Personal vs. Work/Free Server?

akutz asks: "I am sure many of you have asked yourselves this question before: do I run my own server, or take advantage of my employer's hardware and/or free online hosts? I recently brought my own personal server online that provides web, e-mail, source control, and directory services for myself. I like the warm snuggly feeling that all my data is on my box and it is mine, mine, mine. However, I have also just burdened myself with maintaining a server when my employer, The University of Texas at Austin, has plenty of servers that I could use for this very purpose. There are also plenty of free services online that do this, such as Gmail and Sourceforge. So the question is, which is better, running your own server or letting someone else do it for you?"

Comments

Depends on who it's for

[andy753421]

If it's just my stuff I prefer to run my own, mostly for the learning experience. However if I'm hosting things that a lot of other people use I think it's better to have a company host it. They generally have better uptime, and if they do go down, the blame isn't on me :)

employee handbook

[spoonyfork]

Check the terms of your employment before setting up shop on your company's hardware. Typically business frown on personal use of company resources. Worse, they pretty much pwn whatever is on them.. including your brilliant ideas squirreled away between email love letters and Mexican vacation photos. Roll your own or find a reliable hosting service.

Re:employee handbook

[statemachine]

This is excellent advice. However, I would go one step further:

Keep all your personal stuff off company computers.

The submitter is correct in keeping his personal items on his own server that he can pack up on a moment's notice. This cuts down on any potential administrative conflicts.

Also keep in mind that your data is flowing over your company's network, so don't be surprised if any non-public connection gets sniffed at some point by a bored admin.

It's better to just keep your computer away from the company you work for, in general, but I know outside hosting or co-location costs money.

Remember, any data on your company's network or servers is theirs, so if you don't feel comfortable with them knowing your personal issues, store your data elsewhere. Even just having a separate computer doesn't stop them from accidentally taking it (or worse).

Think this is paranoia? Consider that the law is on your employer's side. Is it worth it?

Re:employee handbook

[tverbeek]

Don't count on the employee handbook to tell you whether it's OK.

Back in '95, I set up a web site on my desktop machine at the college where I worked. Nothing bandwidth-intensive, just playing around with HTML, publishing info about myself and things I'd written, etc. My boss knew I was doing it, and didn't particularly care. The only person directly affected by it was me (and even running on Win31 for the first several months, I rarely noticed any performance problems).

But the site somehow came to the attention of the upper administration, and some of the material on it did not meet with their {ahem} moral approval. (No, I wasn't running a pr0n site; I'd be rich by now if that were the case. But I was openly gay and had some erotic drawings on the site.) By the end of the day, I found myself in a conversation in which it was suggested that I resign.

Believe me: there was nothing in the employee handbook about what I'd done. There were no disciplinary policies or procedures involved. "At will" employment (which describes the jobs most of us have) doesn't require anything of the sort. All it requires is someone in authority saying "get rid of him". In retrospect, I can say that storing my personal files like this on a college-owned machine was the one of most bone-headed things I've ever done.

After that incident, I briefly tried commercial hosting, but quickly ran into problems with my provider that left me thinking "I can do it better than this". So I got me an ISDN line, installed Red Hat 6 on a spare Pentium box, and never looked back. OK, I admit: When the web server periodically locks up for no apparent reason, or the power goes out for several hours and the portable generator won't start, or a configuration oversight gets my mail server blacklisted as an open proxy, etc. I find myself wondering why the hell I'm trying to do this myself. But the feeling of self-sufficiency, the freedom and power of root access on everything, and the incredible learning experience of doing it all myself keeps persuading me that it's worth it.

It's also made me all the more valuable to the (entirely different) college where I work today. Where I'm careful not to use college resources for anything personal.

Re:employee handbook

[Fishin76]

Since I work for a Global Company in a information Security postion, I may a few insights to add. Statemachine talked about your information on company assets and how that information is now theirs. The reverse can be true also. If you brought in your own machine and put company data on it, theoretically, that machine belongs to the company. As we all know, even deleted, overwitten, zero-ed out data can be recovered (with different levels of labor respectively) from hard drives and other mediums. Companies will not and should not let you take your personal machines out of the building. This represents a avoidable risk to that companies intellectual property and corperate information. Email, files, software, and any other electronic communications methods that you use and/or provided by your company are theirs. This includes Cell phone converasations on company cell phones.

