8 ms·

I think the spirit of this article is correct, although some of the digs at modern web tech and SPAs seem to be beside the point. I used to have a "mildly dyna

I think the spirit of this article is correct, although some of the digs at modern web tech and SPAs seem to be beside the point. I used to have a "mildly dynamic website." It was a $5 digital ocean box. It ran nginx with php-fpm, mostly so it could have a Wordpress install in a subdirectory, and it had a unicorn setup for an experimental Rails app somewhere in there. Given that environment, the "mildly dynamic website" experience that TFA talks about was absolutely true. If I wanted a simple script to accept form input, or some little tiny dynamic experimental website, I could trivially deploy it. I could write PHP (ugh) or whatever other backend service I felt like writing. I ported the Rails app to golang after a while. It was fun. It made for a low cost of entry for experimental, hackish things. It's a nice workshop if you have it. The thing is — if you are running this setup on your own linux virtual machine — it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks. And the base OS needs endless security updates. And maybe you want backups, because you got lazy about maintaining your ansible scripts for system setup. And the price of the $5 virtual linux box tends to go up over the years. And the "personal website" model of the web has kind of declined (not that it's altogether dead, just marginalized by twitter/facebook). So I got exhausted by having to maintain the environment (I already do enough system maintenance at work) and decided to switch to static HTML sites on S3. You can't hack it anymore. But so far — I can live with it.

layer8 2y ago
> The thing is — if you are running this setup on your own linux virtual machine — it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks. And the base OS needs endless security updates. Just use Debian with unattended-upgrades. Done. Only rarely do you have to do anything manually. Setting up daily backups with verification is also a one-time thing.
jimmaswell 2y ago
A daily apt update/upgrade in crontab has been working fine for me. What is the maintenance beyond that?
pixl97 2y ago
And then you forgot to add "I had to stick it behind cloudflare because someone decided to DDOS it and send me 500GB/s traffic for no apparent reason at all. The early web was the wild west. The modern web has turned into small fry trying to hide in the shadows of megalodons so they don't get ate by a goliath.
- ozim 2y ago
  You don't have to go as far as DDOS. Blogpost mentions comment section, like it something you can "just do" - no one wants to do comment sections in 2024 on their own. Amount of crap one will get in case they start to have mildly popular post is insane.
edflsafoiewq 2y ago
Shared hosting is probably better, and AFAIK more common, for the mildly dynamic website. The host handles a lot of the admin tasks like OS updates that you have to handle yourself with a VPS.
- adamomada 2y ago
  When I was checking out the grav flat-file CMS, they had a recommendation for PaaS (php as a service) https://learn.getgrav.org/16/webservers-hosting https://learn.getgrav.org/16/webservers-hosting
  - endofreach 2y ago
    As much as i love every P standing for PHP, "PaaS" usually means Platform as a Service
- massysett 2y ago
  NearlyFreeSpeech.NET is good for this. Their main tier - "production" sites - are very inexpensive and the admins take care of OS and server-software updates. They have another tier - "non-production" sites - that are even cheaper and can be perfectly sufficient for a personal homepage. The admins maintain these servers as well but they might do beta testing on them. The environment is fully hackable and has PHP, SSH, SFTP, MariaDB, dominant languages like Perl and Python, obscure languages like Haskell and Lisp, etc etc.
  - mk12 2y ago
    +1 for NearlyFreeSpeech! I’ve used them for years paying only 40-45 cents a month. I love that I can just ssh in and mess around. My site is mostly static but recently I wanted to add a private section for specific family and friends. So I implemented OAuth 2.0 login with 2 php files and an .htaccess rule.
    - Something1234 2y ago
      Love nearly free speech. Although I wonder how often your family actually uses it.
chubot 2y ago
The thing is — if you are running this setup on your own linux virtual machine — it requires endless system maintenance. Yeah, this is exactly what I talk about this post -- why do I used shared hosting? Comments on Scripting, CGI, and FastCGI - https://www.oilshell.org/blog/2024/06/cgi.html https://www.oilshell.org/blog/2024/06/cgi.html
