3 ms·

As much as it pains me to say it, it's true. I use predominantly open source software on all my computers with some small exceptions. I used to rely on some clo

As much as it pains me to say it, it's true. I use predominantly open source software on all my computers with some small exceptions. I used to rely on some cloud services because of the convenience and nothing else. But leaks started becoming way too common and what I can say about all places that I've worked at, data is handled really badly. If you pair that with some OSINT skills, you can learn pretty much anything about anyone from a single leak. So over the past few years I've been slowly cutting down my dependency on cloud services. Nextcloud was the first big step, a zfs pool for backups, a few custom protocols for alerting and kill switches and that's it. On paper this sounds really good but there's a lot of overhead when it comes to maintenance. "Yeah, it's just one more docker-compose.yml, big whoop"(yes kubernetes is pointless overkill if you are the sole user). I've said that too many times and it's not true cause it only takes one small thing that you overlooked and you have to spend a day or two to put everything back up together. Another thing worth mentioning is that open source can be a good alternative but open source does not mean free or cheap. For instance, I've gotten really into drones and radio communications lately. Take hackrf and the baby brother that is flipper zero - they are both completely open source but neither of them is cheap. In fact, they are really expensive - they are effectively open source ASIC's. I'm willing to bet that north of 80% of the cost is down to the software and not the hardware - because polishing a piece of software to the point where you can pick up a product and use it without effort or a steep learning curve, involves a ton of work on behalf of developers and UX/I people. And you can't really cut off all big tech - open source phones are BAD, you don't really have a good alternative to google maps and waze, you still heavily rely on search engines and a few dozen services if you start digging deeper. There are also a number of services which do not have an even half-decent open source alternative. Also not everyone has the skills to set up and run these things. I think the big case in favor of self-hosting whatever you can is that while open source is far from immune to leaks, if it resides in your private network(which it should) without access to the rest of the world, those holes will eventually be patched and you can take action in the meantime - stop the service, block a few ports, etc. The odds of you personally getting affected are pretty low. Now if a leak happens in big tech, there's nothing you can do about it and by the time you learn about it, it's often too late. Honestly, this is the number one reason I'm doing this to myself.

jcgrillo 2y ago
I think your experience is interesting, because it seems like approximately the same small fraction of individuals as companies commit to "vertically integrated software"--that is you own everything top to bottom. That is to say almost nobody does it. For an individual that's excusable, it's a mountain of expertise and effort, although I imagine it pays off rather well in skills learning. For a company, not so much. Companies (and governments) have the ability to acquire the expertise they need to vertically integrate. Some do so when they see value in it, but it's rare. Why do so few make the choice?
- okwhateverdude 2y ago
  > Why do so few make the choice? Because it is risky. The more esoteric the knowledge gets, the further it moves away from your core business, the more in-demand the skills are. As an example, maintaining your own metrics and timeseries storage. It takes quite a few skilled hands to do this in house and probably only feasible for larger companies anyway. Or you can simply hand this problem over to DataDog. While they are pricey, it is potentially pricier to build your own internal DataDog-like system, especially if you consider the opportunity cost of pulling your most skilled engineers to build it instead of building your product that your customers are paying for. Companies are perfectly willing to pay a premium to not worry about something, and that includes not worrying about your very skilled engineers leaving and then needing to scramble because no one else understands what has been built.
  - jcgrillo 2y ago
    There are three big risks I see in depending on vendors: 1. You aren't average. Market forces might not align with your use case. The pricing model might change, or it might happen that you find out later it doesn't scale well for your business. 2. They might leave you suddenly. For example, all the google "products" (quotes because there is actually only one--ads) that have disappeared over the years. Even when an open source dependency suffers a cataclysmic licensing event, you can still fork it and carry on, provided you've both chosen your dependencies wisely and hired the people capable of maintaining them. 3. By choosing a vendor you're making a commitment to ossifying a part of your stack. The observability example is a good one here. At the companies I've worked for who do all their logging, metrics, alerting, etc in-house, developers aren't afraid to use the tools. The tools adapt to the requirements, whether it's cost efficiency, features, whatever. At the companies where we've used vendors everyone's perpetually afraid of increasing the monthly bill, and nobody has a say in deciding what goes on the product roadmap. To be clear, this might be the right trade.

jcgrillo 2y ago

I think your experience is interesting, because it seems like approximately the same small fraction of individuals as companies commit to "vertically integrated software"--that is you own everything top to bottom. That is to say almost nobody does it. For an individual that's excusable, it's a mountain of expertise and effort, although I imagine it pays off rather well in skills learning. For a company, not so much. Companies (and governments) have the ability to acquire the expertise they need to vertically integrate. Some do so when they see value in it, but it's rare. Why do so few make the choice?

okwhateverdude 2y ago
> Why do so few make the choice? Because it is risky. The more esoteric the knowledge gets, the further it moves away from your core business, the more in-demand the skills are. As an example, maintaining your own metrics and timeseries storage. It takes quite a few skilled hands to do this in house and probably only feasible for larger companies anyway. Or you can simply hand this problem over to DataDog. While they are pricey, it is potentially pricier to build your own internal DataDog-like system, especially if you consider the opportunity cost of pulling your most skilled engineers to build it instead of building your product that your customers are paying for. Companies are perfectly willing to pay a premium to not worry about something, and that includes not worrying about your very skilled engineers leaving and then needing to scramble because no one else understands what has been built.
- jcgrillo 2y ago
  There are three big risks I see in depending on vendors: 1. You aren't average. Market forces might not align with your use case. The pricing model might change, or it might happen that you find out later it doesn't scale well for your business. 2. They might leave you suddenly. For example, all the google "products" (quotes because there is actually only one--ads) that have disappeared over the years. Even when an open source dependency suffers a cataclysmic licensing event, you can still fork it and carry on, provided you've both chosen your dependencies wisely and hired the people capable of maintaining them. 3. By choosing a vendor you're making a commitment to ossifying a part of your stack. The observability example is a good one here. At the companies I've worked for who do all their logging, metrics, alerting, etc in-house, developers aren't afraid to use the tools. The tools adapt to the requirements, whether it's cost efficiency, features, whatever. At the companies where we've used vendors everyone's perpetually afraid of increasing the monthly bill, and nobody has a say in deciding what goes on the product roadmap. To be clear, this might be the right trade.