Hacker News Reader

Comment by aborsy | Hacker News Reader

Self-hosting is time-consuming and potentially dangerous with respect to security.

You need to know what you are doing.

x—————-

Example: Dropbox is open to the world. You can share files with everyone. Can you properly secure a nextcloud instance?

VPN may not be applicable, because you have to share files with others. Even then, you need to have fair amount of knowledge about networking, protocols, security, current software, vulnerabilities, etc. Even with SSH, you need to be careful. And this is only the security part, I am not getting into a dozen of other concerns.

Overall, as software complexity grows, self-hosting will be increasingly harder.

Encrypting client-side and using a managed solution is a compelling option.

View on HN

> Self-hosting is time-consuming and potentially dangerous with respect to security.

When you see that large companies get hacked all the time with you sensitive info and password released in the wild, it makes you think twice about "security" when your data is not in your hands. I'd say both are dangerous anyway, and certainly trusting a third party with any kind of data is a big gamble (plus, they may be spying on you as well).

It depends on what the third party is. The chances that your google account gets hacked because of lax security practices on google's part, is probably orders of magnitude lower than your typical F500 company getting hacked because they forgot to patch their machines.

They just roll over all government requests for data, so that's a lot of APT that are neutralized.

This. I'm keenly aware of how time-consuming self-hosting is.

- A FreeBSD firewall (requires continuous patching)

- 6 DNS/NTP servers (don't ask!), most of which are in the cloud

- 2 VMware ESXi hosts

- 3 ethernet switches (an 8-port 10Gbe, 24-port 1GBe, 8-port 1GBe)

- 2 WiFi Access Points

- 12TB TrueNAS server

- 2 laptops, 1 desktop

- countless VLANs, countless VMs.

Effectively I run my own AWS. But it comes at a cost: countless evenings & weekends. Endless updates (OS, BIOS, firmware), periodic hardware failures.

Also, as pointed out, security. My unpatched DNS server was compromised, and the intruder managed to get root on my server (this was back in '99, before BIND was heavily re-vamped for security).

Self-hosting is a labor of love, but I'd be hard-pressed to recommend it to anyone who didn't enjoy it.

It is only time consuming if you let it be: I have been there too, hosting each service in a different OpenVZ jails (before containers were a thing) and doing hyper complex stuff...

Nowadays I simplify to the extreme (refrain to run something I do not need, always using the simplest solution) and it works pretty well for me:https://benou.fr/www/ben/14-years-of-self-hosting.html

One hack in '99 is not bad really. Looks like you're doing a great job.

Don't forget that the whole DIY thing is also incredibly educational. People tend to forget that when weighing the pros and cons.

It's not always directly teaching useful skills for work as most companies will just want you to know how to talk to AWS. But general computing and security knowledge is always useful IMO.

I like seeing people acknowledge the problems that come with self-hosting. I tried to self-host a few years back ended up lasting only a handful of months before going back to letting others host the services I use.

I didn't run into any specific issues, but instead I ended up realizing that I had to monitor the services myself to ensure that they were still functioning properly and that they had security patches applied. That's not a responsibility I want to deal with.

And as strange as it sounds, I also noticed that there actually were privacy advantages to not hosting stuff myself. Maintaining multiple identities when self-hosting is only possible with a domain per identity and not reusing the same machine for services across identities.

Wow, you really need to write a how-to book and sell it on leanpub. I would buy it!

The other side of this is that unless you're a very important individual nobody is going to blow zero days on your self-hosted server, and you're pretty unlikely to get focused by individual human (non-automated) attention/exploitation.

I've been self hosting for over a decade with no intrusion to my knowledge, although I'm sure some state-level actor has access. On the flip side I've had many of my login credentials stolen over the years due to a wide range of companies getting hacked- haveibeenpwned currently lists 11 breaches for just one of my emails. It's probable I'll get owned eventually, but I've got some catching up to do.

I mostly agree with your post, except using a zero day on a small (especially self-hosted) server is very rarely blowing it. In fact I would bet the majority of self-hosted or small-time servers wouldn't have the first clue about how to figure out how you got in, let alone parsing logs to figure out the exploit. Assuming they even log sufficiently, hiring a forensics expert is almost certainly out of the question financially.

I wanted to write exactly the same comment: it is a lot less likely to be targeted. The big company leaks happen often because A LOT of resources and human hours go into trying to find flaws in their security.

Not only that, but the reward is a lot smaller for the attacker and the overall damage is smaller for the community. If attackers get into Google Analytics/Tag Manager servers they will be able to find data and sensitive information about most of the websites in the world and be able to control them. If they get into your self-hosted analytics server they would only find out your stats which can't be used for much.

