Reconsider listing of self-hosted services

[ph00lt0]

I am not really a big fan of the recommendation for vaultwarden. I doubt most visitors are capable of securely hosting and monitoring this. Setting up a VPS for this alone is not much less than just paying for Bitwarden premium and supporting the project. That besides adding more parties to trust (hosting and vaultwarden authors). It's really a niche solution.

[jonaharagon]

With almost 18K stars on GitHub I'm not sure I would describe it as a niche project, and it was designed to be easier to install. The use-case here isn't the cost benefit, it's for total data ownership on your own infrastructure.

[ph00lt0]

To illustrate if you would self-host Etesync for contacts and notes I think the thread is a lot lower as there is less to gain for an attacker. Only attacker who will be very specifically interested in contact details and notes will hack this. This is far less interesting than a password manager having access to bank accounts, email etc etc.
But yes I would say probably best to just pay the subscription. For both security as well as supporting the project.

[matchboxbananasynergy]

This sounds all well and good, but if we were to decide on a self-hosting section in Advanced, where would we list projects that we think are worth self-hosting? Would they be listed in their current location, or somewhere else?

[ph00lt0]

Maybe it should still be listed with the main product and have for advanced users button. This can bring users to the article about self hosting the service. On top of those self-hosted service pages, we could have a generic warning about the risks involved with self hosting.

[ph00lt0]

I think the https://www.privacyguides.org/advanced/ is pretty good for this. There could be a page for each self-hosted product, with a generic card with the list of warnings on top.

[ph00lt0]

Now that I am thinking more about it, I would rather actually have those pages describing the risks and still providing it for those who believe can mitigate those (maybe organizations) or people who risk lockouts. Not providing it may result in people discovering it themselves and assuming that it's okay, explaining the considerations is actually good guidance.

[jonaharagon]

To address the new title of this discussion, RE: reconsidering self-hosted services as a whole:

I think I fundamentally disagree with the notion that we should be afraid of recommending self-hosted services.

Removing self-hosted recommendations or splitting them out of their established categories on the site into a new advanced section does not make sense to me, and it isn't where people are going to look for these solutions. A page in the knowledge base about self-hosting as mentioned at https://github.com/privacyguides/privacyguides.org/discussions/1677#discussioncomment-3449047 could make sense, if we presented it as "these are the considerations and risks to self-hosting" objectively, without passing judgement on whether or not people should self-host things (which I think we should leave as a decision to the reader).

[dngray]

I will say I agree on this.

[ph00lt0]

This generally sounds like a good idea. I just hope people will read it. Might be good to refer people towards it at self-hosted options.

[matchboxbananasynergy]

A page in the knowledge base about self-hosting as mentioned at https://github.com/privacyguides/privacyguides.org/discussions/1677#discussioncomment-3449047 could make sense, if we presented it as "these are the considerations and risks to self-hosting" objectively, without passing judgement on whether or not people should self-host things (which I think we should leave as a decision to the reader).

This sounds like a great compromise between both points of view. I'm in favor.

[jonaharagon]

Approved this for a PR in #1686.