dreadnip 2y ago
> it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks How so? I've seen PHP websites & apps run for 10+ years in production without updates. Even longer with a simple "sudo apt update" every few months and a "composer update" every year or so. The maintenance rate is actually very very low.
- crazygringo 2y ago
  Years ago a Digital Ocean virtual server of mine stopped working because I had never upgraded Ubuntu to the newest major version. After a few years, the version of Ubuntu was no longer supported by the Digital Ocean hypervisor and couldn't mount or boot at all. In my experience, yes you absolutely need maintenance. In the past I've had to upgrade from HTTP to HTTPS, upgrade the OS, upgrade to newer versions of external API and embedded components because the old ones were deprecated, handle a domain registrar shutting down, and then yes absolutely PHP updates and upgrades for security that then start giving you warnings because less secure versions of functions are being deprecated... And frequently updating the one thing that's broken necessitates upgrading a bunch of other things that breaks other things. I literally cannot imagine how you would keep a PHP site running on a virtual server for 10 years without any maintenance. I need to address an issue probably roughly once a year.
  - Publius_Enigma 2y ago
    These are all problems that shouldn’t exist. You have succinctly described the problems with modern IT. Software doesn’t need to have an expiration date. It doesn’t decay or expire. But because of our endless need to change things, rather than just fix bugs, we end up with this precarious tower of cards. If, as an industry, we focussed on correctness and reliability over features, a lot of these problems would disappear.
    - quest88 2y ago
      I agree there's some truth in what you say. I do think these upgrades are part of a path towards correctness and reliability (bug fixes, security vulnerabilities, etc).
fpoling 2y ago
I am puzzled that your site required constant maintenance. I run a similar setup that I hardens using systemd service restrictions with nothing running as root. Then I subscribed to Debian and couple more mail lists with security announcements. It turned out I needed to spend like 20 minutes per month to maintain it. I also find that PHP works much better than Go regarding maintenance efforts. With Debian I have automatic updates of all PHP dependencies that I need so security announcements is a nice single source of truth. But with Go I would need to setup monitoring of dependencies for updates myself and recompile/deploy the code as necessary.
- bitslayer 2y ago
  They didn't say constant maintenance, they said endless maintenance. 20 minutes a month is a never ending commitment of time. They have better things to think about.
  - oopsallmagic 2y ago
    Yeah, like developing a résumé.
notatoad 2y ago
>and decided to switch to static HTML sites on S3 it's really hard to overstate how great s3 sites are with cloudfront in front of them. mine costs me <$1/month, i have essentially no concerns about security, ddos, maintenance, anything. if i want to update it, i push some different files to s3. the backups are the other copy of the data on my local machine that i pushed to it. the added complexity for any level of dynamic-ness is really just not worth it, unless i'm going to go to the trouble of making a full-on app that needs a revenue model.
- jmathai 2y ago
  Similarly, Github Pages are great. You get rudimentary dynamic support by using a static site generator if you need it.
- selcuka 2y ago
  CloudFlare Pages are another great product for zero maintenance static sites, and they can be made mildly (or heavily, if you want) dynamic with CloudFlare Workers.
  - mmarian 2y ago
    Second Cloudflare. And it's super easy to hook up to domains registered via Cloudflare too.
BenjiWiebe 2y ago
Linode's base tier VPS is still $5/month.
mtalhaashraf 2y ago
I tried S3 for my static HTML site but the problem is my personal website gets infrequent visitors and for each visit the first load is always slow probably because my website gets moved from memory to disk. The thing is, my website is less than 20KB and I don't like it to be slow for all the users just because it is infrequent. Managing my own server allows me to lock my website into memory.

