Hacker News Reader

Comment by eugenekolo | Hacker News Reader

Always surprised when some of these sites shut down. The operating cost seems low and putting on a few ads (ethical, non-intrusive, etc.) can net you passive $100+/mo.

View on HN

It's more than money, they still require care and feeding.

At some age (and I'm getting to that), you just tire of being a sysadm, esp. for "home"/hobby stuff.

A historical archive of something should allow for robust, non-interactive ways to persist. Maybe there should be standards for this. In the mean time we can find gratitude to archive.org and similar services

Even if it's a static HTML, you need to patch your webserver, OS, and migrate the whole stack to newer versions.

This is why I'm scaling down my home infrastructure to SBCs and run everything on Debian with stock package repositories. It reduces tons of burden to something very manageable.

Non-sysadmin here. For static HTML, why is server patching/OS needed if things are locked down?

A webserver like Apache and NGINX are way more complex than they look. It's sometimes possible to exploit bugs with benign/simple requests, even if you don't run advanced stacks on them. See [0] for example.

If you're not running strict firewall rules to limit your SSH access and if you expose other services outside, they also need constant patching against newer attacks.

Lastly, security standards evolve. Your SSH and SSL layers need to be kept up to date to patch holes and add newer algorithms while deprecating others, further reducing the attack surface [1].

[0]: https://www.exploit-db.com/exploits/50383

[1]: https://lists.mindrot.org/pipermail/openssh-unix-announce/20...

Because no software is perfect, which means every lock has weaknesses that sooner or later get found out. Chances are that, say, a Linux 2.x server that was considered "very secure" in 2005 would now be pwned in a few hours.

Because both the Linux kernel and whatever SSL and web server stack you use regularly have their remotely exploitable vulnerabilities.

Static HTML means you don't have your own code to worry about vulnerabilities in. Vulnerabilities in the server or OS software don't just go away.

If it's static HTML you can put it on Github Pages and leave it alone.

Sometimes you can, sometimes you can't.

Sometimes you will, sometimes you won't.

"Even if it's just static text, you need to patch your OS, update your text editor and migrate the whole document to newer versions."

Nah. That's bull. A static site can be put on a web server and the site never needs to be updated again. I have web sites people started hosting on my servers in the '90s that are still there, still serving, and haven't been touched in twenty years.

Sure, I update the servers and software, but the actual amount of work needed for the site is, quite literally, zero.

Which ones? …for research purposes only, of course.

I have several dozen that go back at least two decades, but I don't think I should post them without asking the owners. OTOH, here's a rather public one:

http://www.baloneypotd.com/

Someone has to run the server. That's the point.

For $100+/mo you can easily have someone manage that.

For simple servers, unattended upgrades and an automatic mail whenever server needs a restart (like kernel updates) is enough. I'd put that $100 to a piggy bank every month instead.

Easily said when it's not your $100/mo for something that no longer interests you.

I was taking this comment into account

> and putting on a few ads (ethical, non-intrusive, etc.) can net you passive $100+/mo.

My response is: In what decade?

What?

> Sure, I update the servers and software, but the actual amount of work needed for the site is, quite literally, zero.

I think this is what I said? Quoting myself:

> Even if it's a static HTML, you need to patch your webserver, OS, and migrate the whole stack to newer versions.

I don't think I said "you need to update/patch the webpage itself".

Huh. The password masking algorithm changes some words possibly.

I was making the point that the web server can just keep getting updated by virtue of being part of an active server. Separately, the site doesn't need any updating / maintenance.

The same person or people who run the servers aren't necessarily the same person or people who make the web sites.

People can just as easily have static sites on SDF.org. There'd be no reason for anyone to fret about whether the servers are up to date.

Also, nobody ever needs to "migrate the whole stack to newer versions". That's just not a thing with a static site.

Of course, I'm generally on the side which maintains the servers. Some of these servers happen to be my own servers which stores my own stuff.

BTW, I'm on SDF. I love these guys. They sometimes nuke my TTRSS user, but that's OK. :D

The whole stack, at least in my parlance, means anything and everything between your (static) webpage and hardware. From kernel to the server which serves your page.

IOW, I use stack as in "LAMP" stack. In this case it's only LA, but it's a stack nonetheless.

Stick it on s3, tell cloudfront to serve from the bucket, and let that sucker run almost unattended till aws shuts down.

Why complicate everything when I can serve it with webfs (a tiny webserver), from a tiny SBC from a cabinet in my room, or from a VM and concentrate all my services to it while paying not too much money and have all the flexibility in the world?

I don't like to use oversized tools for small jobs. Also, it's not fun.

No, you definitely don't. I'm pretty sure no-one has performed one single update on my old server since we installed it in 1996:

http://resworld.eolith.net/staff.html

I don't remember if it is Linux or *BSD now, but I don't even know how you would update a kernel or libraries that old lol

I can say that the server in question is updated at least until 2010. However, some of the software running on it has some (read: quite a few) weaknesses as far as I can see.

...and it has ports open.

Maybe you should give it a backrub, IDK. It's possible to iteratively update that thing AFAICS.

> a few ads (ethical, non-intrusive, etc.) can net you passive $100+/mo.

No way. That's barely true of Adsense anymore much less whatever non-Adsense network you have in mind. And not for a dead site like bash.org.

Reply on news.ycombinator.com