The future of selfhosted services is going to be… Android?
Wait, what?
Think about it. At some point everyone has had an old phone lying around. They are designed to be constantly connected, constantly on… and even have a battery and potentially still a SIM card to survive power outages.
We just need to make it easy to create APK packaged servers that can avoid battery-optimization kills and automatically configure an outbound tunnel like ngrok, zerotrust, etc…
The goal: hosting services like #nextcloud, #syncthing, #mastodon!? should be as easy as installing an APK and leaving an old phone connected to a spare charger / outlet.
It would be tempting to have an optimized ROM, but if self-hosting is meant to become more commonplace, installing an APK should be all that’s needed. #Android can do SSH, VPN and other tunnels without the need for root, so there should be no problem in using tunnels to publicly expose a phone/server in a secure manner.
In regards to the suitability of home-grade broadband, I believe that it should not be a huge problem at least in Europe where home connections are most often unmetered: “At the end of June 2021, 70.2% of EU homes were passed by either FTTP or cable DOCSIS
3.1 networks, i.e. those technologies currently capable of supporting gigabit speeds.”
Source: https://digital-strategy.ec.europa.eu/en/library/broadband-coverage-europe-2021
PS. syncthing actually already has an APK and is easy to use. Although I had to sort out some battery optimization stuff, it’s a good example of what should become much more commonplace.
Running web services on a device that hasn’t seen a security patch in 3 years seems like a bad idea.
Also, unless you can mount a real hard drive, you are going to very quickly run into I/O bandwidth issues and flash longevity limits
@RegalPotoo Maybe I should have been more specific in the wording of my title.
No one planning on hosting public multi-user service that would see some serious traffic would probably benefit from hosting on a phone.
Someone who wants to simply run a single-user instance or their personal nextcloud? I think that’s a real possibility.
It’s a really cool idea, and the internet would probably be a better place if more people took ownership of their infrastructure rather than relying on ad-supported “free” services, and it’s easy to criticise an approach that I’ve spent maybe 10 minutes actually thinking about - I’ve got my reservations, but if you can make it work it would be awesome
The risk that @regalpotoo mentioned is still unmitigated though, single user instance or not. At worst, the personal data can be exfiltrated. At best, the server can be used as a part of a botnet. Even if the software (nextcloud) would be patched, that doesn’t help against exploits on a OS level.
Granted, one could run services inside a vpn and have some kind of preventive / monitoring controls, but you’re still need to implement some kind of defense in depth in order to protect it.
It is possible nowadays: I’m hosting quite a few services on an 5 years old Android. Just with Termux, no root required. Of course connectef it’s just to the internal network due to all the security concerns mentioned in the post.
To solve all the bandwidth/connection issues, I’ve bought a usbc-ethernet dongle that works like a charm.
To mitigate battery issues I’ve limited the charging to 85%.
I would never host Jellyfin there, but with webdav and Kodi I can get my media served easily to all my devices at home
I’d also be worried about battery issues
Don’t want to find it having overheated / turned into a pufferfish
Future news headline: “The web server literally exploded under the DDOS attack.”
I mean, android is fine I guess, but it’s being pushed to be less and less able to be separated from Google. I think for a lot of people interested in self hosting, there’s a low amount of interest in it because of that.
@southsamurai Oh that’s definitely a huge concern, but not just for self-hosting but for privacy in general.
But still, if the average joe wants to self-host something using an old phone is probably the easiest way to get them to try self-hosted alternatives and drop corporate / commercial services.
Maybe not the ‘average average joe’ such as my parents, but anyone who is minimally curious enough to do stuff such as registering a domain, setting up a game server for friends and maybe has opened the CMD windows console once or twice in the past following a tutorial. That kind of demographic (IDK if it has a name) might be much more inclined to self-host if it was as easy as installing an APK and letting your phone one somewhere at home.
Overall as long as Android doesn’t become straight out malicious spyware itself, the benefit of dropping commercial alternatives might very well be a net positive. In a worst-case scenario, any tunnel / vpn configuration necessary to expose a service to the internet could also add an automated step to blackhole requests to google’s tracking servers.
IMO, more like Linux. Android for such old devices is unmaintained, but if you’re able to run Linux on it you’ll still be able to apply kernel updates and security updates for software will continue to exist. Many things are opensource too and you should be able to recompile them on the android device to make it run.
PostMarketOS or UBPorts are basically that, but have limited functionality and few hardware options.
Seems like this is a great use-case for an RPi. At least for single/few user setups
Who provides the software and firmware updates for my antique Samsung S4 and Galaxy young?
I hope you will give me some firmware for the old snapdragon.
Don’t forget the loads of Exynos CPUs and loads of GPUs from different vendors.Who provides the software and firmware updates
That’s the fun part. Nobody does.
The future of selfhosted services might includes phones yes, Android most likely not.
