5 ms·

What’s so painful about self hosting? I’ve been self hosting since before I hit puberty. If 12 year old me can run a httpd, anyone can. And if you don’t want t

by Gud 1y ago

What’s so painful about self hosting? I’ve been self hosting since before I hit puberty. If 12 year old me can run a httpd, anyone can. And if you don’t want to self host, at least try to use services from organisations that aren’t hostile to the open web

victorbjorklund 1y ago
I self-host lots of stuff. But yes it is more pain to host a WAF that can handle billions of request per minute. Even harder to do it for free like Cloudflare. And in the end the end result for the user is exactly the same if you use a self-hosted WAF or let someone else host it for you.
- lucb1e 1y ago
  If you're handling billions of requests per second, you're not a self hoster. That's a commercial service with a dedicated team to handle traffic around the clock. Most ISPs probably don't even operate lines that big To put that in perspective, even if they're sending empty TCP packets, "several billion" pps is 200 to 1800 gigabits of traffic, depending on what you mean by that. Add a cookieless HTTP payload and you're at many terabits per second. The average self hoster is more likely to get struck by lightning than encounter and need protection from this (even without considering the, probably modest, consequences of being offline a few hours if it does happen) Edit: off by a factor of 60, whoops. Thanks to u/Gud for pointing that out. I stand by the conclusion though: less likely to occur than getting struck by lightning (or maybe it's around equally likely now? But somewhere in that ballpark) and the consequences of being down for a few hours are generally not catastrophic anyway. You can always still put big brother in front if this event does happen to you and your ISP can't quickly drop the abusive traffic
  - Gud 1y ago
    To be fair, he did say per minute :-)
    - lucb1e 1y ago
      Oh, whoops. Divide everything by 60, quick! That does make it a bit less ludicrous even if I think the conclusion of my response still applies
  - PaulHoule 1y ago
    If somebody decides they hate you, your site that could handle, say, 100,000 legitimate requests per day could suddenly get billions of illegitimate requests.
    - Gud 1y ago
      Not everybody wants to manage some commercial grade packet filter that can handle some DDoSing script kiddie, it’s a strong argument. But another argument against using the easiest choice, the near monopoly, is that we need a diverse, thriving ecosystem. We don’t want to end up in a situation where suddenly Cloudflare gets to dictate what is allowed on the web. We have already lost email to the tech giants, try running your own mail sometime. The technical aspect is easy, the problem is you will end up in so many spam folders it’s disgusting. What we need are better decentralized protocols.
      - immibis 1y ago
        Please do try running your own mail some time. It's not nearly as hard as doomers would have you think. And if you only receive, you don't have any problems at all. At first, you can use it for less serious stuff until you see how much it works.
        Gud 1y ago
        I do, I host my own mail server. Technically it's not very challenging. The problem is the total dominance of a few actors and a lot of spammers.
        lucb1e 1y ago
        I haven't had spam issues since using a catch-all and giving everyone a unique address, blocking ones that receive spam Won't work if you need a fixed address on a business card or something, but in case you don't... Waiting for the day they catch on. Then it's time for a challenge-response protocol I guess
    - lucb1e 1y ago
- immibis 1y ago
  But you don't get billions of requests per minute. You get maybe five requests per second (300 per minute) on a bad day. The sites that seem to be getting badly attacked, they get 200 per second, which is still within reach of a self hosted firewall. Think about how many CPU cycles per packet that allows for. Hardly a real DDoS. The only reason you even want to firewall 200 requests per second is that the code downstream of the firewall takes more than 5ms to service a request, so you could also consider improving that. And if you're only getting <5 and your server isn't overloaded then why block anything at all?
  - Symbiote 1y ago
    Such entitlement. How much additional tax money should I spend at work so the AI scum can make 200 searches per second? Human and 'nice' bots make about 5 per second.
deleted 1y ago
[deleted]

by Gud 1y ago

victorbjorklund 1y ago

I self-host lots of stuff. But yes it is more pain to host a WAF that can handle billions of request per minute. Even harder to do it for free like Cloudflare. And in the end the end result for the user is exactly the same if you use a self-hosted WAF or let someone else host it for you.

lucb1e 1y ago
If you're handling billions of requests per second, you're not a self hoster. That's a commercial service with a dedicated team to handle traffic around the clock. Most ISPs probably don't even operate lines that big To put that in perspective, even if they're sending empty TCP packets, "several billion" pps is 200 to 1800 gigabits of traffic, depending on what you mean by that. Add a cookieless HTTP payload and you're at many terabits per second. The average self hoster is more likely to get struck by lightning than encounter and need protection from this (even without considering the, probably modest, consequences of being offline a few hours if it does happen) Edit: off by a factor of 60, whoops. Thanks to u/Gud for pointing that out. I stand by the conclusion though: less likely to occur than getting struck by lightning (or maybe it's around equally likely now? But somewhere in that ballpark) and the consequences of being down for a few hours are generally not catastrophic anyway. You can always still put big brother in front if this event does happen to you and your ISP can't quickly drop the abusive traffic
- Gud 1y ago
  To be fair, he did say per minute :-)
  - lucb1e 1y ago
    Oh, whoops. Divide everything by 60, quick! That does make it a bit less ludicrous even if I think the conclusion of my response still applies
- PaulHoule 1y ago
  If somebody decides they hate you, your site that could handle, say, 100,000 legitimate requests per day could suddenly get billions of illegitimate requests.
  - Gud 1y ago
    Not everybody wants to manage some commercial grade packet filter that can handle some DDoSing script kiddie, it’s a strong argument. But another argument against using the easiest choice, the near monopoly, is that we need a diverse, thriving ecosystem. We don’t want to end up in a situation where suddenly Cloudflare gets to dictate what is allowed on the web. We have already lost email to the tech giants, try running your own mail sometime. The technical aspect is easy, the problem is you will end up in so many spam folders it’s disgusting. What we need are better decentralized protocols.
    - immibis 1y ago
      Please do try running your own mail some time. It's not nearly as hard as doomers would have you think. And if you only receive, you don't have any problems at all. At first, you can use it for less serious stuff until you see how much it works.
      - Gud 1y ago
        I do, I host my own mail server. Technically it's not very challenging. The problem is the total dominance of a few actors and a lot of spammers.
        lucb1e 1y ago
        I haven't had spam issues since using a catch-all and giving everyone a unique address, blocking ones that receive spam Won't work if you need a fixed address on a business card or something, but in case you don't... Waiting for the day they catch on. Then it's time for a challenge-response protocol I guess
  - lucb1e 1y ago
immibis 1y ago
But you don't get billions of requests per minute. You get maybe five requests per second (300 per minute) on a bad day. The sites that seem to be getting badly attacked, they get 200 per second, which is still within reach of a self hosted firewall. Think about how many CPU cycles per packet that allows for. Hardly a real DDoS. The only reason you even want to firewall 200 requests per second is that the code downstream of the firewall takes more than 5ms to service a request, so you could also consider improving that. And if you're only getting <5 and your server isn't overloaded then why block anything at all?
- Symbiote 1y ago
  Such entitlement. How much additional tax money should I spend at work so the AI scum can make 200 searches per second? Human and 'nice' bots make about 5 per second.

deleted 1y ago

[deleted]