6 ms·

Speaking for myself, the issue is that I don’t know enough about devops/security to go barebones (esp if for a side project accepting payments w/ sensitive data

Speaking for myself, the issue is that I don’t know enough about devops/security to go barebones (esp if for a side project accepting payments w/ sensitive data). It’s of course dead simple to set up a server barebones, but to do it in a way for a service open to the internet with uptime requirements requires more specialization of knowledge these days.

nojs 4y ago
This comment is kind of ironic given that the recent Heroku breach presumably triggered the OP’s question :)
- christophilus 4y ago
  There’s an added advantage to running your own server or VM. Heroku is a big, juicy attack target. Your little side project is not. If you take the basic precautions, your VPS will probably be just fine unless you become super successful and a juicy target in your own right.
  - kasey_junk 4y ago
    The security history of VPS’ don’t lend much credibility to your argument. It was a running gag for awhile how frequently Linode was getting owned up (they may be great now this was a while ago).
    - christophilus 4y ago
      Yeah, I don’t run the provider’s software on my VPSs, so it’s mostly a non-issue, especially if you encrypt your disks.
TekMol 4y ago
OS level security? What does a service like Heroku even offer in this regard? You can turn on autoupdates or run "apt update && apt upgrade" regularely. If an OS level exploit slips through that, you will probably be affected no matter where you are hosting. But OS level exploits are super rare. The problem is usually your application. And Heroku and Co cannot guard you against those problems. I'm not sure what you mean by setting up a server "in a way for a service open to the internet". "apt install php" gives you pretty much all you need. And it is ready for the open internet.
- tyingq 4y ago
  Heroku does isolate the application somewhat. You would have to add some amount of itables configuration, ssh setup, web server config, "don't run everything as root", and so on to your list. All doable of course, but there's a reason people pay for things like heroku.
  - TekMol 4y ago
    You don't have to do any of those security wise. On a plain Debian installation, do "apt install php", throw your files into /var/www/html/ and your application is up and running in a secure fashion.
    - christophilus 4y ago
      You do need to at least: set up automatic security patching (a one-line command), turn off password authentication, disable root, and probably run ufw or something. It’s not hard, but it is slightly more effort than Heroku.
      - D13Fd 4y ago
        The hard part is making sure this random list of things I found on the internet is sufficient to keep the site secure, and taking the blame if it turns out not to be.
        Handytinge 4y ago
        As opposed to trusting the random black box company on the internet? Don't you take the blame still for picking a company whose product you are unable to do due diligence on?
    - tyingq 4y ago
      The OP wanted updates to happen in some automated fashion from a git repo. Also, didn't say specifically, but I'm guessing they wanted https and certificates.
deleted 4y ago
[deleted]

nojs 4y ago

This comment is kind of ironic given that the recent Heroku breach presumably triggered the OP’s question :)

christophilus 4y ago
There’s an added advantage to running your own server or VM. Heroku is a big, juicy attack target. Your little side project is not. If you take the basic precautions, your VPS will probably be just fine unless you become super successful and a juicy target in your own right.
- kasey_junk 4y ago
  The security history of VPS’ don’t lend much credibility to your argument. It was a running gag for awhile how frequently Linode was getting owned up (they may be great now this was a while ago).
  - christophilus 4y ago
    Yeah, I don’t run the provider’s software on my VPSs, so it’s mostly a non-issue, especially if you encrypt your disks.

TekMol 4y ago

OS level security? What does a service like Heroku even offer in this regard? You can turn on autoupdates or run "apt update && apt upgrade" regularely. If an OS level exploit slips through that, you will probably be affected no matter where you are hosting. But OS level exploits are super rare. The problem is usually your application. And Heroku and Co cannot guard you against those problems. I'm not sure what you mean by setting up a server "in a way for a service open to the internet". "apt install php" gives you pretty much all you need. And it is ready for the open internet.

tyingq 4y ago
Heroku does isolate the application somewhat. You would have to add some amount of itables configuration, ssh setup, web server config, "don't run everything as root", and so on to your list. All doable of course, but there's a reason people pay for things like heroku.
- TekMol 4y ago
  You don't have to do any of those security wise. On a plain Debian installation, do "apt install php", throw your files into /var/www/html/ and your application is up and running in a secure fashion.
  - christophilus 4y ago
    You do need to at least: set up automatic security patching (a one-line command), turn off password authentication, disable root, and probably run ufw or something. It’s not hard, but it is slightly more effort than Heroku.
    - D13Fd 4y ago
      The hard part is making sure this random list of things I found on the internet is sufficient to keep the site secure, and taking the blame if it turns out not to be.
      - Handytinge 4y ago
        As opposed to trusting the random black box company on the internet? Don't you take the blame still for picking a company whose product you are unable to do due diligence on?
  - tyingq 4y ago
    The OP wanted updates to happen in some automated fashion from a git repo. Also, didn't say specifically, but I'm guessing they wanted https and certificates.

deleted 4y ago

[deleted]