5 ms·

Not much. Use an LTS version of a distribution which you understand well. You're more likely to have appsec problems caused by yourself rather than being comp

by patio11 12y ago

Not much. Use an LTS version of a distribution which you understand well. You're more likely to have appsec problems caused by yourself rather than being compromised by problems in the OS. Make sure you're able to do firedrills like e.g. upgrading the version of Nginx or OpenSSL which you use in response to a vulnerability in them getting discovered. We've been doing a lot of that these last two years, and it probably won't get any less common.

WestCoastJustin 12y ago
Going to echo patio11's comment. But add a little too. Do not run Wordpress / Wordpress Plugins, or Drupal, on the same system you are doing anything with user data. These continually have security issues and you will almost certainly be owned [1, 2]. Out source blog hosting to one of the many hosting providers that maintains the software install for you. The chances of actually getting owned running stock Apache, or Nginx, are extremely low. You really need to watch what third party apps you install, like Wordpress, Drupal, or an unsecured phpMyAdmin. ps. Make sure you have source code and database backups happening on a regular basis. If the server dies tonight, are you able to restore it to a point in time? What about getting the application stack installed quickly? Think about these things. [1] https://wordpress.org/news/category/security/ https://wordpress.org/news/category/security/ [2] https://www.drupal.org/security https://www.drupal.org/security
- cat9 12y ago
  For any X, getting rooted is still often a matter of someone with 1000 botnet nodes to burn running a for loop against an IP range. At which point, your odds of getting rooted are the product of how desirable that target is to write for loops against and how long it has been since you last applied security updates. The reason WordPress tends to be root city is that there are a great many installs out there, of which many have never had step one done to harden it, and were last given security updates ~ when they were installed. I would still outsource WordPress, but that's mostly in the vein of "the cost of outsourcing is less than the cost of me having to think about it one hour a month, while 1 hr/mo is a reasonable floor for the time cost function, but the actual value will probably exceed that at least once in a given year." A WPEngine subscription costs $30 to "I don't care, why are you wasting my time with numbers this small." Developer time costs between $75/hr and "everything is on fire and you can only put out one fire at a time." Ergo it makes economic sense to configure nginx / DNS once, then outsource further complications to paid external support.
  - meowface 12y ago
    >For any X, getting rooted is still often a matter of someone with 1000 botnet nodes to burn running a for loop against an IP range. At which point, your odds of getting rooted are the product of how desirable that target is to write for loops against and how long it has been since you last applied security updates. If you're looking at all Internet-facing servers in aggregate, yes, but if you know what you're doing then the odds of getting owned by a random botnet are very slim. Assuming you have a good security posture, your risks are dedicated and intelligent attackers and 0-days, not botnets scanning for low hanging fruit.
    - JoachimSchipper 12y ago
      Careful, there - it's easy to forget to patch one site out of some hundred-odd. Big organizations are hard. (But yes, a single competent admin who doesn't take holidays will usually have pretty decent security.)
      - meowface 12y ago
        Oh yes, once you have more than a few employees you become much more at risk of that. I was assuming a scenario of one sys admin managing a small set of servers.
- collyw 12y ago
  I know that Wordpress has a bit of a bad reputation, but this is the first have heard that Drupal has similar problems. Is there anywhere you can check how good or bad a particular CMS or framework is regarding security?
  - spoiler 12y ago
    I work for a hosting company, and we get to see quite a few hacked CMSs. The most hacked—of the popular CMSs—would be Joomla, closely followed by WordPress, and then Drupal. However the margin between Drupal and WordPress is quite big. I can never fathom why Joomla is so popular. It's horrendous to work with. Also, the attention given to security by the majority of the plugin development community, and even Joomla's core dev team is minuscule.
