5 ms·

It's easy to create a secure server. Use private keys. Use a firewall (ufw is really simple) and only expose your reverse proxy (e.g nginx or haproxy). Use doc

It's easy to create a secure server. Use private keys. Use a firewall (ufw is really simple) and only expose your reverse proxy (e.g nginx or haproxy). Use docker to run your crap. Any software engineer should be well capable of setting up a secure server. It really is simple.

bingo-bongo 3y ago
Right up until someone runs a container with 8080:8080, which unfortunately bypasses ufw and the container is suddenly exposed to the entire internet .. :|
- Vuizur 3y ago
  Reading the GitHub issue about this is somewhat entertaining: https://github.com/docker/for-linux/issues/690 https://github.com/docker/for-linux/issues/690 People are getting hacked a lot because of this, and docker doesn't seem to care all that much.
  - bArray 3y ago
    Oh man, that really sucks, to the point I would consider against using Docker for anything deployed. 5 years and such a basic security issue goes unfixed.
JackSlateur 3y ago
The minute you implement a firewall, you failed Firewalls are made for two things: - packets alteration (iptable table mangle) - applying filtering on behalf of a badly configured OS So, if your case and if you want to prevent remote access to your database, you have a bad way: create a firewall rule to drop connections to tcp/3306 And you have a good way: configure your sql to bind to ::1 The firewall way requires two configuration (hence: complexity) and hide your intent : the mysql say : "I accept connections from everybody", and then the firewall say "I deny all connections". While the good way is clear and sane : one component who say : "I only accept connections from localhost"
cpursley 3y ago
None of that stuff is “simple”. Git pushing and having Render.com auto deploy is, however.
- arandomusername 3y ago
  Using private keys is not simple? sudo apt-get install ufw and ufw allow https is not simple? The whole process takes maybe 30-60 minutes to setup for someone completely new and following guides. Render's is simple, true, you just pay $300 for 1TB of bandwidth. It's crazy how much Merchants of Complexity fooled devs into thinking that running your own server is complicated and you need to pay 1000x to save few minutes of your time.
  - cpursley 3y ago
    Merchants of Complexity didn't fool me, trying to run my own severs convinced me.
    - arandomusername 3y ago
      What did you find difficult in running your own servers?
      - cpursley 3y ago
        Even trying to figure out which OS, for a start.
      - throwaway11460 3y ago
        Backups, recovery on VM host failure
- speff 3y ago
  Blows my mind that tech people don’t see that as simple. The comments on this post did wonders for my imposter syndrome
ChrisMarshallNY 3y ago
> Any software engineer should be ... It really is simple. I get that, a lot. It's the "No True Scotsman" of tech. This is also used as a way of validating college-style leetcode. Let me introduce you to my GH Activity Graph[0]. See all that green? That's pretty much all coding in Swift; mostly in shipping apps and whatnot. There's a bit of PHP, for server-side stuff, but I like to spend a lot of time, coding frontend app stuff. Every minute I spend, being a Linux admin, is a minute that I don't spend on executable code. I know that there's a number of folks, hereabout, that can code circles, around me, in Swift, and a few more, that can code circles around me, in PHP, but pretty much all of you, can run circles around me, in Linux admin. I'm not especially interested in competing, there; especially since a number of you are likely the folks that would Do Bad Things to my server, given an opening. [0] https://github.com/ChrisMarshallNY#github-stuff https://github.com/ChrisMarshallNY#github-stuff
- arandomusername 3y ago
  Every minute you spend on here, is a minute you don't spend on executable code as well, yet you're on here. Perhaps because spending every productive minute on coding is practically impossible. You don't have to be a linux admin to be able to setup a properly secure server, nowadays it's quite trivial. I bet you, that if you tried, you would be able to do so in less than an hour (at a relaxed pace). We get lied to about the complexity of hosting by the cloud. I was able to host forums and game servers on VPSes when i was a young teenager, and I'm not technically gifted, it just wasn't complicated at all.
  - ChrisMarshallNY 3y ago
    Well, we choose where to spend what free time we have. I like hanging here. There's really no pressure to perform. I'm too old to play insecurity-sop games. I tend to like shipping stuff, which means taking Responsibility for its operation, maintenance and security. That often means a lot of "not fun." My servers are working servers. They have data and capabilities that are important to a lot of "not-Chris" people. It's my job to make sure that they get what they are [not] paying for (I write free stuff). That can be a bit stressful, at times; especially when some bad actor is making life miserable for me. I'd much rather that be someone else's problem, where I can write an email that says "Make it so, Numbah One!", instead of spending two days, wrestling with config files, and CLIs.

