

rwalle 3y ago

Try sending this URL to your uncle. Hacker news is not the entire world.