How much effort is worth spending on a "perfect webserver for whonix.org"?

[Patrick]

@Mycobee

• potential reputational loss if a hack occurs. I am not a terrible sysadmin by any means, but I am a human and much more specialized on infra automation as my day job. Security is something I have learned a good bit, but could still spend a lifetime and not know it all. I could make a mistake, a hack would be embarrassing to the project.

Another great point I wish I had in mind when writing above bullet points. Self-hosting doesn’t have good incentive structures.

• If all goes well, it’s invisible effort.
• If it gets hacked, it’s probably resulting in FUD (related: Placing Trust in Whonix ™ chapter Server Security in Whonix wiki) and ridicule.
• If using third-party hosting such as github and github gets hacked, then it’s just a third party that got hacked and the reputation of the project that was using github remains stainless.

Even security experts don’t claim that they can absolutely secure a webserver / webapps form ever getting hacked. Usually the more of a security expert they are, the more modest they are, the more careful they are to avoid making bold claims of something being secure.

@Mycobee

@grass

Sad to see TPO doing that,

You could donate $100,000 every year for them to have a full time experienced SysAdmin in charge of the task lol

If that would even be enough money to avoid full database losses every other year.