              Most companies indemnify their employees. In other words, you, personally, would not get sued for an illegal act to commit fraud against customers using company assets. The company would. But, you would probably get fired in attemptng to settle the lawsuit.

A few things to remember:

      PC does not mean Personal computer. It means Property of your Company.

      Keeping Personal data on company assets is a big NO-NO.

      Keeping Company Data on personal assets is a big NO-NO.

      If you need something to do your job better, ask your company first.

      If you need to bring in an asset you own, get permission and know the rules.

And the number one thing you can do: USE COMMON SENSE.

I know not every company follows these rules, mine does. They make sense, allbeit, sometimes difficult to follow.

CYA is a very good thing. If your using the CYA methodology, your already following the rules.

The question is...

[grub]

... are you a geek or an end user?

ISP port blocking

[Mr_Tulip]

If you host it yourself, make sure taht your ISP has no plans to block the port(s) you plan to use for the servers.
There seem to be a lot ISP now, at least here in Australia, who routinely block port 80, 25 and a host of others.

Host your own if you can

[cli_man]

If you have the ability and it is not costing you much or anything host your own.

I hosted my stuff at my previous employers and it worked great for a couple of years and then our relationship turned sour overnight and I lost about 3 years of work, I had backups but most of them were where I worked, what I did have backups of on my own was outdated etc.

Running your server is more than warm fuzzies, you can do what you want without anyone looking over your shoulder, plus the experience you gain from it could very well be stuff that could be used on a resume or talked about during a job interview. Much of what landed my current job came from the fact I was my own server admin.

Re:Host your own if you can

[Antique Geekmeister]

If work can tolereate it, do it at work because you can test out features that work is not ready for yet. New OS's, webserver software, new content management features, new databases, they can all be tested out on a work-sponsored playspace in a way that would never be permitted on a core server. Then you can turn around and integrate those features into your work services with some practice and some debugging in hand before possibly slapping down a core server.

My thoughts on the issue

[green pizza]

I debated this very same issue, you can read my thought on it at my homepage:

http://www.cocacola.com/~robert

easy

[Call Me Black Cloud]

It's time to choose:

a) If you like the challenge of configuring, securing, and running a server, do it yourself.

b) If you just need to use a server and you get what you want...security, access, uptime...somewhere else for free (or at a reasonable cost), then let someone else do it.

Employment goes away - have a backup plan

[billstewart]

Over a decade ago, before all the non-techies had acquired email and when ISPs were still a novel thing, a friend of mine postulated that you should _never_ have your primary personal email contact be your employer, because if you lose that job you've just lost your social contacts and the contact information that potential employers might use to reach you (at least for the kinds of employers that techies want to work for.) He set up a server in his bedroom which he gave friends accounts on to subsidize his bandwidth addiction, and it's since grown into a respectable-sized ISP with several full-time employees.

Normal employment can change policies or downsize, but universities are an especially fickle environment - many of them have policies making it easy for students to have websites, and some of them have strong academic-freedom policies about your rights to posting content, but other universities change policies when they change bureaucrats, and some of them occasionally go full-blast wacko shutdown-and-expel-you no-due-process mode when somebody complains about H4CK3RZ or when some application suddenly sucks down 98% of the school's firewall bandwidth, or when the RIAA/MPAA hands them a complaint about EVIL FILE SHARING CRIMINALS, especially if the complaint gets handed to an organizationally incorrect person who doesn't get it (at some universities, that's the legal department, at others it's a random grunt in the computer management; it varies a lot.) It wouldn't happen at MIT, but it's standard operating procedure at many state universities, and I don't know about UT.

So if you're going to use a university server, make sure than not only is it ok under the official policies, but that you have automatically-updating backups to your off-campus home computer.

Re:Employment goes away - have a backup plan

[cli_man]

Also while your at it, make sure to buy your own domain and use that for your email, domains are almost free these days. So when the campus shuts off your access and throughs you off the grounds your backups won't do you much good when nobody reconizes your email address when you try to contact them again.

Your online identity is precious, most of the people I know online I know mostly by their email address, if someone shows up anouncing some great story about losing their email address and they really are who they say they are and can we continue where we left off with such and such big deal we were working on I would really hesitate and have to work my trust back up again.

