4 ms·
As in so many of these stories, what gets glossed over is just how much complexity there is in setting up your own server securely. You set up your server. Har
by poszlem 11mo ago
As in so many of these stories, what gets glossed over is just how much complexity there is in setting up your own server securely.
You set up your server. Harden it. Follow all the best practices for your firewall with ufw. Then you run a Docker container. Accidentally, or simply because you don’t know any better, you bind it to 0.0.0.0 by doing 5432:5432. Oops. Docker just walked right past your firewall rules, ignored ufw, and now port 5432 is exposed with default Postgres credentials. Congratulations. Say hello to Kinsing.
And this is just one of many possible scenarios like that. I’m not trying to spread FUD, but this really needs to be stressed much more clearly.
EDIT. as always - thank you HN for downvoting instead of actually addressing the argument.
- mkesper 11mo agoI don't see the point of using ufw at all as Hetzner provides an external firewall.
- poszlem 11mo agoIf you use a dedicated hetzner machine you only get a stateless firewall. That would be one reason.
- tracker1 11mo agoUFW doesn't add much overhead given the implementation in Linux is already in place, it's mostly just a convenient front-end. That said, you also need to be concerned with internal/peer threats as well as external ones... Clearly defining your boundaries is important for both internal and external vectors of attack.
- isaacvando 11mo agoThere are also an enormous number of ways to build insecure apps on AWS. I think the difficulty of setting up your own server is massively overblown. And that should be unsurprising given that there are so many companies that benefit from developers thinking it's too hard.