  - cpach 12y ago
    I’m afraid I have no good links for you. And if you really want to to know, you should probably have a security research firm do a survey for you. But that is probably not within the budget of a startup.
  - mechanical_fish 12y ago
    I work for a very large Drupal hosting company. We host important web sites on Drupal for corporations big and small. Web service software is not secure unless you patch it rapidly. There is no silver bullet. Last year there was a big security hole in Drupal, which we patched. Much like the ones that routinely turn up in Wordpress, which they patched. Much like the ones that happened, what, three or four times to Rails in the last few years? Which are like the ones they found in OpenSSL, which are like the ones they found in bash - bash, which is not supposed to be a web service! But which is nonetheless connected to the web in lo these many ways. You have to watch for patches and apply the patches. Ubuntu gets six of them every week. There are tools that apply them automatically, or with one line of typing (which rapidly ends up in the autocomplete buffer, let me tell you), and server reboots are only needed once a week or so, but you have to do it. You have to spot the patches and you have to apply them. It is like brushing your teeth, with the occasional excitement of an urgent tooth-brushing emergency. It's mostly boring. You must also have a plan to recover if a patch doesn't get applied in time, because these patches can be hard to write and can take several tries, and because you won't always be perfectly fast at getting your chores done. So you need to keep your family jewels away from the Apache server process, preferably in an alternate universe. If you are a company, this stuff graduates from boring to "hard", because how do you know that the employee who swore to do the upgrades every week didn't forget for six critical days? But mostly it is just about patience and routine. Routine turns out to be surprisingly hard.
michaelbuckbee 12y ago
The OP also asked about a difference between distros (DIY) and "something else" - and I do think that there is a large difference in the security + maintenance surface area that you have to contend with on a Platform As A Service like Heroku versus your own box. What's more I think you hit on exactly the reasons why: I'm much more likely to screw something up by misconfiguration or lack of attention than a team of security and maintenance people at a company whose sole job is to make sure that I don't get burnt by these things. OP is trying to get a SAAS off the ground and not (presumably) doing something with handling distro security and server maintenance - for the minimal cost difference in getting started it's hard to see how the time+effort difference in being your own sysadmin is worth it.
- patio11 12y ago
  FWIW: this is imminently sensible advice, too.
- logn 12y ago
  Heroku can be expensive. You're looking at $240/yr just for SSL (vs. $0 - $30/yr for non-wildcard SSL). For a 1GB VPS, a dyno costs ~3x as much as Digital Ocean. For protection from cyber crime, you might be better off paying an insurance company than Heroku prices.
  - michaelbuckbee 12y ago
    Heroku is expensive from a hosting perspective but cheap from a sysadmin cost perspective. And it's this total cost of running a service (or at the very least the opportunity cost of not working on things essential to your business and the risk of your site getting screwed by somebody malicious) that I'm trying to convey. For a business, $240/year to get a SSL terminating load balancer maintained by a dedicated security sysadmin team to sit in front of their app looks like a heckuva deal. There is just so much work that is involved in keeping a system properly up and secure that unless you're valuing your time at near zero dollars an hour, or you have so much traffic and cash coming in that you can get a dedicated person to handle it Heroku makes monetary sense.
stock_toaster 12y ago
In addition to what patio11 said with regard to firedrills for updates, make sure you use some type of repeatable automation. chef, salt, puppet, ansible -- just pick one and use it... _religiously_

