Comment by superkuh
5 days ago
How I Blog with HTML and nginx - Zero Cost, Fully Owned: Step 1. install nginx from repos on my home desktop computer. Step two: write html files and put them in directories under the web root. Step 3. forward port 80 to the webserver internal IP on my router config. Step 4. Link people to http://your.ip.here.a/somepage.html or maybe rent a .com domain.
I've been doing it for 20+ years (xitami and thttpd before nginx) and it not only has an infinite lifetime (because it's .html and files) but it also has no attack surfaces or mantainence required.
All that static site generator and remote corporate services stuff will break within a year if left untouched. And re: security, running a static nginx server from home is about 10,000x less of a security risk than opening a random page in $browser with JS enabled. nginx RCEs are less than once a decade. And DoS re: home IP? A vastly over-stated risk for most human people. In my 20+ years I've never had a problem, and even if I ever do, who cares? It's not like my personal website needs nine 9s of uptime. It can be down for days, weeks, with no issue. It's just for fun.
Yikes, I'd strongly discourage unfiltered ingress PAT to your desktop machine.
I know you have acknowledged the decision to entrust nginx with all of your personal data and tax records and bank statements and legal documents and browser history and GitHub credentials and ssh private keys and so on.
But it's still madness. You are one oversight, accident, or bug away from total pwnage.
All of this applies to using your browser and your browser automatically executes code from random sources. If this is your threat model then how are you even posting on HN? Shut down that insecure browser quickly. It is tens of thousands of times more likely to expose your personal data etc etc than nginx.
Running nginx isn't madness. Thinking nginx is more of a risk, or even comparable to, your normal daily browser behavior certainly is.
Go look up the last nginx RCE. I think you'll be in the 2000s for just bare nginx.
You are not educating me in any way. And obviously I don't browse with JavaScript enabled.
We could go back and forth all day about the likelihood of a v8 sandbox escape vs RCE in a big C program. But another risk to consider is a non-obvious misconfiguration. A default server block with a wildcard server name. A stray symlink inside the docroot. An unexpected mount point. A temporary config change that you forget to revert. So many ways to fail...
Regardless, trusting your entire personal data security to a single layer of protection is madness.
Perhaps only exceeded by the logic of "it hasn't happened for a long time, therefore it will never happen again".
Good luck.
3 replies →
But I’d say “infinite lifetime” only holds as long as your hardware, power, and IP setup stay stable. If your home machine dies or your router resets, things go offline fast.
That’s part of why I prefer hosting the static output somewhere external. Not perfect, but it lets me step away from the setup for months and still have it running.
Yes, I do need society to continue existing and for me to not be homeless. I guess I hadn't considered the needs of the unhoused. For them self-hosting is going to be a problem. For everyone else, not a problem. Going briefly offline for a week literally doesn't matter at all. This isn't a business or institutional service. Once you stop trying to fulfill the needs and constraints typical of those endevors you can see just how easy it is.
As for IP, when it changes you can just copy the new IP and stop sending links with the old IP to friends. It's not a big deal. But a domain is nice (either some dyndns subdomain or a real tld with free DNS hosting (and dyndns updates) by zoneedit or the like).