0:00:00welcome to under the radar a show about
0:00:02independent iOS app development I'm
0:00:04Marco Arment and I'm David Smith under
0:00:06the radar is never longer than 30
0:00:07minutes so let's get started so today we
0:00:11wanted to unpack the situation that
0:00:15occurred I guess it was the end of our
0:00:18beginning of this week end of last week
0:00:20something like that where parse a fairly
0:00:23widely used platform for app backends
0:00:27design announced that they will be
0:00:28shutting down and the while the actual
0:00:32situation and the nuances of that aren't
0:00:34particularly like generally applicable
0:00:36they're interesting the actual sort of
0:00:38the fundamentals of that of having this
0:00:40big general-purpose flat platform that
0:00:42was used by lots of apps finally
0:00:44shutting or deciding it was going to
0:00:45shut down has a lot of knock-on effects
0:00:48that are probably worth unpacking before
0:00:51we dive into that app robbing sense to
0:00:52just sort of talk about what parse was
0:00:53and so parse was this platform that made
0:00:56and relatively easy to make a back-end
0:00:59for your application that would do
0:01:00object persistence user management
0:01:03things like that like a very basic
0:01:05high-level like non specific to a
0:01:07particular industry back-end sort of
0:01:09system that a lot of apps could use and
0:01:11it had fairly attractive pricing and
0:01:14including a free tier which is always a
0:01:16bit of a trap for these kinds of things
0:01:18where you can say oh we can use it for
0:01:19free and if our app gets really
0:01:20successful then we only then what we
0:01:22have to pay an advantage a couple years
0:01:24ago was bought by Facebook which it made
0:01:26everyone who is using it kind of happy
0:01:27because oh now it's not this sort of
0:01:29fly-by-night thing it's backed by you
0:01:31know this major corporation but now it's
0:01:34ship being shut down Facebook has
0:01:36decided that that's not something that
0:01:37they want to invest in and continue to
0:01:39maintain and so a year from now they are
0:01:42going to be turning it off they're doing
0:01:44it pretty well like they're getting a
0:01:46year's notice and a bunch of migration
0:01:47tools but at the end of the day this
0:01:49thing that I've heard varying reports
0:01:52but you know at least I think it's fair
0:01:55to say a quite a lot of apps make use of
0:01:57at least in part he's just gonna be
0:01:59turned off and as a result the apps that
0:02:01use it if they haven't been updated or
0:02:03migrated are just going to stop working
0:02:05and that's kind of tricky yeah I think
0:02:08one of the weird things about this is
0:02:09like you know kind of ties back to app
0:02:11economics where
0:02:12in order for these apps to continue
0:02:15working it has to be worth their
0:02:16developers time and and their developers
0:02:19have to have the budget to now do a
0:02:22noticeable update and you know they've
0:02:24made it relatively easy they've released
0:02:26big parts of their service as open
0:02:28source that you could just install at
0:02:29any server microsoft azure has started
0:02:32trying to attract people to migrate to
0:02:34them and they're making a little bit
0:02:35easier
0:02:36so there are migration options here that
0:02:38aren't gonna be incredibly work heavy
0:02:41but it is still work you have to still
0:02:43do an update there are going to be
0:02:44things you have to change and rewrite
0:02:45and so it has to be worth that happening
0:02:49by the by the apps developers so if
0:02:52you're relying on an app that uses this
0:02:53that hasn't updated in a long time that
0:02:55might never be updated for this it might
0:02:57never be worth somebody's time to update
0:02:59it and that's unfortunate and that that
0:03:01is going to cause a lot of problems in
0:03:02the app stores these apps was kind of
0:03:03slowly you know collect 1 star reviews
0:03:06and stopped working and and they just
0:03:08kind of live as zombies forever yeah and
0:03:10so as developers when I see something
0:03:13like this like I said like the a the
0:03:15specifics of the PAR situation are sort
0:03:18of inch vaguely and or like
0:03:19intellectually interesting but aren't
0:03:20actually practically that interesting
0:03:22but what it makes me think about is it
0:03:24makes me evaluate the dependencies that
0:03:27I have in my own apps and as I build
0:03:29apps and increasingly a fewer and fewer
0:03:33of the things that I've built have no
0:03:36web component whatsoever because the
0:03:38feel seems like these days like you're
0:03:41gonna need some kind of back-end for
0:03:43your application either something like
0:03:45parse or you know that's sort of like
