3 ms·

Software engineering is a broad spectrum where we can move up and down its abstraction ladder. Using off-the-shelf tools and even third-party providers is fine.

Software engineering is a broad spectrum where we can move up and down its abstraction ladder. Using off-the-shelf tools and even third-party providers is fine. I don't have to do everything from scratch - after all, I didn't write my own text editor. I'm also happy to download prepacked and preconfigured software on my Linux distro instead of compiling and adding them to PATH manually. I could, I just choose not to and direct my interests elsewhere. Those interests can change over time too. One day someone with Tailscale can decide to explore Wireguard. Similarly, someone who runs their own mail server might decide to move to a hosted solution and do something else. That's perfectly fine. To me, this freedom of choice in software engineering is not disheartening. It's liberating and exciting.

johnisgood 9mo ago
That is a strawman though, and I am not sure why all replies assume extremes all the time. Nobody said do everything from scratch. The point is: basic networking (port forwarding, WireGuard) should not be beyond someone's capability as a software engineer. "I use apt instead of compiling" is a time tradeoff. "I can't configure a VPN" is a skill gap. These are not equivalent. If you choose convenience for whatever reasons, that is completely fine.
- mschild 9mo ago
  "I can't configure a VPN" and "I don't want to configure a VPN" are 2 entirely different things. Mind you I have no idea how complex tailscale setup is in comparison. I'm in the middle of setting up my own homeserver. Still deciding on what/if I want to expose to the internet and not just local network and while setting everything up and tinkering is part of the fun for me. I get some people just want results that they can rely on. Tailscale, while not a perfect option, is still an option and if they're fine with the risk profile I can understand sacrificing some security for it.
  - johnisgood 9mo ago
    It seems like we do agree. :) For a homeserver: - SSH with key-only auth, exposed directly. This has worked for decades. Consider non-standard port to reduce log noise (not security, just quieter logs), fail2ban if you want - Access internal services via SSH tunnels or just work on the box directly - If exposing HTTP(S): reverse proxy (nginx/caddy) with TLS, rate limiting - Databases, admin panels, monitoring - access via SSH, not public (ideally) You do not need a VPN layer if you are comfortable with SSH. It has been battle-tested longer than most alternatives. The fun part of tinkering is also learning what is actually necessary vs. cargo-culted advice. You will find most "security hardening" guides are overkill for a homeserver with sensible defaults.
- duckmysick 9mo ago
  I'd argue that no, managing your own VPN is not a basic skill - certainly not in the realms of software engineering (more like network engineering).
  - johnisgood 9mo ago
    WireGuard is ~10 lines of config and wg genkey. Calling that "network engineering" is a stretch. The siloing of basic infrastructure knowledge into "not my discipline" is part of the problem. Software gets deployed somewhere: understanding ports, keys, and routing at a basic level is not specialized knowledge. Honestly, if 10 lines of config is "network engineering", then the bar for software engineering has dropped considerably.
    - InfinityByTen 9mo ago
      I am probably in the camp where I've found myself ovewhelmed with the amount of information about networks and I'm an alleged software engineer (without formal training in CS albeit). The 10 loc is not a valid measure. `sudo rm -rf /` is a 1 line of code. It's not the lines that are hard to wrap your brain around, it's the implication of the lines that really what we are talking about.
      - johnisgood 9mo ago
        The rm -rf comparison is a bit dramatic. WireGuard's config is conceptually simple: your key, peer's key, endpoint, what IPs route through the tunnel. The "implications" are minimal. It is a point-to-point encrypted tunnel. Being overwhelmed by networking basics is worth addressing regardless. It comes up constantly: debugging connectivity, deployments, understanding why your app cannot reach a database. 30 minutes with the WireGuard docs would demystify it. The concepts are genuinely simple and worth 30 minutes to understand as it applies far beyond VPNs. I have become pragmatic too. I do not tinker for the sake of it anymore. But there is a difference between choosing convenience and lacking foundational knowledge. One is a time tradeoff, the other is a gap that will bite you eventually. And with LLMs, learning the basics is easier than ever. You can ask questions, get explanations, work through examples interactively. There is less excuse now to outsource or postpone foundational knowledge, not more[1]. At some point it is just wanting the benefits without the investment. That is not pragmatism, it is hoping the gaps never matter. They usually do. [1] You can ask an LLM to do all of that for you and make it help you understand under less than 10 minutes!