by patio11 12y ago

WestCoastJustin 12y ago

Going to echo patio11's comment. But add a little too. Do not run Wordpress / Wordpress Plugins, or Drupal, on the same system you are doing anything with user data. These continually have security issues and you will almost certainly be owned [1, 2]. Out source blog hosting to one of the many hosting providers that maintains the software install for you. The chances of actually getting owned running stock Apache, or Nginx, are extremely low. You really need to watch what third party apps you install, like Wordpress, Drupal, or an unsecured phpMyAdmin. ps. Make sure you have source code and database backups happening on a regular basis. If the server dies tonight, are you able to restore it to a point in time? What about getting the application stack installed quickly? Think about these things. [1] https://wordpress.org/news/category/security/ https://wordpress.org/news/category/security/ [2] https://www.drupal.org/security https://www.drupal.org/security

cat9 12y ago
For any X, getting rooted is still often a matter of someone with 1000 botnet nodes to burn running a for loop against an IP range. At which point, your odds of getting rooted are the product of how desirable that target is to write for loops against and how long it has been since you last applied security updates. The reason WordPress tends to be root city is that there are a great many installs out there, of which many have never had step one done to harden it, and were last given security updates ~ when they were installed. I would still outsource WordPress, but that's mostly in the vein of "the cost of outsourcing is less than the cost of me having to think about it one hour a month, while 1 hr/mo is a reasonable floor for the time cost function, but the actual value will probably exceed that at least once in a given year." A WPEngine subscription costs $30 to "I don't care, why are you wasting my time with numbers this small." Developer time costs between $75/hr and "everything is on fire and you can only put out one fire at a time." Ergo it makes economic sense to configure nginx / DNS once, then outsource further complications to paid external support.
- meowface 12y ago
  >For any X, getting rooted is still often a matter of someone with 1000 botnet nodes to burn running a for loop against an IP range. At which point, your odds of getting rooted are the product of how desirable that target is to write for loops against and how long it has been since you last applied security updates. If you're looking at all Internet-facing servers in aggregate, yes, but if you know what you're doing then the odds of getting owned by a random botnet are very slim. Assuming you have a good security posture, your risks are dedicated and intelligent attackers and 0-days, not botnets scanning for low hanging fruit.
  - JoachimSchipper 12y ago
    Careful, there - it's easy to forget to patch one site out of some hundred-odd. Big organizations are hard. (But yes, a single competent admin who doesn't take holidays will usually have pretty decent security.)
    - meowface 12y ago
      Oh yes, once you have more than a few employees you become much more at risk of that. I was assuming a scenario of one sys admin managing a small set of servers.
collyw 12y ago
I know that Wordpress has a bit of a bad reputation, but this is the first have heard that Drupal has similar problems. Is there anywhere you can check how good or bad a particular CMS or framework is regarding security?
- spoiler 12y ago
  I work for a hosting company, and we get to see quite a few hacked CMSs. The most hacked—of the popular CMSs—would be Joomla, closely followed by WordPress, and then Drupal. However the margin between Drupal and WordPress is quite big. I can never fathom why Joomla is so popular. It's horrendous to work with. Also, the attention given to security by the majority of the plugin development community, and even Joomla's core dev team is minuscule.
- cpach 12y ago
  I’m afraid I have no good links for you. And if you really want to to know, you should probably have a security research firm do a survey for you. But that is probably not within the budget of a startup.
- mechanical_fish 12y ago
  I work for a very large Drupal hosting company. We host important web sites on Drupal for corporations big and small. Web service software is not secure unless you patch it rapidly. There is no silver bullet. Last year there was a big security hole in Drupal, which we patched. Much like the ones that routinely turn up in Wordpress, which they patched. Much like the ones that happened, what, three or four times to Rails in the last few years? Which are like the ones they found in OpenSSL, which are like the ones they found in bash - bash, which is not supposed to be a web service! But which is nonetheless connected to the web in lo these many ways. You have to watch for patches and apply the patches. Ubuntu gets six of them every week. There are tools that apply them automatically, or with one line of typing (which rapidly ends up in the autocomplete buffer, let me tell you), and server reboots are only needed once a week or so, but you have to do it. You have to spot the patches and you have to apply them. It is like brushing your teeth, with the occasional excitement of an urgent tooth-brushing emergency. It's mostly boring. You must also have a plan to recover if a patch doesn't get applied in time, because these patches can be hard to write and can take several tries, and because you won't always be perfectly fast at getting your chores done. So you need to keep your family jewels away from the Apache server process, preferably in an alternate universe. If you are a company, this stuff graduates from boring to "hard", because how do you know that the employee who swore to do the upgrades every week didn't forget for six critical days? But mostly it is just about patience and routine. Routine turns out to be surprisingly hard.

michaelbuckbee 12y ago

The OP also asked about a difference between distros (DIY) and "something else" - and I do think that there is a large difference in the security + maintenance surface area that you have to contend with on a Platform As A Service like Heroku versus your own box. What's more I think you hit on exactly the reasons why: I'm much more likely to screw something up by misconfiguration or lack of attention than a team of security and maintenance people at a company whose sole job is to make sure that I don't get burnt by these things. OP is trying to get a SAAS off the ground and not (presumably) doing something with handling distro security and server maintenance - for the minimal cost difference in getting started it's hard to see how the time+effort difference in being your own sysadmin is worth it.

patio11 12y ago
FWIW: this is imminently sensible advice, too.
logn 12y ago
Heroku can be expensive. You're looking at $240/yr just for SSL (vs. $0 - $30/yr for non-wildcard SSL). For a 1GB VPS, a dyno costs ~3x as much as Digital Ocean. For protection from cyber crime, you might be better off paying an insurance company than Heroku prices.
- michaelbuckbee 12y ago
  Heroku is expensive from a hosting perspective but cheap from a sysadmin cost perspective. And it's this total cost of running a service (or at the very least the opportunity cost of not working on things essential to your business and the risk of your site getting screwed by somebody malicious) that I'm trying to convey. For a business, $240/year to get a SSL terminating load balancer maintained by a dedicated security sysadmin team to sit in front of their app looks like a heckuva deal. There is just so much work that is involved in keeping a system properly up and secure that unless you're valuing your time at near zero dollars an hour, or you have so much traffic and cash coming in that you can get a dedicated person to handle it Heroku makes monetary sense.

stock_toaster 12y ago

In addition to what patio11 said with regard to firedrills for updates, make sure you use some type of repeatable automation. chef, salt, puppet, ansible -- just pick one and use it... _religiously_