0:03:47off the shelf or something you build
0:03:49yourself and you're probably gonna need
0:03:51these for at least one of three reasons
0:03:53like you're gonna need some kind of your
0:03:55apps probably going to do something
0:03:56back-up related or people are if they're
0:03:58people are putting any amount of data
0:04:00into your application they're probably
0:04:02going to want to be able to have it
0:04:04backed up and this is something that for
0:04:06a long time I used to ever say oh I rely
0:04:08on like the iTunes iCloud backup system
0:04:10but that is all kinds of problems and
0:04:13issues that you'll run into where like I
0:04:16have a recipe manager and I ran into
0:04:18issues where like their recipes were
0:04:20fully backed up in like the latest
0:04:22backup that they did but they
0:04:23accidentally deleted the app and so now
0:04:25the only way they
0:04:26get their recipes back is to do a full
0:04:29restore of an old backup on to their
0:04:32device potentially destroying newly like
0:04:35newer data on in other apps and things
0:04:38like it's a mess so you wanna be able to
0:04:39backup your data or you want to be able
0:04:41to sync your data between different
0:04:43devices so you'll need some kind of
0:04:45back-end to do that or you just have an
0:04:47app that has like a core service like
0:04:49obviously like I imagine an overcast you
0:04:52need a back-end or this you're like a
0:04:55lot of what you do wouldn't work if you
0:04:56didn't have some kind of back-end to run
0:04:58for it oh sure I mean you know there are
0:05:01podcast apps that don't use server-side
0:05:03backends like as intermediaries and just
0:05:05crawl feeds directly and everything but
0:05:07that's not how I built mine and and it
0:05:10affords me a bunch of advantages to have
0:05:11done it the way I do it but now I have
0:05:13this big dependency I'm on my surface
0:05:15yeah and I think ultimately like that's
0:05:17the right word like at the end of it
0:05:19building these backends that are maybe
0:05:22they aren't always required but are
0:05:23going to be required in a lot of cases
0:05:25like the biggest thing that I think this
0:05:28situation is instructive for is making
0:05:31us aware of the things that were
0:05:33dependent on and that our apps are
0:05:35dependent on because we're always gonna
0:05:38be dependent on something it seems like
0:05:39there's no way to really say like ok I'm
0:05:41gonna be completely independent because
0:05:43ultimately you're gonna be like I'm very
0:05:44reliant on Apple for example and iOS
0:05:48like if if Apple announced you know
0:05:51tomorrow that hey we've decided you know
0:05:54this iOS thing isn't really working out
0:05:55we're just gonna turn it off like we're
0:05:58just gonna stop making iPhones I'm not
0:06:00saying it's likely but if they did my
0:06:02apps would stop working like in the same
0:06:04way that if parse decide you know to
0:06:05going away meant that absolute relied on
0:06:07it go away like or maybe a more
0:06:09practical example for like i-4 on the
0:06:11Apple side of things as if they decide
0:06:13like you know what cloud kit isn't
0:06:14working out we're gonna turn that off or
0:06:16those types of things or like I rely on
0:06:19my hosting provider I post all my own
0:06:21all my Linux servers online out and you
0:06:25know if they decide they're gonna go out
0:06:27or they go out of business or they
0:06:29decide they're not gonna do the kind of
0:06:30hosting that I need anymore
0:06:31suddenly like I'm in a big bit of a bind
0:06:34and so like there's no way to avoid
0:06:35being dependent you're always dependent
0:06:37on something
0:06:38but like you can there's a lot of
0:06:41dependencies that you kind of have some
0:06:42choice in like do i want to be so wed to
0:06:46a particular platform or back-end or
0:06:47system or do i want to be a bit more
0:06:50flexible and do you know Bujji it ends
0:06:52up like the more custom you make it and
0:06:54how much of it you control you're gonna
0:06:56have more like Portability and be able
0:06:59to be like you know if this particular
0:07:00host goes away I can just get another
0:07:02one and your how to be able to look at
0:07:05the trade-offs and make more choices
0:07:06than if you're just all in on one thing
0:07:09that's when you start to get a little
0:07:11bit awkward yeah and that's why I like
0:07:13the the selection of what you depend on
0:07:16this this is why I'm usually very
0:07:18conservative with these you know
0:07:19obviously I try to minimize how many
0:07:21external services and companies and
0:07:23things I depend on but you know the
0:07:25betterment something as you said this is
0:07:28why I always try to choose as
0:07:29conservatively as possible so like yeah
