3 ms·
Years ago, I home rolled my own web server. Why? Security --- it is dedicated and limited to a single purpose so every request can be scrutinized and validate
by jqpabc123 3y ago
Years ago, I home rolled my own web server.
Why? Security --- it is dedicated and limited to a single purpose so every request can be scrutinized and validated and verified. Attack surface is minimized and totally unique so any hacker is starting from ground zero. The only common vulnerability is the OS network stack.
After 25 years of being openly exposed and attacked on the internet, it has never been breached --- at least to my knowledge. In that time, I think I've saved a lot of time and money watching exploits for commonly used web servers just pass me by.
- Shawnj2 3y agoThis is a good point (at a small scale until you become large enough to be a target people spend significant time targeting)
- jqpabc123 3y agoPeople target my server every single day. They mostly try off the shelf attacks geared toward known vulnerabilities and common misconfigurations of popular web servers and setups. And these don't work --- so they mostly give up after a while.
- Shawnj2 3y agoBecause those are more likely to yield results than trying to figure out how to break your custom web server. If a big company suddenly started using it or AWS made your custom web server a default option then that would be a different scenario.