Re:Employment goes away - have a backup plan

[munpfazy]

I can certainly see the advantage of using a personal domain for email. In particular, using a domain that isn't your isp is a must. I've known people trapped for years with a terrible ISP by the enormous amount of work required to change addresses.

But, it could also lead to serious trouble if your operational identity is closely tied to the where you work. If you're communicating with someone as a representative of your institution (or using your association with the institution to try to get something done that would be otherwise difficult), starting off with a homebrew email domain is risky.

For an academic, it strikes me as a particularly dangerous. Just imagine what your first thought would be if you received a cold letter from "Professor John Smith ". I'd guess that it won't be, "Oh, that must be that guy with a beard I chatted with at a conference last year." More likely is something along the lines of, "Is this spam? Some crank? Should I bother to open it to investigate?"

In a world where most email isn't worth reading and most people get too much of the stuff that is, it is a good idea to make your headers as obviously legitimate as possible. For an academic who probably has a fixed term of many years and can expect months of notice before an account is cancelled, changing addresses isn't really a huge problem.

Adding a personal address for friends and family can't hurt. But, if you're like me, the distinction between friends and colleagues is often imprecise. Even when it's not, juggling two different from-addresses and remembering who gets which is a pain.

Administering your own machine within your workplace may be a decent compromise, although you could lose your transitional buffer that way. Convincing your workplace to let you set up a .forward file and leave your account intact (if inaccessible to logins) for a few months is going to be a lot easier than convincing them to leave a personal machine running.

Re:Employment goes away - have a backup plan

[munpfazy]

Doh! That should have said,

"Professor John Smith <jsmith@somewackydomain.com>"

Didn't realize the tags would get eaten even when posting in plain text. (Clearly this is some new definition of "plain old text" of which I was not previously aware...)

My own reliability stinks

[Wespionage]

In general, I think that managing your own server is a great way to go for things like this -- there are other issues of responsibility that come into play when using your company/institution to host it for you. But if you're going to rely on any of the services you set up for yourself while also treating the box like a bit of a toy (or at least a minor concern), then be prepared to have decent backup services in place for anything that becomes important to you.

I've been running a personal server now for about three years, primarily for web/email services with a few other things. I approached it as though it would be a little box to tinker on. But as I've come to rely on the services more -- particularly email -- I find that relying on my own availability and attentiveness isn't as carefree as I had thought. Most things on the machine are easily trashed/rebuilt/restored, but I rely too heavily on the email accounts handled by the machine so each time I hose the machine or just feel like starting fresh, it is becoming more of a hassle without also having a backup mail server in place.

Requirements?

[Morty]

So, what are your requirements?

• Do you need the server to be up 24x7, or is some amount of downtime acceptable?
  
  
• Do you mind rebuilding your server when you change jobs?
  
  
• Do you mind rebuilding your server when you change hosting providers?
  
  
• What budget do you need to stay under?
  
  
• Do you have time to perform backups, routine software upgrades, and other maintenance?
  
  
• If your backups are in someone else's hands, will you want to perform periodic secondary backups in case their backups become inaccessible to you?
  
  
• How much do you want to learn, vs. having it Just Work?
  
  
• Will your employer get pissed off at you if you use your company's resources?
  
  
• How much bandwidth, CPU, and other resources do you need?
  
  
• Do you want physical access to the server, or is some virtual setup good enough?
  

This is a multivariable optimization problem. There is no right answer for all circumstances. Which is why some people host their own sites, some host at their employers' sites, some use colocated servers, some use virtual servers, etc.

Hosting work/personal

[topham]

The company I work for would have no technical difficulty hosting my personal website. In many ways they would probably encourage me to do it, as I can use it to gain experience outside of what I do on a day to day basis for the company.

But even if they suggested it I wouldn't do it lightly.

I would rather pay for hosting service and know that if I lost my job tomorrow I would still have the website and domain.

I know that anything I do on the website is mine. I don't use their tools, or their time to maintain it. If, for some reason, they decided they owned something on my website I could, in good faith fight for my rights to keep it as mine. They would have to fight to take it from me, I wouldn't have to fight to get it back.

Keep your homelife, and your worklife separate.

Simple

[Fishbulb]

Who do you trust?

(this coming from someone who still has an answering machine)

thanks for the responses!