0:07:32Apple could shut down the entire App
0:07:34Store and that would that would really
0:07:35be disruptive for us but that's very
0:07:37unlikely like the apps the app stores
0:07:39continued success is pretty important to
0:07:42Apple as well so I've aligned my
0:07:44incentives with this now pretty old and
0:07:47pretty important thing to its parent
0:07:49company that like it is very unlikely
0:07:51that Apple's Apple will do that and
0:07:53that'll be a problem for me
0:07:54Facebook shutting down parse this thing
0:07:57they bought did not have that kind of
0:07:59luxury like if you were a parse customer
0:08:01six months ago you're like looking
0:08:02evaluating this this dependency Facebook
0:08:05it isn't that important to Facebook to
0:08:07keep this running so that this this was
0:08:09foreseeable that like this was a high
0:08:11risk of happening that this company made
0:08:13this service it got big got bought the
0:08:15parent company didn't really depend on
0:08:16its continued operation for their core
0:08:18strategy so this was always gonna be a
0:08:21risk right so you know if if Linode I
0:08:25know however we're supposed to be
0:08:26pronouncing it I sale I know do you sale
0:08:27I know they say Linode if if that
0:08:29particular Linux VPS host gets shut down
0:08:32well that's unlikely because they're
0:08:35really big and they're they've been
0:08:37around a while but even if that happens
0:08:40migrating away from that is not that big
0:08:43of a problem because there are other
0:08:44Linux VPS hosts just like it and they
0:08:48and if if every Linux VPS host went away
0:08:52you could get a Linux server somewhere
0:08:53that behaved very similarly you know if
0:08:56every Linux server provider went away
0:08:59you could add as a last ditch run one in
0:09:01your house like you shouldn't but you
0:09:03could like in this so like the the
0:09:05transition options away from something
0:09:08are also very important like parse
0:09:09shutdown they did a decent thing here
0:09:12where they they open sourced a big part
0:09:13of their of their server and made it
0:09:16like installable on your own stuff but
0:09:17what if they didn't do that lots of
0:09:19things shut down and never do that
0:09:20because they just either can't or won't
0:09:22or don't feel like it so you know if
0:09:26let's suppose suppose you depend on an
0:09:28Amazon Web service for your business and
0:09:30Amazon shuts that down most of the time
0:09:33that is very hard to replace because
0:09:35they are so custom and proprietary you
0:09:37can't just kind of do your own thing if
0:09:39you dependent on any kind of like high
0:09:41level service like this then it is it is
0:09:44always a risk the the more like custom
0:09:47and proprietary and high level something
0:09:48is the risk of it being hard to replace
0:09:51if it ever does go away increases yeah
0:09:55and I think that's ultimately probably
0:09:57like the enticement and why it's this
0:09:59weird tension that you find yourself in
0:10:01as you're developing a service or as
0:10:02you're thinking about a feature you're
0:10:03saying like if I do it with this high
0:10:06level can't like constructor that this
0:10:09company's providing I can save myself a
0:10:12lot of time upfront because I'm not
0:10:15having to build that again you know I'm
0:10:18saying like if if there's this solution
0:10:20that they've come up with that like
0:10:22means that you know user authentication
0:10:24it's just like a thing that I can just
0:10:26ruff like plug into my app and it
0:10:28handles all the give a secure password
0:10:30storing and email resets and all that
0:10:33kind of stuff like say there's a service
0:10:34that does that off-the-shelf like that's
0:10:36you know days weeks months of time that
0:10:40you weren't spending building that thing
0:10:42that instead you're just kind of more
0:10:43integrating directly into your
0:10:44application and so like it's enticing
0:10:47and like you're getting this enticement
0:10:50at the benefit of that upfront time but
0:10:53it's sort of at the detriment of this
0:10:55this risk that you're increasing in your
0:10:57application and
0:10:58maybe that makes sense like if you're
0:11:00just kind of prototyping something and
0:11:02throwing it out there or you aren't in a
0:11:04situation that's very time limited that
0:11:06you have to you know you if you don't
0:11:08ship your app in a month it's you're
0:11:12gonna miss some kind of market window or
0:11:13opportunity that or like that's the only
0:11:15amount of like you just have that much
0:11:16money to make a run at it and you just
0:11:19kind of have to then great like it's
0:11:22there's nothing bad about those types of
0:11:24things but it's this weird tension that
