Cover the choices and considerations in choosing a specific Rented Server (VPS, VDS, etc).
Cover choices in choosing a domain name registrar, and different types of services
Proposal
Create a new topic in the Advanced Section named something like Hosting Software through Rented Servers
Create a new topic in the Advanced Section named something like Choosing a Domain Name Registrar
[OPTIONAL] Create a new topic in the Advanced Section named something like Hosting Software through your own Server [SELF-HOSTING]
Context
At this time, PG is quite focused on technology that can be directly used to mitigate privacy issues. However, PG doesn’t seem to have focus on those who deploy applications. This topic is typically reserved for developers who are deploying applications.
This is useful as users may wish to deploy privacy front ends, but may end up not choosing technologies that conceal their own privacy while assisting others. Specifically, this applies to me wanting to deploy services, but I don’t know where I should rent from and what registrars would be good to choose, along with their pros/cons and what choices to consider.
Good criteria, these should be the minimum. I think the .onion service is more a “nice to have”, but at least the provider shouldn’t block Tor and VPN users.
I think the hardest one will be the domain registration, because normally you have to register it in your name. Then there’s some providers like Njalla who register your domain in their name to keep your anonymity, but that one in particular is unprofessional and against free speech so I wouldn’t trust them to not steal the domain and shut it down.
There’s IncogNET as an alternative to Njalla for anonymous proxy domain registration.
I would also like to see some known attack vectors mentioned in the guide when using VPSs. For example, when using disk encryption, they can pull the encryption key while in RAM and decrypt your VM instance.
This is getting into security. I think this information is only important to include if it’s tied to different privacy choices. If the security considerations apply to all VPS servers, it’s outside of scope of a privacy guide. Not to say it isn’t important, but the scope of OpSec is a lot longer than what a privacy guide may have.
For sake of argument, let’s assume we should have an OpSec guide for hardening a server. That is still an entirely separate discussion from choosing a privacy respecting VPS vendor and domain name registrar, which is what I’m proposing in this thread.
If we wish to have an OpSec guide on hardening servers (VPS or otherwise), that belongs to its own dedicated guide. I would suggest making that a separate request from this one so PG can prioritize each differently. If you make the thread I’ll probably vote for it too
@jonah if I were to make a Draft PR, would this help in getting this suggestion up and running? I’d like to help out, but I also don’t want to write up a whole GitHub PR if it would be discarded.
No specific recommendations, perhaps just listing criteria to look for and maybe some “gotchas” for a first draft. I’d say PG is better suited to evaluate specific vendors on a case by case basis.
Then it should be fine. A PR is typically more helpful than a discussion yes.
The guide has to be clear and logical, and it should explain why you are suggesting all the things you are suggesting. The discussion going on here doesn’t really have many details about even what’s going to be suggested, or why the suggestions make sense, so it’s really hard for me to say whether a PR is going to be successful just because I have no data
But if you have ideas and know what you want this to look like and can back those ideas up, then a PR would be great.
I’m just saying that it obviously goes a lot quicker the more you help reviewers and try to preemptively answer our questions. If it’s just a list of stuff that we have to do original research on ourselves to see whether it makes sense, it’s probably going to take a long time. If it’s filled with factual information from the get-go that we only have to double-check, it goes a lot quicker
I would say these three things should be three separate PRs, and probably worth doing one at a time to make sure things are on the right track:
It should also go without saying that we are here to assist with the writing process at any point!
I think recommending VPS providers and domain registrars on a platform like PG is non-trivial, mainly because the selection criteria almost always boil down to the political stance of an individual. It always turns into a debate between free-speech purists and people who don’t believe in free-speech.
The goal of this thread was to garner interest in the general topic. Had I done everything already, I probably would have just opened a PR directly. I just wasn’t sure the right protocol to execute this in a way PG prefers.
It sounds like these threads are to request PG to do the lift, while at any point of time any user can open a PR for review, is that correct?
But with this, I’ll do some more research. I’ll probably need to triage vendors to gain a general idea of what’s best to write for a general article. Thanks again for the clarification.
We do want these threads to exist regardless of who authors the PR, even if I’m going to make a change myself I am still going to create a Site Development post first. So they are not just to request someone on the team to create the PR.
Often times they will get picked up by a team member anyways, yeah, but they can also be picked up by anyone. And on the flip side, there’s no guarantee that a PG team member will open a PR based on forum posts either. Basically everything is done at the discretion of volunteers
This would be a great topic and perfect timing for me. We are about to make decisions around self-hosting some apps in our small business. I would like to have privacy and security focused criteria to make sure the developer implements even if we host with a 3rd party.