There is one thing to find the name and phone number of one person and another thing to find the name and phone number of millions of people.

You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn.

Hackers wont even know if your self-host server exists. I self-host Bitwarden and that's how I am able to sleep at nights.

[1] https://github.com/pritunl/pritunl

What if your self-hosted app must be accessible on the web? (eg. a blog or analytics platform)

Would all that traffic still have to go through the VPN tunnel?

No, only the traffic of the self-host server you whitelist on Pritunl using the self-host server IP goes through VPN. Rest of the internet traffic works as usual.

This is my issue with self-hosting. I am so damn paranoid.

I'm not a sysadmin or a security expert.

I don't keep vital or sensitive stuff on anything I'm hosting but it's still frighting.

> Overall, as software complexity grows, self-hosting will be increasingly harder.

Setting up self-hosting is not easy, except that it can be, as I see in the responses to this comment.

I am not sure I understand what "as software complexity grows" means. My observation is that "as software complexity grows" it eventually (and hopefully) fails, and we go back to simpler software, albeit using a few things we've learned along the way.

"As software complexity grows" is not a desirable trait. I hope that there is no need for such software, but I can't predict the future.

Most self hosted things don't need to be on the internet, the only things I have on the internet are a webserver, a game server or two, and an openvpn server.

The rest of my stuff is all local/vpn only.

This is my solution too. My server with private data is only accessible via my LAN. I'm home often enough that syncing isn't a problem. I kind of treat it like the old Palm desktop, where you had to sync regularly by USB. The nice thing is that the sync is automatic in this case. I know that kind of punctuated syncing wouldn't work for everyone, but it works for me.

My public server has a couple of ports open to the internet, but SSH, SFTP, etc., are only accessible on the LAN with access by key (no passwords). It does things like XMPP (hashed passwords, no locally-stored chat data), public websites, and the like.

Until we have self hosting as simple as app installation and without having to fiddle with security, it will be a niche thing.

Plenty of home/SMB NAS offer that. Plus there are projects like https://www.freedombox.org/.

On top of that, many hosting providers offer to set up popular open source projects for you.

https://sandstorm.io/ as well

Even if it's "as simple as an app installation", you still need to have a public IP address that isn't behind a NAT. How many residential ISPs offer that?

NAT isn't an issue, but CGNAT is a problem and becoming more common as IPv4 space gets more expensive.

It's not much more difficult. Many hosting companies provide installers like e.g. cPanel that allow you to set up a Nextcloud instance within a minute.

Look at the Uniform Server, a complete WAMP stack pre-hardened for placement on a public server. Just run the installer, it is that easy.

That's the statement I wholeheartedly disagree with.

It is INCOMPARABLY more secure in a broad sense just because you control your infrastructure.

Yes, you need to know what you are doing, but this is applicable to everything, does it not? Of course, mindlessly subscribing to bazillion of services is much simpler, but it's plainly not professional.

On a side note, do you think Dropbox is any more secure than any other service, including self hosted? Or any other service?

After years of seeing how those companies are made from inside I am personally quite free from those illusions.

This is one reason I think urbit is cool - it makes self hosting way easier.

I run mine in digital ocean, but if you want to run it off your home network it’s basically just figuring out the vpn bit to safely get on your home network and everything else is good to go. You can also use something like tail scale or zero tier to skip the vpn part (but I know less about those things).

Hopefully in time even this will get easier with UI that guides you through the process.

> Even then, you need to have fair amount of knowledge about networking, protocols, security, current software, vulnerabilities, etc.

...

> Encrypting client-side and using a managed solution is a compelling option.

You need a similar amount of expert knowledge to properly configure your client-side encryption, ensure the algorithm wasn't cracked, the implementation you're using doesn't have any severe vulnerabilities, etc.

If we're in a situation where we can trust no one, not even ourself, then we have a problem.

You can trust a Linux distribution to provide reasonably secure software out of the box, like Debian / Freedombox

Nothing you care about should have access to the open web. If your self-hosted services can be accessed by anyone with a web browser or curl, you're doing it wrong.

> VPN may not be applicable, because you have to share files with others.

You can use a self-host app like Pritunl[1] to host a private vpn server and put all the other self-host instances behind this vpn.

[1] https://github.com/pritunl/pritunl

"you need to know what you're doing" -Mr. Obvious

There are pre-packaged solutions such as the Uniform Server - a complete WAMP stack fully hardened for placement on a public server. This is an EXTREMELY COMMON PROBLEM and PEOPLE HAVE OPEN SOURCE PACKAGED SOLUTIONS.

This constant "it's too hard, waaa!" bullshit is just lies.

Reply on news.ycombinator.com