0:11:26you're finding of like because you're so
0:11:28locked in at that point you're setting
0:11:30yourself up for difficulty down the road
0:11:33because it's not necessarily like you're
0:11:35it's like short-term benefit and like
0:11:38long-term pain because you know
0:11:39developing it yourself there's also
0:11:41long-term pain it's a different kind of
0:11:42pain but like you have to then be the
0:11:45one who's maintaining it or when
0:11:46security issues happen you know you have
0:11:48to could be you're the one going in and
0:11:50patching your web server or you're the
0:11:54Linux distribution you're installing on
0:11:55your servers or whatever like you're you
0:11:57know at some point there's always the
0:11:58long-term challenges with these things
0:12:00but the difficult the difference is more
0:12:02one of your totally locked in and at the
0:12:06whim of whatever that company is and
0:12:08unless you're their biggest customer
0:12:11which for the kind of people who I
0:12:12imagine listen to a show like this
0:12:13you're unlikely to be a service
0:12:16providers made like biggest customer
0:12:18you're just gonna be kind of like rah
0:12:20you know sort of wash back and forth
0:12:22based on whatever makes sense for them
0:12:24and that may or may not be something
0:12:26that or a position that you find
0:12:28yourself in that you'd be comfortable
0:12:29with this episode of under the radar is
0:12:32brought to you by hover quite simply
0:12:34hover is the best way to buy and manage
0:12:36domain names when it comes to buying a
0:12:38domain name hover is the first place I
0:12:40check now when you have an idea for a
0:12:41project naming it can be difficult when
0:12:43you finally get that name you want to be
0:12:45able to quickly and easily get the
0:12:46domains that you need hover provides a
0:12:48simple fast and hassle-free method of
0:12:50buying domains I don't want to be faced
0:12:52with a thousand screens and all these
0:12:53add-ons high prices all these like
0:12:56custom weird services that seem kind of
0:12:57like scams I just want to get in it's
0:12:59like what I need buy it and get on with
0:13:01my life and building my new idea hover
0:13:03makes us very very easy
0:13:04their search is very nice it suggests
0:13:06things for you if nothing's available
0:13:08they can search all the TL DS all the
0:13:10crazy new ones in addition to all the
0:13:12nice
0:13:13and they have dot-com domain starting at
0:13:15just $12.99 a year great prices on all
0:13:18the other ones as well all these include
0:13:20Whois privacy for free with every hover
0:13:22domain because they believe that you
0:13:24shouldn't have to pay extra for
0:13:25something like that that's you know
0:13:26obviously you want to keep your private
0:13:28information private that's one have
0:13:29fantastic customer support if you want
0:13:32to call them they have a no hold no wait
0:13:34no transfer telephone support policy
0:13:36when you call them you talk to an actual
0:13:37human being not a robot not a menu you
0:13:40don't have to say like operator like the
0:13:42stupid speak menus it's a real human
0:13:44being you can just talk to directly they
0:13:46pick up the phone and if you do of
0:13:47course prefer the robots they also have
0:13:50great support documents and support
0:13:51guides and their website for getting
0:13:52everything you need and you can email
0:13:54them as well if you'd like and they also
0:13:56have a valid transfer service where they
0:13:58can take all the hassle out of switching
0:13:59from your current provider so because
0:14:01they do it all for you you can just give
0:14:03them your login to your old provider and
0:14:04they will transfer names for you if
0:14:05you'd like all that for free of course
0:14:07they have so much more great stuff they
0:14:09have volume discounts they have custom
0:14:11email addresses storage and forwarding
0:14:13and so much more stuff check it out
0:14:15today at hover.com
0:14:17use code perspective at checkout that is
0:14:20once again code perspective at checkout
0:14:22and you will get 10% off your first
0:14:24purchase at hover comm and you will show
0:14:26your support for under the radar and all
0:14:28of real afm thank you very much to hover
0:14:30for sponsoring this episode so it seems
0:14:33like we should probably also dive now
0:14:34dive into kind of like what we do how we
0:14:37approach this because I think we both
0:14:39have found ourselves at the end of the
0:14:41like the thought process on how we
0:14:44should bake backends for our servers
0:14:46with the like well we're gonna build
0:14:47them ourselves and we're gonna build
0:14:49custom applications running on you know
0:14:53Linux VPS is that we use and probably
