Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
I don’t think programming language is a good metric for security. I assume everything I host has issues, and then try to mitigate from there.
IMHO, a better approach is to vet the project beforehand, looking at whether it is still actively maintained. I usually use things like commits, issues, etc to try and gauge whether a piece of software is actively maintained so that when an issue arises, it can be fixed.
You can mitigate much of the risk by using some basic best practices, like isolating all apps from each other (using docker, for example), using a reverse proxy, tools like fail2ban or a web application firewall, using proper database permissions for each app, etc
What I also do is add another layer by making certain applications accessible only over vpn. That won’t work for some tools, obviously, but also reduces the risk for tools you are only using yourself.
That all seems prudent and reasonable. I guess some of my own anxiety is about how exactly I'll evaluate projects like you're talking about. I can (and do) certainly look at whether a project is actively developed before selecting it. Not just for security reasons.. I don't want to bet on a horse that won't get updated with fixes and features. But for security in particular, I guess I was hoping for ways to evaluate that for a project.. without exhaustively poring over its source. Maybe, to your point, the other mitigations you listed should be sufficient, and I should worry more about that side of things than picking the perfect project.