[akutz]

I appreciate all your comments, truly. For the curious, here is my setup at home. I have a 10mbps Fiber connection to my home courtesy of Grande Communications. I happen to rent a duplex in a well-to-do neighborhood of Austin where my wife and I could never afford to actually buy, but the nice side-effect of renting here is that the Austin president of Grande lives in the same neighborhood making this area the first one with fiber to the doorstep :) Oh, and I pay for 3mbps! double-:)

My server is a P4-2.8ghz 83G5 Shuttle with 2GB of RAM. It runs Ubuntu Linux 5.10 Breezy Badger. All this setup does is run SSH (pubkey auth only ) and Apache2 with WebDav enabled so I can access my home directory from afar with ease. Oh, and I require client certificates to talk to my WebDav share for security.

On top of this though I run VMware GSX server. I run a virtual instance of Breezy that is my web/e-mail/ldap/svn server. The beauty of it being virtual is that if I ever need to move it I just move the directory to another machine! Since the VM was created under VMware GSX 3.2.1 I can easily move it into ESX 2.5 or VMware Workstation 5.5.1 (legacy mode). I went this route specifically in case of the need to migrate the server. I also run a virtual instance of Windows 2003 Server Enterprise and Exchange 2003 for testing code and projects on Windows.

I like running my own server, it teaches me a lot, and I feel that I have the minimum amount of competence to pull it off. That said, there are times when I would love to just give it to somebody to run for me!

P.S. I was using Lunarpages, but I got to the point when I decided that I needed shell access to much. However, Lunarpages is a spectacular hosting company and their support turnaround is second to none. Withing 2 hours on the weekends! Those guys rock!

Dumb story, but...

[Gherald]

Q. Which is better, running your own server or letting someone else do it for you?

A. Letting someone else do it for you, and rsyncing daily to your own server.

You Are Responsible for Security

[yancey]

I'm guessing you have already considered the relevant University of Texas System polices, the Office of General Council Ethics Standards, and the ITS Policies. Sorry, I work for another Texas university. :-) Universities tend to be generous and tolerant of a personal computer on their network so long as it does not interfere with your work, does not violate any laws or policies, and does not interfere in any way with the network or other computing systems.

With that in mind, know that you and only you are responsible for the security of your computer and that you will be held responsible for any undesireable activity coming from your computer. If someone were to manage to compromise your computer and then attempt to compromise other university systems, you will at least be held responsible for not securing your own system, if not held responsible for anything coming from your computer -- or through it. If you are quite certain that you can keep your computer secure, then by all means run your own server and learn as much as possible. It's best not to experiment with production university systems. Besides, one could argue that using university-owned systems for your own purposes is a violation of the ethics policy. However, using your personal computer on the university network is no different than any student using a laptop.

Running Servers on University Boxes in Ohio (FYI)

[Ohio Calvinist]

Just as an FYI, here in Ohio (as it was explained to me by my HR contact), it is illegal to profit from State owned (e.g. public university) resources such as IT equipment, vehicle, telephone, e-mail box, etc. (ORC 102.04) For example, forwaring "you@yourbiz.com" to the University Central Mail system and making personal business transactions, is (at the opinion of the University) a violation of (ORC 102.02) If what you are doing is of "academic or not-for-profit" interest, it's up to the IT folks/university lawyers what they construe as "within the academic mission of the university." The problem comes when your friend of a friend's boss asks if you'll host his stuff for $juicy_sum_of_money, and you risk it or need to get a 3rd party host if you want to get his business anyway,. You also have to worry about hosting content for a social/political group whom the university (or mid-tier sysadmin) doesn't want on the subnet, you're in a real pickle.

List of personal colocation providers

[ziegast]

I don't host anything of my own at work. Take a look at the Personal Co-location Registry. You'll find a bunch of inexpensive providers for your servers or apps.

shared server

[np_bernstein]

Uhm, have you looked around to see how much it costs to get your web/mail/databases hosted? It's cheap as hell. I started at 2.95/month a few years ago, and now I pay a whopping $9/month. Maybe I'm just insane, but I would *never* consider hosting my stuff at an employer's work, even if they were OK with it and I had no plans of leaving ever. It's just shady. What if your php script that you just threw together playing around and that didn't go through QA had a hole in it and your server got compromized... or whatever.

Leave work at work and home at home,
Nick