0:14:58worth saying why we kind of do that I
0:15:00mean to me it's it's you know first of
0:15:02all it's all about control for me I'm a
0:15:03control freak and I want to do
0:15:05everything myself and I want I want I
0:15:06want everything to be under my control
0:15:07because I don't want to have major parts
0:15:11of my roadmap dictated by a dumb change
0:15:16in my host that oh all of a sudden this
0:15:17entire thing I depend on is shutting
0:15:19down and I got to change that like you
0:15:21know Apple give us enough of those
0:15:22things we don't you know the with like
0:15:24new device releases and everything but
0:15:25those are you know kind
0:15:26an unavoidable part of working with
0:15:27Apple but when it comes to running your
0:15:29services you control a lot more of that
0:15:31and you can avoid those things and so I
0:15:33love that part of it and for me it's
0:15:36also it's also a lot about capability
0:15:38and and cost in a low cost and and and
0:15:42just being able to do a lot cloud kit is
0:15:44very appealing in a lot of ways and if I
0:15:46was making the new app today I would
0:15:48think very hard about how about whether
0:15:50I could just do it all in cloud kit and
0:15:51whether that'll be the right move for me
0:15:52but it is still limited in what it can
0:15:56do what it can't do
0:15:57and and so for me like a website or like
0:16:01a regular Linux back-end is the default
0:16:03for me I know how to do it it really
0:16:05isn't that hard which we'll get into in
0:16:07a little bit it really isn't that hard
0:16:08and it's it is surprisingly capable for
0:16:12surprising little cost yeah exactly I
0:16:14think there's the reasons are fairly
0:16:16similar for me like I like I think the
0:16:19thing that I like most is being able to
0:16:21tailor the backend of my application to
0:16:23not necessarily the application but it's
0:16:27tailored to the way that I think and the
0:16:29way that I solve problems in the way
0:16:31that I'm thinking about like the
0:16:32problems that are being solved in my app
0:16:35so when I'm dealing with something like
0:16:38sink like the generic term for like one
0:16:41of the hardest problems in computer
0:16:42science I like that I can like so I'm
0:16:47solving that problem in a way that makes
0:16:49sense to me that I'm not having to kind
0:16:51of shoehorn my application in the way I
0:16:54think about it into the model that a
0:16:57service provider provides and they say
0:16:59like well you know we handle conflict
0:17:01resolution using like last last updated
0:17:05wins or something like that and like
0:17:06maybe that works maybe it doesn't
0:17:08and so when you build your app builder
0:17:10yourself like I actually understand it
0:17:12like I have to go I've gone through and
0:17:14I've made the decisions at the various
0:17:17levels of like well I want this to work
0:17:19this way I want this to work that way
0:17:20and so then down the road when I'm
0:17:22debugging something and I have a better
0:17:25understanding of how how I expected to
0:17:28work and when things go wrong I have a
0:17:30sense of where they're made might be
0:17:32going wrong like is this an app problem
0:17:34is this a web service problem and like
0:17:37ultimately it probably also just like
0:17:38makes my apps better and makes me a
0:17:40better program
0:17:41like having this breath of experience
0:17:42that at this point like I can build
0:17:46something all the way from like the UI
0:17:49and the application the business logic
0:17:51inside of the application and then all
0:17:54the way through to like the you know
0:17:56then the web service that's managing
0:17:58that information and a database at the
0:18:00back that's storing that information
0:18:02like having being able to do all those
0:18:04things is just like good for me from a
0:18:08career and personal development
0:18:09perspective like I've learned to solve
0:18:12more problems doing it this way that
0:18:16ultimately I think makes me a better
0:18:17developer like I write less my apps are
0:18:20probably better because they're the kind
0:18:22of calls they're making like I know what
0:18:24the server is trying to do with those
0:18:25calls and so you don't end up just like
0:18:27well this is like the naive obvious
0:18:30solution I'll just kind of throw all
0:18:31this data at the server or I'll hey let
0:18:34me just ask for all of it every day all
0:18:36the time and because if the servers are
0:18:39overwhelmed that's not my problem like
0:18:41those are things that ultimately
0:18:43probably make my apps better and like
0:18:45you were saying it is kind of crazy how
0:18:46inexpensive it is to do a lot of these
0:18:48things now like just with a lot of my
0:18:52things are just backed by like two or
