Hacker News Reader

Comment by ozim | Hacker News Reader

Personal website - what if someone takes over your server and does malicious stuff?

Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn?

You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it?

Because that is where it is going - it is not just code that can be vulnerable - but also combination of different software, combination of configurations. If you install 2 applications they might interact in a way that makes your system vulnerable.

Software is infinitely complex we can cut down complexity but then anything that is useful and complex will cost a lot more.

View on HN

> what if someone takes over your server and does malicious stuff?

What if somebody steals my kitchen knife and uses it as a murder weapon?

> Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn?

Yes. This is (and always has been) the price of operating a website on adversarial public networks. We established relatively simple ways to make this possible even for individuals decades ago.

> You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it?

As I replied to the sibling comment, when was the last time there was RCE for Apache or Nginx configured to serve static files from a webroot? We are talking about personal websites here after all.

> Software is infinitely complex we can cut down complexity but then anything that is useful and complex will cost a lot more.

I think I disagree with you on where the threshold of usefulness is.

I would like to present you how complex life is, maybe you embedded a video on your personal website and no one hacked your apache/nginx:

https://www.vice.com/en/article/qj8xz3/a-defunct-video-hosti...

People like to embed things in their personal websites - integrate them with third parties. That is my point.

Now you are responsible for what you embed on your personal website and what you publish.

I agree that Apache and Nginx are not critical attack surfaces, especially for static web sites. I have been experimenting with running static sites on Cloudflare Pages, delegating security and infrastructure to them. This goes against my desire for decentralization, however. I usually use GCP for my web sites and it is so little effort to occasionally start a fresh VPS, a few git pulls, and copy an Nginx config file, and flipping DNS settings. Automating this process to happen frequently would avoid the problems associated with hackers taking over your servers and use them long term.

Cutting down things that are unnecessarily complex would be a good start. I.e. most websites out there could be easily replaced by static code generators. Webauthn and client certificates can be used to protect admin interfaces. Technology is here but there is no demand for it because making things less secure is way cheaper.

Reply on news.ycombinator.com