Yes yes, I know all that. The fact remains that a permanent IP associated with an individual is personally identifying information. Even the variety in browser requests counts as such according to the GDPR, and that is usually pooled with lots of other users. This is clearly a level above that. It’s why, for example, I would not use the VPS for proxy web browsing: zero privacy.

In an ideal world, creators would accept that only 10% of their viewers would contribute to them monetarily

Agreed.

(through patreon or donations)

and then you lapse into using “patreon” as if it’s a generic noun!

Not your intention I know, but this kind of corporate capture of minds has to end somehow.

What’s the downside you see from having a static IP address?

What’s the downside to having one’s phone number in the public directory? There’s no security risk and yet plenty of people opt out. It’s personally identifying information.

I don’t know if any companies provide reverse proxies without a CDN though.

Exactly.

You still need encryption between your CDN and your origin, ideally using a proper certificate.

It can be self-signed though, that’s what I’m doing and it’s partly to outsource the TLS maintenance. But the main reason I’m doing it is to get IP privacy. WHOIS domain privacy is fine, but to me it seems pretty sub-optimal for a personal site to be publicly associated with even a permanent IP address. A VPS is meant to be private, it’s in the name. This is something that doesn’t get talked about much. I don’t see any way to achieve this without a CDN, unfortunately.

I guess it’s popular because people already use Github and don’t want to look for other services?

Yes, and the general confusion between Git and Github, and between public things and private things. It’s everywhere today. Another example: saying “my Substack” as if blogging was just invented by this private company. So it’s worse than just laziness IMO. It’s a reflexive trusting of the private over the public.

I have some static sites that I just rsync to my VPS and serve using Nginx. That’s definitely a good option.

Agree. And hard to get security wrong cos no database.

If you want to make it faster by using a CDN and don’t want it to be too hard to set up, you’re going to have to use a CDN service.

Yes but this can just be a drop-in frontend for the VPS. Point the domain to Cloudflare and tell only Cloudflare where to find the site. This provides IP privacy and also TLS without having to deal with LetsEncrypt. It’s not ideal because… Cloudflare… but at least you’re using standard web tools. To ditch Cloudflare you just unplug them at the domain and you still have a website.

Perhaps its irrational but I’m bothered by how many people seem to think that Github Pages is the only way to host a static website. I know that’s not your case.

This is a bit fuzzy. You seem to recommend a VPS but then suggest a bunch of page-hosting platforms.

If someone is using a static site generator, then they’re already running a web server, even if it’s on localhost. The friction of moving the webserver to the VPS is basically zero, and that way they’re not worsening the web’s corporate centralization problem.

I host my sites on a VPS. Better internet connection and uptime, and you can get pretty good VPSes for less than $40/year.

I preferred this advice.

This whole subject is such a chestnut here. No messaging option is perfect, you will need to compromise. If a perfect option existed you would have heard of it already. And if you haven’t heard of it, then by definition it must be small with few users and even fewer maintainers to keep an eye on its codebase and security, which is risky in itself.

Cynicism is a self-fulfilling prophesy.

Can recommend Hetzner (German IP). Good value and so far solid.

Before that I used OVH (French IP) for years but it ended badly. First they locked me out of my account for violating 2FA which I had not asked for or been told about, and would not provide any recourse except sending them a literal signed paper letter, which I had to do twice because the first one they ignored. A nightmare which went on for weeks. And then, cherry on the cake, my VPS literally went up in smoke when their Strasbourg data center burned down! Oops! Looks like your VPS is gone, sorry about that, here’s a voucher for six months free hosting! Months later they discovered a backup but the damage was done. Never again.

This doesn’t really compute. Society would collapse if nobody trusted “third parties”, and your second phrase is just hyperbole.

It’s more complex than that. The issue is money, and incentives, and how power is structured. A third party that you are paying or whose income is uncoupled to the profit motive, and preferably one that has both private and institutional stakeholders - well, if we choose not to trust them, then basically we can’t trust anyone for anything. That would be a dark place to be.

That’s why I emphasized the word “server”

E2EE with a server web interface is a technical impossibility. The ends are the clients. By definition the server is only there to pass encrypted data from client to client. Presumably you can make this work with a web client using the browser’s local storage, but at that point you’re not actually looking at a web site and you might as well just use the official app. This is one reason why Telegram doesn’t do encryption by default: group chats are particularly hard to do with EE2E.

Possibly unsolvable given its distributed nature. Seems like there will be at least some small cost to pay for that benefit.

Decent counter-example. In turn I’d say that’s an edge case where we could still survive just fine without knowing the relevant fact for sure. And certainly not worth the cost in privacy terms of recording and storing everything.

Completely agree! The ephemerality of Signal is a feature, not a bug.

I didn’t always see it this way, but then a thought occurred to me. None of the conversations we have in person are recorded. Those communications are just as meaningful if not more so than text conversations, and yet somehow we get by just fine without them being stored indefinitely on some personal device, let alone in someone else’s datacenter.

This is a case of technology controlling us when we should be controlling it.

Who do you talk to on it?

All completely irrelevant to most people. Nobody they know is on those platforms.

There are only two alternatives to the Big Tech messengers that are anywhere near critical mass: Signal and the shady one we’re talking about here.

Though I would love Matrix to go mainstream.

If you don’t mind going full back-to-basics, you can do this with standard command-line tools and no cloud server. Contrary to popular wisdom, a server is not necessary to sync files between a computer and a mobile device.

I use ssh and unison over wifi hotspot, no cable required. Works fine though it does require a button to be pressed. It doesn’t sync constantly in the background. Personally, after many years of doing that, I decided that it was an anti-feature.

Disappointing that the top comment is this dismissive take (whether or not it’s factually true).

If the best response we can muster is cynicism, we’ll get what we deserve.

Yes it looks a bit like the Twitter-Mastodon paradigm. Nobody uses it because nobody uses it. And also because changing is hard. And also because the installation and UX is bad. Which is partly because not enough people are using it.