0:18:54three
0:18:55you know VPS is that cost I mean like at
0:18:59a basic one it's like $20 a month
0:19:00there's something like that twenty forty
0:19:02dollars a month like for a lot of my
0:19:04applications I end up spending you know
0:19:05maybe it's $100 a month in in servers
0:19:09and that's really not too bad for the
0:19:13can of capability in the throughput and
0:19:14the number of users that you can support
0:19:17even with just at that level oh yeah I
0:19:20mean evenly the twenty bucks a month
0:19:21server level on a modern host like line
0:19:24out or digitalocean you can get so much
0:19:26for this for this money now and when
0:19:29you're using boring old fast tools like
0:19:32MySQL or Postgres and you're you have
0:19:35like a modern web language in front of
0:19:36it you know you have even in the old
0:19:38ones PHP Ruby you know like Python or
0:19:41more recently you might have like go you
0:19:43know these these are so fast you can do
0:19:46so much you can support so much usage
0:19:48it's way more than you think because now
0:19:50you know you have these modern
0:19:51processors doing the virtualization you
0:19:53have
0:19:54ssds on almost all these hosts now it is
0:19:56incredibly fast to do and so like you
0:19:59you really can support a lot on very
0:20:01little hardware yeah and I think
0:20:03ultimately that makes it a lot easier
0:20:04like it's there the hardest problems
0:20:07I've ever had to solve like the only
0:20:08time I kind of regretted doing backends
0:20:10myself is they were the early days of
0:20:13feed Wrangler my RSS sinking system
0:20:15which like I was doing stuff that in
0:20:19retrospect was really foolish and was
0:20:22just crushing my database like it was
0:20:24just my Postgres database was just
0:20:27constantly dying and falling over and in
0:20:30retrospect it was because I was being
0:20:33you know deserves I've made a few really
0:20:34bad assumptions upfront but even there
0:20:38like that's the only time I've ever
0:20:40really had to do any low-level
0:20:43performance tuning of any of my
0:20:45applications otherwise just out of the
0:20:47box things are just fast and work and
0:20:50it's fine in a way that like it would be
0:20:53problematic if I you know if I really
0:20:55needed to be like a database
0:20:56administrator like a serious like you
0:21:00know DBA whatever they call them these
0:21:01days like doing that kind of work but
0:21:03most of the times I just like install
0:21:04Postgres with the defaults you know
0:21:07tweak a few things how the way I like it
0:21:08and then it's fine and it just runs
0:21:11quickly enough for you know that my
0:21:13users don't even really notice any kind
0:21:15of performance issues or problems yeah I
0:21:18mean like you might think if you've if
0:21:19you haven't done this before or if the
0:21:21last media this was like 10 years ago
0:21:22you might think that running servers
0:21:24requires lots of like low-level tweaking
0:21:26and performance tuning and getting these
0:21:28right config variables to like exactly
0:21:30the right buffer size and everything and
0:21:31you don't really need to do that anymore
0:21:33that's very very rare for most people
0:21:36need to get that that down into the
0:21:38nitty gritty stuff it really is like as
0:21:40you said that you can just install these
0:21:41things with the defaults and usually
0:21:44you're fine
0:21:44that's usually what you need to do
0:21:46because everything is just so good now
0:21:48there's so much Headroom the software is
0:21:50very mature and a lot of these things
0:21:52and and the hardware isn't very mature
0:21:54to so it you really get a lot of weight
0:21:57with just the defaults now and I think
0:21:59if you think one thing that I was kind
0:22:00of looking forward to when we got it got
0:22:02into this topic is you said you had a
0:22:03few little pro tips for getting into
0:22:06this kind of administer
0:22:07because I think it is it can be a little
0:22:10bit intimidating to it's like you know
0:22:13like go and install Linux even then you
0:22:15starts like well what version of Linux
0:22:16what should I do
0:22:17how to get started and it's remember a
0:22:20bit being a little intimidating but at
0:22:21least like what the fun thing is once
0:22:23you get going like there's tremendous
0:22:24resources and you can just kind of get
0:22:27going and once you know it you know it
0:22:28because this stuff doesn't really change
0:22:30yeah basically like Google is your
0:22:33friend you know not not the corporate
0:22:35structure but you know the search engine
0:22:36its SEC overflow like all these things
0:22:38these are your friend because lots of
0:22:41people have been running Linux servers