johnisgood 9mo ago

That is a strawman though, and I am not sure why all replies assume extremes all the time. Nobody said do everything from scratch. The point is: basic networking (port forwarding, WireGuard) should not be beyond someone's capability as a software engineer. "I use apt instead of compiling" is a time tradeoff. "I can't configure a VPN" is a skill gap. These are not equivalent. If you choose convenience for whatever reasons, that is completely fine.

mschild 9mo ago
"I can't configure a VPN" and "I don't want to configure a VPN" are 2 entirely different things. Mind you I have no idea how complex tailscale setup is in comparison. I'm in the middle of setting up my own homeserver. Still deciding on what/if I want to expose to the internet and not just local network and while setting everything up and tinkering is part of the fun for me. I get some people just want results that they can rely on. Tailscale, while not a perfect option, is still an option and if they're fine with the risk profile I can understand sacrificing some security for it.
- johnisgood 9mo ago
  It seems like we do agree. :) For a homeserver: - SSH with key-only auth, exposed directly. This has worked for decades. Consider non-standard port to reduce log noise (not security, just quieter logs), fail2ban if you want - Access internal services via SSH tunnels or just work on the box directly - If exposing HTTP(S): reverse proxy (nginx/caddy) with TLS, rate limiting - Databases, admin panels, monitoring - access via SSH, not public (ideally) You do not need a VPN layer if you are comfortable with SSH. It has been battle-tested longer than most alternatives. The fun part of tinkering is also learning what is actually necessary vs. cargo-culted advice. You will find most "security hardening" guides are overkill for a homeserver with sensible defaults.
duckmysick 9mo ago
I'd argue that no, managing your own VPN is not a basic skill - certainly not in the realms of software engineering (more like network engineering).
- johnisgood 9mo ago
  WireGuard is ~10 lines of config and wg genkey. Calling that "network engineering" is a stretch. The siloing of basic infrastructure knowledge into "not my discipline" is part of the problem. Software gets deployed somewhere: understanding ports, keys, and routing at a basic level is not specialized knowledge. Honestly, if 10 lines of config is "network engineering", then the bar for software engineering has dropped considerably.
  - InfinityByTen 9mo ago
    I am probably in the camp where I've found myself ovewhelmed with the amount of information about networks and I'm an alleged software engineer (without formal training in CS albeit). The 10 loc is not a valid measure. `sudo rm -rf /` is a 1 line of code. It's not the lines that are hard to wrap your brain around, it's the implication of the lines that really what we are talking about.
    - johnisgood 9mo ago
      The rm -rf comparison is a bit dramatic. WireGuard's config is conceptually simple: your key, peer's key, endpoint, what IPs route through the tunnel. The "implications" are minimal. It is a point-to-point encrypted tunnel. Being overwhelmed by networking basics is worth addressing regardless. It comes up constantly: debugging connectivity, deployments, understanding why your app cannot reach a database. 30 minutes with the WireGuard docs would demystify it. The concepts are genuinely simple and worth 30 minutes to understand as it applies far beyond VPNs. I have become pragmatic too. I do not tinker for the sake of it anymore. But there is a difference between choosing convenience and lacking foundational knowledge. One is a time tradeoff, the other is a gap that will bite you eventually. And with LLMs, learning the basics is easier than ever. You can ask questions, get explanations, work through examples interactively. There is less excuse now to outsource or postpone foundational knowledge, not more[1]. At some point it is just wanting the benefits without the investment. That is not pragmatism, it is hoping the gaps never matter. They usually do. [1] You can ask an LLM to do all of that for you and make it help you understand under less than 10 minutes!