3 ms·

You can get around some of these issues if you use a control panel like cpanel. (Although as you get further from the old-school LAMP stack the complexity star

You can get around some of these issues if you use a control panel like cpanel. (Although as you get further from the old-school LAMP stack the complexity starts to return.) Regardless, in the early stages, when you're just trying to determine whether there's a market for your product, there's a fairly low bar for system administration. As long as it works, it's probably good enough. Even security (beyond the most blatant things) can probably wait until you've got some revenue, since it's very unlikely you'll be subjected to a targeted attack before anyone has even heard of you.

thaumaturgy 12y ago
cpanel has a loooooong history of security issues. It's probably the single most vulnerable part of any hosting company's infrastructure. ISPConfig is probably better, but it too has had some issues (http://www.exploit-db.com/exploits/29322/ http://www.exploit-db.com/exploits/29322/). There's a fairly low bar for system administration for "just getting it to work", but a really long upward curve from there to "properly managed". For example, backups (which typically require some special handling for Postgres and MySQL). Also, if you store any user data at all, you're kind of obligated to make sure it's safe. You kinda want to have automated DB backups and data safety even if you're using Heroku, but doing your own sysadmin might add to the effort required to get it all working right. You're right for the most part that you're not likely to see much in the way of targeted attacks, but be careful not to discount the number of automated attack systems that are out there now. Within a minute or two of bringing a server online, I begin to see hits for spam, ssh, and root password attempts from around the world. It's sort of amazing really. None of these are likely to go very far on a default install, but if for example you decide to set up an MTA so that your application can send you (or your users) email notifications, it's easy to goof up a sendmail config and end up with an accidental open relay. Maybe another way to put this is, Heroku charges that much because they provide that much value to people who don't want to deal with this stuff. I prefer to deal with this stuff myself, but a lot of other people don't, and I can't say they're wrong.
opendais 12y ago
Do not use cPanel. Its security is disastrous.

thaumaturgy 12y ago

cpanel has a loooooong history of security issues. It's probably the single most vulnerable part of any hosting company's infrastructure. ISPConfig is probably better, but it too has had some issues (http://www.exploit-db.com/exploits/29322/ http://www.exploit-db.com/exploits/29322/). There's a fairly low bar for system administration for "just getting it to work", but a really long upward curve from there to "properly managed". For example, backups (which typically require some special handling for Postgres and MySQL). Also, if you store any user data at all, you're kind of obligated to make sure it's safe. You kinda want to have automated DB backups and data safety even if you're using Heroku, but doing your own sysadmin might add to the effort required to get it all working right. You're right for the most part that you're not likely to see much in the way of targeted attacks, but be careful not to discount the number of automated attack systems that are out there now. Within a minute or two of bringing a server online, I begin to see hits for spam, ssh, and root password attempts from around the world. It's sort of amazing really. None of these are likely to go very far on a default install, but if for example you decide to set up an MTA so that your application can send you (or your users) email notifications, it's easy to goof up a sendmail config and end up with an accidental open relay. Maybe another way to put this is, Heroku charges that much because they provide that much value to people who don't want to deal with this stuff. I prefer to deal with this stuff myself, but a lot of other people don't, and I can't say they're wrong.

opendais 12y ago

Do not use cPanel. Its security is disastrous.