0:22:43for years and as you said the tools and
0:22:46the commands and what you need to do
0:22:47doesn't change very often usually
0:22:49typically that you learn this stuff like
0:22:51once and you have to learn something new
0:22:53maybe every two years like it's it's
0:22:55pretty it's pretty stable it doesn't
0:22:57change much so number one tip I can give
0:22:59is to pick a very popular but somewhat
0:23:04conservative Linux distribution to do
0:23:06this with four years I recommended sent
0:23:08to us which was basement right Hat
0:23:09Enterprise Linux I think today I think
0:23:12Ubuntu might have more momentum behind
0:23:14it so I actually just I just managed my
0:23:18first Ubuntu server recently and it's
0:23:21it's things are a little bit different
0:23:23but I was able to figure it out
0:23:24so between sent OS and Ubuntu you can't
0:23:27really go wrong turn on auto updates for
0:23:31as much of a system software as it makes
0:23:33sense to do that for usually every major
0:23:35district has a way to do this it's very
0:23:37straightforward that will take care of
0:23:39most security problems for you if you
0:23:42basically are not an idiot which you're
0:23:44not trust me you know if you're not an
0:23:46idiot and if you leave things mostly at
0:23:48their defaults with the distro and what
0:23:50it comes with modern Linux distros are
0:23:52very secure by default because they know
0:23:54that that matters like the default
0:23:56matter so they've all adopted pretty
0:23:58conservative and pretty secure defaults
0:24:00for the most part keeping things updated
0:24:02automatically is very easy and things
0:24:04like that on a other high level stuff
0:24:06only run the software that you need to
0:24:08be running and they're all very good at
0:24:10letting you manage this so like if you
0:24:12have a server that you have your website
0:24:13on don't also install like well let me
0:24:16install FTP so I can like trade files
0:24:18with my friends like no just leave that
0:24:19off that's just of just a liability it
0:24:20just don't do that
0:24:21you know install what you need to
0:24:22install and if you want to play around
0:24:24with different things you can create a
0:24:26second VPS for like five or ten bucks a
0:24:27month and play around on that don't play
0:24:29around in your main servers run only
0:24:31what you need to be running on them take
0:24:33advantage of the built in isolation in
0:24:36Linux machines especially with regard to
0:24:39networking almost every service that
0:24:43you'll be running will have some kind of
0:24:44like listening port where you can say
0:24:45alright this database should listen on
0:24:47this interface on this port if you only
0:24:49have one server make this make the
0:24:52internal stuff listen on localhost so
0:24:53that you can't log into MySQL from
0:24:56outside like you shouldn't need to do
0:24:58that anyway you should be doing things
0:24:59on the server if you need you know
0:25:00management stuff lock that down if you
0:25:02have multiple servers use use private
0:25:04networking every host that's worth their
0:25:06salt support the private networking
0:25:07between your between your own machines
0:25:09so if you have multiple servers need to
0:25:11talk to each other have them talk to
0:25:13each other only over private interfaces
0:25:15have things like MySQL or memcache
0:25:17listen-only on private or our local
0:25:19interfaces that helps a lot just make it
0:25:22don't don't rely on like being your
0:25:24password secure make it so that
0:25:26passwords don't even work from the
0:25:28outside so that also applies to things
0:25:30like SSH when you're doing login remote
0:25:32login so disable root logins once you
0:25:34have a user set up had that user have
0:25:36sudo access with the password and then
0:25:38that user account that you're logging in
0:25:40as say you're logging in as David make
0:25:41that the only user that can log in via
0:25:43SSH and make that key authentication
0:25:45only disable password authentication in
0:25:47SSH this is very simple stuff to do you
0:25:50can Google how to do it so that right
0:25:53there you have no way to log in with a
0:25:55password you have to have the the
0:25:58encryption key to log in that knocks out
0:26:00massive you know brute force
0:26:02possibilities and everything that helps
0:26:04so so much between that and private
0:26:07networking for private services you
0:26:09really eliminate a lot of problems now
0:26:11moving on slightly to user data collect
0:26:15as little user data as possible to get
0:26:17your job done because worst case
0:26:20scenario somebody hacks into your server
0:26:22worst case scenario they take your
0:26:24database what do they have think about
