3 ms·

This is the approach I would take too, but I'm not sure I would recommend it. The downside to Linode, Digital Ocean, et al is that you'll have to spend more of

This is the approach I would take too, but I'm not sure I would recommend it. The downside to Linode, Digital Ocean, et al is that you'll have to spend more of your time doing sysadmin work. If you're not already an experienced sysadmin, figuring out how to get the pieces playing nice with eachother can easily take up more than $300/month of your time. And, once you're done with the setup, you're still not done: you have to stay on top of log files, watch for abuse, keep software up-to-date. And and, if you've never done this before, you won't know what you don't know. (Pop quiz: you've never done sysadmin work before, what's the correct way to configure sshd? Bonus points: if you use MySQL, what's the first command you should run right after package installation, that nobody runs?) I like sysadmin work, I consider it to be an important part of my software stack. But I'd be reluctant to tell anybody else that they should spend their time on it, too.

tempestn 12y ago
You can get around some of these issues if you use a control panel like cpanel. (Although as you get further from the old-school LAMP stack the complexity starts to return.) Regardless, in the early stages, when you're just trying to determine whether there's a market for your product, there's a fairly low bar for system administration. As long as it works, it's probably good enough. Even security (beyond the most blatant things) can probably wait until you've got some revenue, since it's very unlikely you'll be subjected to a targeted attack before anyone has even heard of you.
- thaumaturgy 12y ago
  cpanel has a loooooong history of security issues. It's probably the single most vulnerable part of any hosting company's infrastructure. ISPConfig is probably better, but it too has had some issues (http://www.exploit-db.com/exploits/29322/ http://www.exploit-db.com/exploits/29322/). There's a fairly low bar for system administration for "just getting it to work", but a really long upward curve from there to "properly managed". For example, backups (which typically require some special handling for Postgres and MySQL). Also, if you store any user data at all, you're kind of obligated to make sure it's safe. You kinda want to have automated DB backups and data safety even if you're using Heroku, but doing your own sysadmin might add to the effort required to get it all working right. You're right for the most part that you're not likely to see much in the way of targeted attacks, but be careful not to discount the number of automated attack systems that are out there now. Within a minute or two of bringing a server online, I begin to see hits for spam, ssh, and root password attempts from around the world. It's sort of amazing really. None of these are likely to go very far on a default install, but if for example you decide to set up an MTA so that your application can send you (or your users) email notifications, it's easy to goof up a sendmail config and end up with an accidental open relay. Maybe another way to put this is, Heroku charges that much because they provide that much value to people who don't want to deal with this stuff. I prefer to deal with this stuff myself, but a lot of other people don't, and I can't say they're wrong.
- opendais 12y ago
  Do not use cPanel. Its security is disastrous.
meowface 12y ago
I don't know, I really don't agree. I've never had a sysadmin job but I never found any problems with any of these things. All it takes is basic *nix knowledge. I do work in infosec though, so as for your pop quiz: 1. Disable root login and enable public key auth only (PasswordAuthentication no, PermitRootLogin no). 2. Run mysql_secure_installation All of these things are easy to learn with a little Googling. "How do I secure X?" "How do I install/configure X?" Way, way easier to learn than learning how to program or start a business, at least. It is not worth $300 or more per month just to outsource some sys admin tasks. Not to mention I doubt Heroku is paying very close attention to your log files for you; it's probably easier for you to do that yourself on your own VPS (where you'll also have access to more logs in the first place). If you have a vulnerability in your application then no hosting/platform provider is going to notice it and fix it for you 9 times out of 10.

tempestn 12y ago

You can get around some of these issues if you use a control panel like cpanel. (Although as you get further from the old-school LAMP stack the complexity starts to return.) Regardless, in the early stages, when you're just trying to determine whether there's a market for your product, there's a fairly low bar for system administration. As long as it works, it's probably good enough. Even security (beyond the most blatant things) can probably wait until you've got some revenue, since it's very unlikely you'll be subjected to a targeted attack before anyone has even heard of you.

thaumaturgy 12y ago
cpanel has a loooooong history of security issues. It's probably the single most vulnerable part of any hosting company's infrastructure. ISPConfig is probably better, but it too has had some issues (http://www.exploit-db.com/exploits/29322/ http://www.exploit-db.com/exploits/29322/). There's a fairly low bar for system administration for "just getting it to work", but a really long upward curve from there to "properly managed". For example, backups (which typically require some special handling for Postgres and MySQL). Also, if you store any user data at all, you're kind of obligated to make sure it's safe. You kinda want to have automated DB backups and data safety even if you're using Heroku, but doing your own sysadmin might add to the effort required to get it all working right. You're right for the most part that you're not likely to see much in the way of targeted attacks, but be careful not to discount the number of automated attack systems that are out there now. Within a minute or two of bringing a server online, I begin to see hits for spam, ssh, and root password attempts from around the world. It's sort of amazing really. None of these are likely to go very far on a default install, but if for example you decide to set up an MTA so that your application can send you (or your users) email notifications, it's easy to goof up a sendmail config and end up with an accidental open relay. Maybe another way to put this is, Heroku charges that much because they provide that much value to people who don't want to deal with this stuff. I prefer to deal with this stuff myself, but a lot of other people don't, and I can't say they're wrong.
opendais 12y ago
Do not use cPanel. Its security is disastrous.

meowface 12y ago

I don't know, I really don't agree. I've never had a sysadmin job but I never found any problems with any of these things. All it takes is basic *nix knowledge. I do work in infosec though, so as for your pop quiz: 1. Disable root login and enable public key auth only (PasswordAuthentication no, PermitRootLogin no). 2. Run mysql_secure_installation All of these things are easy to learn with a little Googling. "How do I secure X?" "How do I install/configure X?" Way, way easier to learn than learning how to program or start a business, at least. It is not worth $300 or more per month just to outsource some sys admin tasks. Not to mention I doubt Heroku is paying very close attention to your log files for you; it's probably easier for you to do that yourself on your own VPS (where you'll also have access to more logs in the first place). If you have a vulnerability in your application then no hosting/platform provider is going to notice it and fix it for you 9 times out of 10.