4 ms·

The author mostly just hand waves away self-hosting. There's an analogy that compares it to suburbia, but unlike the suburbs where you have to drive 40 minutes

The author mostly just hand waves away self-hosting. There's an analogy that compares it to suburbia, but unlike the suburbs where you have to drive 40 minutes to get anywhere interesting, … an Internet hosted service is just as accessible, anywhere. It's a vapid analogy. The only substantive argument I can see is that the technology is immature: > Well...without exposing our services to the public internet and forcing our friends to signup for our weird app Which, yeah, of course the tech is, there's only like a dozen people doing this. The exact hurdle named is hardly insurmountable: in the standards, OIDC overcomes this¹, or guest links. I don't want my family signing up for my weird app either. One of the other big hurdles is that ISPs like to sell "Internet access", but only deliver half the deal. If you're not getting IPv6 connectivity in the year 2025, I'm sorry, that's a crippled product that your ISP was defunct and didn't properly inform you of when they sold it. (It's a lot easier to self-host on the v6 Internet. Some of my personal services are v6 only b/c of that, and that it works well enough in all but the most extreme or temporary locations.) (¹but the half-baked OIDC implementations out there might require you to pre-register your app with them. That, rightly, might be a PITA.)

rel_ic 1y ago
I totally agree. I see this "people don't want to do hard stuff" argument used all over - completely disregarding tens of thousands of years of people doing hard stuff. It comes off to me as the author not wanting to do the hard stuff of working towards their values. Just kind of defeatist and trying to make a splash but leaning on a pretty weak premise.
- scubbo 1y ago
  > It comes off to me as the author not wanting to do the hard stuff of working towards their values Unfair IMO. The author _did_ the hard work. And recognized that most other people, not similarly motivated, would not.
  - smeej 1y ago
    And, the author is right. Most people do not give a rat's ass about the security of their data. They know their social media apps are tracking where they go and who they meet, and they'll say it's creepy if you ask them, but they don't actually care enough to lift a finger to do anything about it.
- bigstrat2003 1y ago
  > completely disregarding tens of thousands of years of people doing hard stuff a) Just because humanity as a whole did hard things, doesn't mean that most humans did or were willing to. It's perfectly possible that all the hard things we did were accomplished by a handful of remarkable individuals, doing things that the majority never would have been willing to. b) just because people in one age have been willing to do things, doesn't mean they are willing to do so in all ages. So it's not like the past necessarily proves anything here.
wmf 1y ago
I've thought deeply about this topic but from the pro-suburbia side and I actually agree with the analogy. At a bare minimum if you want to be independent you need a domain which is ~$10/year. That's a small amount but it's already more than most people will pay. (IMO this is irrational if you're paying >$500/year for cellular service but I digress.) Good home servers like Helm (RIP) or Umbrel are $300+ upfront. A good NAS that can also self-host is even more. As you said, if your ISP sucks maybe you have to upgrade to "pro" broadband that's more expensive. Ultimately you're spending hundreds or thousands of dollars on a worse replacement for services that are already "free". Self-hosting is like spending money putting a swimming pool in your backyard when you could walk to a public pool instead.
- selfhoster11 1y ago
  I disagree. From experience (see my username), self-hosting is hardly expensive. A $50 ex-corporate SFF with a couple of large M.2 or SATA SSDs will be a lot more powerful and easier to set up and manage than a Raspberry Pi, while not drawing much power. The ongoing costs are larger than not self-hosting, but not terrible - unless you want a symmetric connection, the domain name renewal is the expensive part.
  - wmf 1y ago
    Normies pay with money; you're paying with time and knowledge.
    - selfhoster11 1y ago
      Nope, normies pay with sovereignty. Given the entire ecosystem (Microsoft, Apple, Google and Meta being the main ones) is trying to rob me of it, I'm happy hosting what I need and can handle admining, paying for what I need and can't handle admining, and saying no to the rest.
      - faust201 1y ago
        How is responding nope make sense? Many people don't know to build immich or ZFS etc. I do know some self-hosters losing data from just a poweroutage etc. So there are self-hosters that also cry.
scubbo 1y ago
> exposing our services to the public internet You yourself have hand-waved away an important part - security. It's not (just) about the friction of signup (though, I'll get to that later) - it's the fact that you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. And sure, you can give them a login to your VPN, but that doesn't negate the next part... > and forcing our friends to signup for our weird app > in the standards, OIDC overcomes this It's not the signup that's the hurdle. It's the fragmentation. Sure, if you implement OIDC, your friends can sign up to your photo app. And they can sign up to Sam's, and Joe's, and the app of the cute bakery on the street, and a couple others. What then? The whole value of a network is that the components are interconnected and can intercommunicate. If I have to upload my photos seventeen times to seventeen different partitioned applications for my various social groups to see them, I'm just as likely to not bother. Fediverse-like ideas go some way towards addressing that, but they don't seem to be in any state of usability for anyone non-technical (I say that as someone who was using Mastodon as my only social media for the last couple of years)
- dzikimarian 1y ago
  Apparently I'm utterly insane for years with no consequences. SaaS/cloud providers propagate this FUD 24/7 and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Relax. Most companies has security team incapable of operating beyond checklist.
  - scubbo 1y ago
    > [it's fine to expose your services to the Internet, there will be] no consequences. > and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Pick one. If even the "big boys" can't protect themselves, why do you believe you can?
    - dzikimarian 1y ago
      I think both cases pose similar risk from security standpoint. I'm not perfect, they aren't either. There's a lot of nuance about attack surface, available tech/resources, effort of average employee vs mine etc. But all in all let's call it roughly equal. I just prefer to host by myself and I think it's perfectly reasonable alternative. Far from "utterly insane".
Zacharias030 1y ago
Isn‘t the sweet spot for many things to just „host“ on hetzner or whatever, but not „self-host“ and then trip over the power cable once in a while?
- illiac786 1y ago
  Depends on the reasons you are self hosting. If you want to be relatively certain hetzner cannot access your data, you need your own server and confidential computing enabled, that’s not cheap anymore.