0:26:27it when you're designing your when
0:26:28you're designing your database you're
0:26:29designing your service what information
0:26:31do you really need from people and what
0:26:32can you get away with not having
0:26:34if you don't need to get people's email
0:26:36addresses don't get their email
0:26:37addresses if you like if you're taking
0:26:39passwords from people hash those so that
0:26:41you know people aren't getting like just
0:26:43the md5 like for God's sake don't do
0:26:45that like you know use secure password
0:26:47hashing like be Krypton strong settings
0:26:48there is lots of good practices for this
0:26:51lots of things to tell you how to do
0:26:52this I've considered even for overcast
0:26:53like I do have the email addresses for
0:26:56people because I figure yeah I need to
0:26:57be able to I have email addresses and I
0:26:58have hashed passwords with a strong
0:27:00bcrypt but I'm like I've been thinking
0:27:02recently do I even need the email
0:27:03address could I could I have that too
0:27:06cuz then then you have like if you steal
0:27:08my database you just have no email
0:27:10addresses like that would be amazing and
0:27:11I was thinking like the only if you hash
0:27:14the email address so it works just like
0:27:15that you like the password basically
0:27:16then you could still have logins you can
0:27:19still have password resets the only
0:27:20thing you really can't do is I can't
0:27:23like email people randomly out of my
0:27:25database but I've never done that I
0:27:27don't send a newsletter I don't do it
0:27:29like I don't do any that stuff so you
0:27:32know stuff like that
0:27:32think about just like what data you have
0:27:34what you're collecting and what you can
0:27:35afford not to collect simple security
0:27:39measures beyond that you know you should
0:27:41have database backups you should also be
0:27:43encrypting those backups there's
0:27:44built-in stuff there's a crypt command
0:27:46you can pipe thar through and everything
0:27:47like this really simple stuff on unix to
0:27:49do all this very securely make sure
0:27:52though that you are testing these
0:27:54backups make sure you can decrypt them
0:27:55it's so that's very important don't
0:27:58store the encryption key only on the
0:28:00server because then if that server gets
0:28:01wiped or gets lost or whatever you've
0:28:03lost your data and your backup
0:28:05decryption key that's no good one
0:28:09strategy I employ there is I write my
0:28:11database backups I copied them onto a
0:28:14write only s3 account so like the the
0:28:18account the credentials that are on the
0:28:19machines can only write to the bucket
0:28:21they can't read or delete from it so
0:28:23that way if somebody hacked into the
0:28:24machine they can't also go and delete on
0:28:26my backups so I have a separate you know
0:28:29separate credentials that I can that I
0:28:31can pull the backups off of there and
0:28:32restore that never live on my servers
0:28:34those those stay like with me and my
0:28:36personal documents those never live on
0:28:37the servers so you know keep things as
0:28:39secure and separate as you can just by
0:28:41design like this and that's really about
0:28:44it for basic security stuff it really is
0:28:47not as
0:28:48as you think and you don't have to do
0:28:50very much you don't have to like
0:28:52constantly keep on top of your servers
0:28:54and be constantly baby suddenly for the
0:28:55most part you set it up and it basically
0:28:57runs itself and if you set it up with
0:28:59sensible default using conservative
0:29:01software and some basic security
0:29:02settings like what I've said here
0:29:04you can be pretty much fine yeah exactly
0:29:07and I think that it's the kind of thing
0:29:08that if you can't do this kind of thing
0:29:12and if like if everything that Marco
0:29:14just ran through like is complete
0:29:16gibberish to you like you should
0:29:17probably do something about that it's a
0:29:19good it's an important skill to be a
0:29:21developer to understand some of these
0:29:22basics they sort of like the
0:29:24fundamentals that run the internet like
0:29:26you should understand what this is and
0:29:28you know just sort of take control of
0:29:30that and you know I just I just get a
0:29:33five-dollar like VPS somewhere and start
0:29:36messing around and start seeing you know
0:29:38learning cuz that's how most people even
0:29:39people learn this stuff you just start
0:29:41doing it and you get better at it
0:29:42alright we're out of time this week
0:29:44thanks for listening everybody and next
0:29:46week we're gonna go into a little more
0:29:47detail about our server setups lessons
0:29:50we've learned and how to minimize the
0:29:51workload we'll see you next week okay