5 ms·

The OP also asked about a difference between distros (DIY) and "something else" - and I do think that there is a large difference in the security + maintenance

The OP also asked about a difference between distros (DIY) and "something else" - and I do think that there is a large difference in the security + maintenance surface area that you have to contend with on a Platform As A Service like Heroku versus your own box. What's more I think you hit on exactly the reasons why: I'm much more likely to screw something up by misconfiguration or lack of attention than a team of security and maintenance people at a company whose sole job is to make sure that I don't get burnt by these things. OP is trying to get a SAAS off the ground and not (presumably) doing something with handling distro security and server maintenance - for the minimal cost difference in getting started it's hard to see how the time+effort difference in being your own sysadmin is worth it.

patio11 12y ago
FWIW: this is imminently sensible advice, too.
logn 12y ago
Heroku can be expensive. You're looking at $240/yr just for SSL (vs. $0 - $30/yr for non-wildcard SSL). For a 1GB VPS, a dyno costs ~3x as much as Digital Ocean. For protection from cyber crime, you might be better off paying an insurance company than Heroku prices.
- michaelbuckbee 12y ago
  Heroku is expensive from a hosting perspective but cheap from a sysadmin cost perspective. And it's this total cost of running a service (or at the very least the opportunity cost of not working on things essential to your business and the risk of your site getting screwed by somebody malicious) that I'm trying to convey. For a business, $240/year to get a SSL terminating load balancer maintained by a dedicated security sysadmin team to sit in front of their app looks like a heckuva deal. There is just so much work that is involved in keeping a system properly up and secure that unless you're valuing your time at near zero dollars an hour, or you have so much traffic and cash coming in that you can get a dedicated person to handle it Heroku makes monetary sense.
  - logn 12y ago
    I guess for me, part of the value of my service is the infrastructure. And I sell based on server instance, so any added cost gets passed to the customer (or deducted from my earnings). For someone competent with sysadmin work, I think it's maybe worth the time. It's not like for any hour not spent on my systems I'd otherwise be earning $200 automatically. My message would just be for people to not be intimidated by the concept of something being so much work that it's not worth your time. I saw that argument for years with email as apparently conventional wisdom. I've been hosting my own email for years now with about 3 hours of upfront work and (almost) none thereafter.
    - mechanical_fish 12y ago
      Hosting your own email works great until you try to actually send any. [1] But if you send enough, you eventually have to deal with the spam infrastructure. Customers will complain that critical transactional emails ended up in user spam folders. One person too many will accidentally mark one of your mails as spam. Or you'll relaunch some cloud infrastructure and suddenly your IP is one that is on all the blacklists because of some earlier history that you could never have known. Or one of your customers will innocently assume that you are Mailchimp and send a whole bunch of marketing email through your server. The symptom of any such problem is that email starts falling into the garbage, perhaps silently. But if you are watching your stats like a hawk (a costly and very boring hobby ) - or, much more likely, if your customers start screaming about the very-real high costs of lost email - you will figure that out within a few days, so it might not take more than another day to figure out how to get yourself off the blacklist (a manual process) and how to apologize to customers for the lost email (a manual process). But, if you value your time at in any way, your first encounter with that problem will be your last, because email services are cheap and easy. I have yet to pay for mine; in small quantities Mailchimp, Mailgun et al are free. Indeed, given that low cost, why wait to get burned before you stop playing with fire, even if the fire looks cute and innocent and warm right now? [1] Actually, I'm lying: A much more serious problem which occurs at any volume is that email is another piece of the security perimeter. Even if mail servers had almost no configuration and a history of bug-free operation - which they do not, I am joking, and the joke is not very funny - one of the basic rules of security is to put as much distance as possible between your data and services which connect to outside machines. Mailgun is free in small quantities and runs outside your entire datacenter. The math kind of does itself.

patio11 12y ago

FWIW: this is imminently sensible advice, too.

logn 12y ago

Heroku can be expensive. You're looking at $240/yr just for SSL (vs. $0 - $30/yr for non-wildcard SSL). For a 1GB VPS, a dyno costs ~3x as much as Digital Ocean. For protection from cyber crime, you might be better off paying an insurance company than Heroku prices.

michaelbuckbee 12y ago
Heroku is expensive from a hosting perspective but cheap from a sysadmin cost perspective. And it's this total cost of running a service (or at the very least the opportunity cost of not working on things essential to your business and the risk of your site getting screwed by somebody malicious) that I'm trying to convey. For a business, $240/year to get a SSL terminating load balancer maintained by a dedicated security sysadmin team to sit in front of their app looks like a heckuva deal. There is just so much work that is involved in keeping a system properly up and secure that unless you're valuing your time at near zero dollars an hour, or you have so much traffic and cash coming in that you can get a dedicated person to handle it Heroku makes monetary sense.
- logn 12y ago
  I guess for me, part of the value of my service is the infrastructure. And I sell based on server instance, so any added cost gets passed to the customer (or deducted from my earnings). For someone competent with sysadmin work, I think it's maybe worth the time. It's not like for any hour not spent on my systems I'd otherwise be earning $200 automatically. My message would just be for people to not be intimidated by the concept of something being so much work that it's not worth your time. I saw that argument for years with email as apparently conventional wisdom. I've been hosting my own email for years now with about 3 hours of upfront work and (almost) none thereafter.
  - mechanical_fish 12y ago
    Hosting your own email works great until you try to actually send any. [1] But if you send enough, you eventually have to deal with the spam infrastructure. Customers will complain that critical transactional emails ended up in user spam folders. One person too many will accidentally mark one of your mails as spam. Or you'll relaunch some cloud infrastructure and suddenly your IP is one that is on all the blacklists because of some earlier history that you could never have known. Or one of your customers will innocently assume that you are Mailchimp and send a whole bunch of marketing email through your server. The symptom of any such problem is that email starts falling into the garbage, perhaps silently. But if you are watching your stats like a hawk (a costly and very boring hobby ) - or, much more likely, if your customers start screaming about the very-real high costs of lost email - you will figure that out within a few days, so it might not take more than another day to figure out how to get yourself off the blacklist (a manual process) and how to apologize to customers for the lost email (a manual process). But, if you value your time at in any way, your first encounter with that problem will be your last, because email services are cheap and easy. I have yet to pay for mine; in small quantities Mailchimp, Mailgun et al are free. Indeed, given that low cost, why wait to get burned before you stop playing with fire, even if the fire looks cute and innocent and warm right now? [1] Actually, I'm lying: A much more serious problem which occurs at any volume is that email is another piece of the security perimeter. Even if mail servers had almost no configuration and a history of bug-free operation - which they do not, I am joking, and the joke is not very funny - one of the basic rules of security is to put as much distance as possible between your data and services which connect to outside machines. Mailgun is free in small quantities and runs outside your entire datacenter. The math kind of does itself.