2

In order for users of my software to receive auto-updates, their copy of the software will need remote access to ~100mb of private files (manifest, jars) which means I need a server. Currently I don't have any customer so was thinking about shared hosting, but I've read in numerous Terms of Service that file storage is not allowed on shared hosts, but only files which relate to the hosted website and all files must be available to the public.

Although I do need a website as well it seems I must look elsewhere to store the private "repository" of project artifacts which the auto-updater requires. I'd prefer to not have to purchase one host for my website, and another for storing artifacts.

Can you recommend an approach? I'm leaning toward a reputable shared host for my website, and perhaps a cheap VPS to host the artifacts? I'm talking about only 100mb of private files (for now). Or perhaps I could something like Sync which offers 5GB free, or Amazon S3 -- and then somehow link my domain to it?

The host/provider should be responsible for ensuring uptime and security, as my limited knowledge is certainly inferior.

  • How will you secure the content that is on Sync? – Robert Harvey Sep 19 '16 at 1:18
  • I was hoping Sync took care of that, but further reading may suggest otherwise. I've updated the question to include my requirement for the host/provider to ensure security instead of myself. I've come across Amazon S3 too, which seems flexible and secure. I'm open to any suggestions – MM88 Sep 19 '16 at 1:26
  • I would certainly use something that is specifically designed for what you want to do. If Amazon S3 will host your files for you securely, that certainly beats Sync, which has a different purpose. – Robert Harvey Sep 19 '16 at 2:26
1

There are a few options:

  • rent a VPS (or a dedicated): this requires server side code, know how, monitoring and maintenance
  • ask the user creditentials for a google drive, dropbox (or whatever) account and store it there: quite handy, but the user needs a third party account and you have to do some plumbing in the app
  • use some third party storage service: dunno what the best fit would be here. Ideally something with sub-accounts per user.

And a few more hints:

  • avoid to use something that shares the same "access key" for all users, as you risk exposing the data of all users if someone gets it (by sniffing the network, decompiling the code or whatever).
  • ...or at least encrypt the data with some use specific secret
  • If security is really an important issue, third party hosting services like google drive and dropbox aren't a good alternative to a VPS or running your own server. (the last having the most potential of being secure) – Timothy Groote Nov 18 '16 at 9:47
  • @TimothyGroote: ...I wouldn't be so sure. Google drive and Dropbox will be readable by the NSA. However, running your own VPS requires constant effort and expertise to not be hacked. Are your libs correctly configured? Up-to-date? Have you installed the patch XYZ in time? What about SSL? DDOS? XSS? CSFR? Do your read vulnerability reports daily? ...it's easy to leave a loophole open, especially if you're a solo developer. Every day, VPS and webapps get hacked. Google and Dropbox have experts working round the clock to avoid these issues. Doing so yourself requires a lot of time and expertise. – dagnelies Nov 21 '16 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.