Hacker News

points by Gigachad 1 day ago | 0 comments

At this point if you are self hosting you should have everything behind a VPN. Only companies with their own security and development teams should be putting things on the public internet.

[–] jamesfinlayson 1 day ago

Gosh I'm at a big company and I'm pretty sure all the self-hosted tools are only accessible through VPN-like tech anyway. The only truly public stuff is Jira, Confluence (which I assume it more to do with Atlassian's pricing of self-hosted) and Sharepoint.

[–] Operyl 1 day ago

Atlassian products (Jira Server) are no longer supported, and their more Enterprise offering dies in 2029, so everything is ending up in their cloud now yeah.

[–] wtch98 19 hours ago

We've just moved from on-prem (protected by MTLS) to on-cloud because of this. I now know why everyone hates jira. The cloud version is so much worse

[–] FuriouslyAdrift 17 hours ago

If you're a Microsoft shop, you can put just about anything behind Microsoft Entra Application Proxy (and also support SSO).

https://learn.microsoft.com/en-us/entra/identity/app-proxy/o...

[–] wtch98 16 hours ago

Or I can (and do) use something good. That doesn't change the fact atlasian no longer support on prem jira.

[–] egeozcan 1 day ago

I know a lot of companies vibe-coding alternatives. I'm not an expert but it's perhaps even illegal for most European companies to migrate any customer data to Atlassian servers.

[–] StableAlkyne 1 day ago

This is something I keep struggling with.

If someone wants to vibe code an alternative to a SaaS tool, my gut feeling is "no, this is bad and it will blow up" as vibe-coded projects tend to do.

But then the alternative is often paying $X million per year for licenses to a half-assed program that hasn't had a UI update since 2005.

I just don't have a good argument on why they shouldn't when the outcome will be just as dogshit, only cheaper and flashier.

[–] ozim 1 day ago

They just started updating the UI and I am pissed off.

I don’t want them to change UI. I have plenty of work to do and have plenty of other tools that I use daily.

I have my workflows, I am swamped with work and now I have to change my workflows because someone changed options in UI where ones that O used are not there anymore.

[–] IlanGR 21 hours ago

I think there's ways to have a solid app by giving ai precise instruction about the architecture it has to follow. Especially by configuring read-only agent for security and quality and builder agents for everything else. It isn't perfect and I wouldn't do critical apps for a company with it but it's solid enough to replace a SaaS tool in my opinion. I think the real subject is wether this vibe-coder knows he'll have to maintain his app...

[–] unrented7977 15 hours ago

I'd pay embarrassing amounts of money for applications which do not get biweekly UI overhauls.

I'm still using the 2024 version of JetBrains IDEs because the UI hadn't changed in over ten years. I quit paying JetBrains when they ripped out the perfectly functional UI and replaced it with a VSCode reskin.

Please, for the love of god, give me software with a consistent UI.

[–] gokulravi992 1 day ago

The argument I'd make isn't about UI or features, it's about who owns security afterwards. The vendor has people whose whole job is patching things like this Ruby regex issue. The internal vibe-coded Jira usually has nobody, and the bugs that bite are boring ones, like a project page that loads for anyone who guesses the ID.

If they go ahead anyway, the ask is just that someone actually owns it after launch, not only builds it.

[–] ozim 1 day ago

Atlassian migrated EU data to EU based servers. I still had to click approve but they did that for me.

[–] egeozcan 1 day ago

Atlassian is a US-parented company and this means that CLOUD act can affect it. Even this only can make it unsuitable. Then there are questions to data-in-transit. Also nothing is legally tested. Vibe-coding an alternative is much safer if you have sensitive customer data (even simple support tickets).

[–] input_sh 1 day ago

Not that this matters in terms of the CLOUD Act, but it's actually an Australian company based in Sydney.

[–] egeozcan 23 hours ago

As far as I know the ultimate (as in, when you follow the chain) holding company is from Delaware.

[–] ozim 18 hours ago

Going with this idea further basically all data goes via Microsoft one way or another.

[–] usrnm 1 day ago

The location of the servers matters only if you're trying to prevent physical access, for anything else it's completely irrelevant

[–] griffiths 1 day ago

Can you give more information on "illegal for most European companies" part? Asking for a EU company using Jira :)

[–] Sebguer 1 day ago

This person is just posting absolutely baseless claims, as if Atlassian, a company that basically exists purely on the back of B2B SaaS sales, has not considered EU data residency requirements in their core product offering: https://www.atlassian.com/software/data-residency

[–] dijit 23 hours ago

FWIW nearly every SaaS or IaaS is making bold claims about supporting data sovereignty, but unless it has been challenged in court I wouldn’t put much stock into it.

The fact that Jira/Confluence are being processed by their LLMs puts them in direct legal conflict with several statutes in the EU, its a matter of time for them to get hit by this and I’m betting that they think the fine will be lower than the revenue they acquire for doing it- and they’re hoping they don’t get hit at all.

This seems to be the common case for a lot of the non-EU tech companies, and it seems to be working.

Oracle is currently the market leader in “sovereign” compute for EU governments for example, as ironic as that is.

[–] egeozcan 1 day ago

> This person is just posting absolutely baseless claims

You don't need to be so hostile. I know about the EU requirements but many EU companies have sensitive data on hosted JIRA / Confluence that simply cannot be in the possession of a non-European company. I know because I'm working for one. I cannot even remote-work from outside Europe. Some stuff cannot even leave the VPN. There's also the CLOUD act.

[–] jamesfinlayson 1 day ago

Yeah I thought Jira at least was all built on AWS these days. I've never set up a Jira Cloud instance but I'd be surprised if you don't chose where your data lives.

[–] kenniskrag 1 day ago

In short gdpr compliant means you can configure it but it must not be compliant by default and also there is no guarantee.

They are constantly changing their software and settings. More than once they believed that something is legal but can be risky for the atlassian customer.

For example training AI on metadata which they believe are anonymized but are maybe not enough changed.

Training data or metadata permisson can not be configured on all subscriptions. But as a data processor they must follow the contract otherwise they become data controller.

Also there are risks associated with privacy data framework, cloud act etc. to be non compliant just by data transfers to other countries.

[–] bombcar 1 day ago

This is how SaaS dies, vibe-coded to death.

I’m doing my part!

[–] tallanvor 19 hours ago

It wasn't long ago that companies like Google were advocating for zero trust networks that avoid the need for VPNs!

[–] dewey 19 hours ago

But what they mean by that was that the application (Gitlab in this case) should be behind a IAP proxy (https://docs.cloud.google.com/iap/docs) or something, not that you just put it on the public internet. Also defined here in the zero trust docs (https://docs.cloud.google.com/architecture/framework/securit...).

[–] midtake 14 hours ago

Zero trust is more like you need strong authentication like FIDO on the webapp even if it's behind the VPN, not that you get rid of defense in depth.

[–] ifwinterco 17 hours ago

Zero trust ≠ publicly accessible.

And zero trust makes sense, once one service behind a VPN is compromised attackers can potentially move laterally, zero trust mitigates that

[–] theamk 18 hours ago

that works too

For personal services, even something as simple as HTTP basic auth on the webserver dramatically reduces the attack surface by blocking all probers and drive-by attacks.