bingo-bongo 3y ago

Right up until someone runs a container with 8080:8080, which unfortunately bypasses ufw and the container is suddenly exposed to the entire internet .. :|

Vuizur 3y ago
Reading the GitHub issue about this is somewhat entertaining: https://github.com/docker/for-linux/issues/690 https://github.com/docker/for-linux/issues/690 People are getting hacked a lot because of this, and docker doesn't seem to care all that much.
- bArray 3y ago
  Oh man, that really sucks, to the point I would consider against using Docker for anything deployed. 5 years and such a basic security issue goes unfixed.

JackSlateur 3y ago

The minute you implement a firewall, you failed Firewalls are made for two things: - packets alteration (iptable table mangle) - applying filtering on behalf of a badly configured OS So, if your case and if you want to prevent remote access to your database, you have a bad way: create a firewall rule to drop connections to tcp/3306 And you have a good way: configure your sql to bind to ::1 The firewall way requires two configuration (hence: complexity) and hide your intent : the mysql say : "I accept connections from everybody", and then the firewall say "I deny all connections". While the good way is clear and sane : one component who say : "I only accept connections from localhost"

cpursley 3y ago

None of that stuff is “simple”. Git pushing and having Render.com auto deploy is, however.

arandomusername 3y ago
Using private keys is not simple? sudo apt-get install ufw and ufw allow https is not simple? The whole process takes maybe 30-60 minutes to setup for someone completely new and following guides. Render's is simple, true, you just pay $300 for 1TB of bandwidth. It's crazy how much Merchants of Complexity fooled devs into thinking that running your own server is complicated and you need to pay 1000x to save few minutes of your time.
- cpursley 3y ago
  Merchants of Complexity didn't fool me, trying to run my own severs convinced me.
  - arandomusername 3y ago
    What did you find difficult in running your own servers?
    - cpursley 3y ago
      Even trying to figure out which OS, for a start.
    - throwaway11460 3y ago
      Backups, recovery on VM host failure
speff 3y ago
Blows my mind that tech people don’t see that as simple. The comments on this post did wonders for my imposter syndrome

ChrisMarshallNY 3y ago

> Any software engineer should be ... It really is simple. I get that, a lot. It's the "No True Scotsman" of tech. This is also used as a way of validating college-style leetcode. Let me introduce you to my GH Activity Graph[0]. See all that green? That's pretty much all coding in Swift; mostly in shipping apps and whatnot. There's a bit of PHP, for server-side stuff, but I like to spend a lot of time, coding frontend app stuff. Every minute I spend, being a Linux admin, is a minute that I don't spend on executable code. I know that there's a number of folks, hereabout, that can code circles, around me, in Swift, and a few more, that can code circles around me, in PHP, but pretty much all of you, can run circles around me, in Linux admin. I'm not especially interested in competing, there; especially since a number of you are likely the folks that would Do Bad Things to my server, given an opening. [0] https://github.com/ChrisMarshallNY#github-stuff https://github.com/ChrisMarshallNY#github-stuff

arandomusername 3y ago
Every minute you spend on here, is a minute you don't spend on executable code as well, yet you're on here. Perhaps because spending every productive minute on coding is practically impossible. You don't have to be a linux admin to be able to setup a properly secure server, nowadays it's quite trivial. I bet you, that if you tried, you would be able to do so in less than an hour (at a relaxed pace). We get lied to about the complexity of hosting by the cloud. I was able to host forums and game servers on VPSes when i was a young teenager, and I'm not technically gifted, it just wasn't complicated at all.
- ChrisMarshallNY 3y ago
  Well, we choose where to spend what free time we have. I like hanging here. There's really no pressure to perform. I'm too old to play insecurity-sop games. I tend to like shipping stuff, which means taking Responsibility for its operation, maintenance and security. That often means a lot of "not fun." My servers are working servers. They have data and capabilities that are important to a lot of "not-Chris" people. It's my job to make sure that they get what they are [not] paying for (I write free stuff). That can be a bit stressful, at times; especially when some bad actor is making life miserable for me. I'd much rather that be someone else's problem, where I can write an email that says "Make it so, Numbah One!", instead of spending two days, wrestling with config files, and CLIs.