layer8 2y ago

> The thing is — if you are running this setup on your own linux virtual machine — it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks. And the base OS needs endless security updates. Just use Debian with unattended-upgrades. Done. Only rarely do you have to do anything manually. Setting up daily backups with verification is also a one-time thing.

jimmaswell 2y ago

A daily apt update/upgrade in crontab has been working fine for me. What is the maintenance beyond that?

pixl97 2y ago

And then you forgot to add "I had to stick it behind cloudflare because someone decided to DDOS it and send me 500GB/s traffic for no apparent reason at all. The early web was the wild west. The modern web has turned into small fry trying to hide in the shadows of megalodons so they don't get ate by a goliath.

ozim 2y ago
You don't have to go as far as DDOS. Blogpost mentions comment section, like it something you can "just do" - no one wants to do comment sections in 2024 on their own. Amount of crap one will get in case they start to have mildly popular post is insane.

edflsafoiewq 2y ago

Shared hosting is probably better, and AFAIK more common, for the mildly dynamic website. The host handles a lot of the admin tasks like OS updates that you have to handle yourself with a VPS.

adamomada 2y ago
When I was checking out the grav flat-file CMS, they had a recommendation for PaaS (php as a service) https://learn.getgrav.org/16/webservers-hosting https://learn.getgrav.org/16/webservers-hosting
- endofreach 2y ago
  As much as i love every P standing for PHP, "PaaS" usually means Platform as a Service
massysett 2y ago
NearlyFreeSpeech.NET is good for this. Their main tier - "production" sites - are very inexpensive and the admins take care of OS and server-software updates. They have another tier - "non-production" sites - that are even cheaper and can be perfectly sufficient for a personal homepage. The admins maintain these servers as well but they might do beta testing on them. The environment is fully hackable and has PHP, SSH, SFTP, MariaDB, dominant languages like Perl and Python, obscure languages like Haskell and Lisp, etc etc.
- mk12 2y ago
  +1 for NearlyFreeSpeech! I’ve used them for years paying only 40-45 cents a month. I love that I can just ssh in and mess around. My site is mostly static but recently I wanted to add a private section for specific family and friends. So I implemented OAuth 2.0 login with 2 php files and an .htaccess rule.
  - Something1234 2y ago
    Love nearly free speech. Although I wonder how often your family actually uses it.

chubot 2y ago

The thing is — if you are running this setup on your own linux virtual machine — it requires endless system maintenance. Yeah, this is exactly what I talk about this post -- why do I used shared hosting? Comments on Scripting, CGI, and FastCGI - https://www.oilshell.org/blog/2024/06/cgi.html https://www.oilshell.org/blog/2024/06/cgi.html

dreadnip 2y ago

> it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks How so? I've seen PHP websites & apps run for 10+ years in production without updates. Even longer with a simple "sudo apt update" every few months and a "composer update" every year or so. The maintenance rate is actually very very low.

crazygringo 2y ago
Years ago a Digital Ocean virtual server of mine stopped working because I had never upgraded Ubuntu to the newest major version. After a few years, the version of Ubuntu was no longer supported by the Digital Ocean hypervisor and couldn't mount or boot at all. In my experience, yes you absolutely need maintenance. In the past I've had to upgrade from HTTP to HTTPS, upgrade the OS, upgrade to newer versions of external API and embedded components because the old ones were deprecated, handle a domain registrar shutting down, and then yes absolutely PHP updates and upgrades for security that then start giving you warnings because less secure versions of functions are being deprecated... And frequently updating the one thing that's broken necessitates upgrading a bunch of other things that breaks other things. I literally cannot imagine how you would keep a PHP site running on a virtual server for 10 years without any maintenance. I need to address an issue probably roughly once a year.
- Publius_Enigma 2y ago
  These are all problems that shouldn’t exist. You have succinctly described the problems with modern IT. Software doesn’t need to have an expiration date. It doesn’t decay or expire. But because of our endless need to change things, rather than just fix bugs, we end up with this precarious tower of cards. If, as an industry, we focussed on correctness and reliability over features, a lot of these problems would disappear.
  - quest88 2y ago
    I agree there's some truth in what you say. I do think these upgrades are part of a path towards correctness and reliability (bug fixes, security vulnerabilities, etc).

fpoling 2y ago

I am puzzled that your site required constant maintenance. I run a similar setup that I hardens using systemd service restrictions with nothing running as root. Then I subscribed to Debian and couple more mail lists with security announcements. It turned out I needed to spend like 20 minutes per month to maintain it. I also find that PHP works much better than Go regarding maintenance efforts. With Debian I have automatic updates of all PHP dependencies that I need so security announcements is a nice single source of truth. But with Go I would need to setup monitoring of dependencies for updates myself and recompile/deploy the code as necessary.

bitslayer 2y ago
They didn't say constant maintenance, they said endless maintenance. 20 minutes a month is a never ending commitment of time. They have better things to think about.
- oopsallmagic 2y ago
  Yeah, like developing a résumé.

notatoad 2y ago

>and decided to switch to static HTML sites on S3 it's really hard to overstate how great s3 sites are with cloudfront in front of them. mine costs me <$1/month, i have essentially no concerns about security, ddos, maintenance, anything. if i want to update it, i push some different files to s3. the backups are the other copy of the data on my local machine that i pushed to it. the added complexity for any level of dynamic-ness is really just not worth it, unless i'm going to go to the trouble of making a full-on app that needs a revenue model.

jmathai 2y ago
Similarly, Github Pages are great. You get rudimentary dynamic support by using a static site generator if you need it.
selcuka 2y ago
CloudFlare Pages are another great product for zero maintenance static sites, and they can be made mildly (or heavily, if you want) dynamic with CloudFlare Workers.
- mmarian 2y ago
  Second Cloudflare. And it's super easy to hook up to domains registered via Cloudflare too.

BenjiWiebe 2y ago

Linode's base tier VPS is still $5/month.

mtalhaashraf 2y ago

I tried S3 for my static HTML site but the problem is my personal website gets infrequent visitors and for each visit the first load is always slow probably because my website gets moved from memory to disk. The thing is, my website is less than 20KB and I don't like it to be slow for all the users just because it is infrequent. Managing my own server allows me to lock my website into memory.