rel_ic 1y ago

I totally agree. I see this "people don't want to do hard stuff" argument used all over - completely disregarding tens of thousands of years of people doing hard stuff. It comes off to me as the author not wanting to do the hard stuff of working towards their values. Just kind of defeatist and trying to make a splash but leaning on a pretty weak premise.

scubbo 1y ago
> It comes off to me as the author not wanting to do the hard stuff of working towards their values Unfair IMO. The author _did_ the hard work. And recognized that most other people, not similarly motivated, would not.
- smeej 1y ago
  And, the author is right. Most people do not give a rat's ass about the security of their data. They know their social media apps are tracking where they go and who they meet, and they'll say it's creepy if you ask them, but they don't actually care enough to lift a finger to do anything about it.
bigstrat2003 1y ago
> completely disregarding tens of thousands of years of people doing hard stuff a) Just because humanity as a whole did hard things, doesn't mean that most humans did or were willing to. It's perfectly possible that all the hard things we did were accomplished by a handful of remarkable individuals, doing things that the majority never would have been willing to. b) just because people in one age have been willing to do things, doesn't mean they are willing to do so in all ages. So it's not like the past necessarily proves anything here.

wmf 1y ago

I've thought deeply about this topic but from the pro-suburbia side and I actually agree with the analogy. At a bare minimum if you want to be independent you need a domain which is ~$10/year. That's a small amount but it's already more than most people will pay. (IMO this is irrational if you're paying >$500/year for cellular service but I digress.) Good home servers like Helm (RIP) or Umbrel are $300+ upfront. A good NAS that can also self-host is even more. As you said, if your ISP sucks maybe you have to upgrade to "pro" broadband that's more expensive. Ultimately you're spending hundreds or thousands of dollars on a worse replacement for services that are already "free". Self-hosting is like spending money putting a swimming pool in your backyard when you could walk to a public pool instead.

selfhoster11 1y ago
I disagree. From experience (see my username), self-hosting is hardly expensive. A $50 ex-corporate SFF with a couple of large M.2 or SATA SSDs will be a lot more powerful and easier to set up and manage than a Raspberry Pi, while not drawing much power. The ongoing costs are larger than not self-hosting, but not terrible - unless you want a symmetric connection, the domain name renewal is the expensive part.
- wmf 1y ago
  Normies pay with money; you're paying with time and knowledge.
  - selfhoster11 1y ago
    Nope, normies pay with sovereignty. Given the entire ecosystem (Microsoft, Apple, Google and Meta being the main ones) is trying to rob me of it, I'm happy hosting what I need and can handle admining, paying for what I need and can't handle admining, and saying no to the rest.
    - faust201 1y ago
      How is responding nope make sense? Many people don't know to build immich or ZFS etc. I do know some self-hosters losing data from just a poweroutage etc. So there are self-hosters that also cry.

scubbo 1y ago

> exposing our services to the public internet You yourself have hand-waved away an important part - security. It's not (just) about the friction of signup (though, I'll get to that later) - it's the fact that you'd be utterly insane, as an individual developer without a full-time security team, to expose a self-hosted application to the Internet. And sure, you can give them a login to your VPN, but that doesn't negate the next part... > and forcing our friends to signup for our weird app > in the standards, OIDC overcomes this It's not the signup that's the hurdle. It's the fragmentation. Sure, if you implement OIDC, your friends can sign up to your photo app. And they can sign up to Sam's, and Joe's, and the app of the cute bakery on the street, and a couple others. What then? The whole value of a network is that the components are interconnected and can intercommunicate. If I have to upload my photos seventeen times to seventeen different partitioned applications for my various social groups to see them, I'm just as likely to not bother. Fediverse-like ideas go some way towards addressing that, but they don't seem to be in any state of usability for anyone non-technical (I say that as someone who was using Mastodon as my only social media for the last couple of years)

dzikimarian 1y ago
Apparently I'm utterly insane for years with no consequences. SaaS/cloud providers propagate this FUD 24/7 and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Relax. Most companies has security team incapable of operating beyond checklist.
- scubbo 1y ago
  > [it's fine to expose your services to the Internet, there will be] no consequences. > and then Okta, which should be pinnacle of security gets hacked and has issues with disclosure. Pick one. If even the "big boys" can't protect themselves, why do you believe you can?
  - dzikimarian 1y ago
    I think both cases pose similar risk from security standpoint. I'm not perfect, they aren't either. There's a lot of nuance about attack surface, available tech/resources, effort of average employee vs mine etc. But all in all let's call it roughly equal. I just prefer to host by myself and I think it's perfectly reasonable alternative. Far from "utterly insane".

Zacharias030 1y ago

Isn‘t the sweet spot for many things to just „host“ on hetzner or whatever, but not „self-host“ and then trip over the power cable once in a while?

illiac786 1y ago
Depends on the reasons you are self hosting. If you want to be relatively certain hetzner cannot access your data, you need your own server and confidential computing enabled, that’s not cheap anymore.