Think about it, those phones might work right now but in 10 years their Android versions will not support anything, they wont even have root certificate updates breaking SSL, the kernel will be missing support for whatever people need and whatnot. Maybe the phones won’t even boot because some key will expire somewhere… let alone security vulnerabilities.
People selfhost on 10-year old hardware right now, but they do install modern Linux distros that are well supported and up to date. I believe the most likely scenario is that at some point the “security” of most of that hardware will be broken and you’ll be able to run some version of AOSP for older hardware and/or a generic Linux.
But that might not ever happen, those phones are built like hell and we’ve another category of hardware with similar characteristics that was never repurposed for anything after a decade - routers. It’s common to see older routers that are now too slow when it comes to wifi or even CPU and although they’re way more open and primitive than modern smartphones when it comes to software we usually can’t even repurpose them as dumb switches with alternative / open software. OpenWRT and DD-WRT might work in some case but those are exceptions and usually those models were already supported by those firmwares. For instance there are enough Thomson / Technicolor TG784n ISP provided routers to create a second moon and the effort to break their security and create a usual firmware is so much that nobody did it. It’s just easier to pay 30€ for a cheap router/switch and move on.
People who downvote, care to explain? You clearly never tried to access the Internet / install modern software on a Windows XP computer :)
Am curious. Are you able to run a modern windows 10 virtual machine / virtualbox vm on XP?
I just talking about that: https://lemmy.world/comment/4731273
It doesn’t appear to be possible. The Vmware version that supports the latest Windows 10/11 won’t support a host system older than Windows 8. The same applies to VirtualBox.
The usual issue with that is that the modern OS requires drivers for the virtual devices and if you get a modern version of Vmware it won’t run on Windows XP (https://kb.vmware.com/s/article/90060) if you get an older version of Vmware that does run on XP it won’t have / be compatible with the drivers required for Windows 11 to work.
I have by getting rid of win xp and installing Linux.
@TCB13 I’m not an expert in the matter but I wonder how large the attack surface actually is for a web service that has a single port exposed via a tunnel which can even contribute to doing some security filtering.
The application / server component can actually be updated since it’s just an APK. And someone else in this thread actually linked to whole linux distros that can be installed and run without root. In theory even if the underlying OS is insecure, more secure OSes can be installed on top, or risk can be severely limited by only exposing a single port.
Basically, while flashing a new ROM would be ideal, I think there’s likely a way in which a sandboxed and possibly even updated environment with updated TLS cyphers, CA stores, etc… can be run in a secure manner on top of a stock Android ROM.
Furthermore, developers packaging their apps into APKs could run security checks and by the time it says “your OS is insecure” you’re already on your third phone and can host stuff on your second. I mean… Android phones are in their prime for two/three years at most in my experience :P
The application / server component can actually be updated since it’s just an APK. And someone else in this thread actually linked to whole linux distros that can be installed and run without root. In theory even if the underlying OS is insecure, more secure OSes can be installed on top, or risk can be severely limited by only exposing a single port.
When you install another one “on top” you’re essentially speaking about a very thin layer above the base OS. In most cases that’s simply a container that uses the base OS kernel. This is what happens today and it works for a while but it comes a point (way less than 10 years) when you won’t be able to have a modern top layer OS sitting on such older base OS because the kernel is way too old to support the requirements of the new OS.
Even if go through the trouble of virtualization in order to have the top layer running a modern kernel it will most likely fail. It would require a LOT more effort coding the support for the old hardware and a ton of other virtualization pains to just end with a very slow system. We’ve examples of this: it is next to impossible to virtualize Windows 11 in a Pentium 4 that runs Windows XP, for instance a versions of Vmware that supports Windows 11 won’t support a host system older than Windows 8. The same applies to VirtualBox.
Basically, while flashing a new ROM would be ideal,
Yes it would but for that you would have to completely break the phone’s boot security and that isn’t feasible in all cases. Most phones doesn’t allow you to unlock the bootloader thus you can’t install another ROM/OS. Even on those you can some will only accept software that was signed by the manufacturer so unless there’s a leak of the key they use or it gets bruteforced in some way you won’t be able to do it.
Take older routers as examples, those don’t even protect the firmware, nothing is signed, and yet the time and effort (weeks/months) required to make a simple open firmware to turn a SINGLE model into a dumb switches / routers that it isn’t worth it - after all you can get a < 30€ device today that is faster and more power efficient than those old units.
With phones things are considerable worse as modern day devices are way more locked down than those router ever were. There’s also way more fragmentation (hundreds of phone models all running very specific hardware and software hacks). It’s very likely that in 10 years you’ll be able to buy some ARM / RISC board, such as a raspberry pi, that is open, run a modern OS out of the box and most likely cost you 30€.
The future? No. A useful niche? Sure.
I run 4 mail servers, 2 game servers, 3 directory/auth servers, a firewall/router, a NAS, a security system server, a media server, a monitoring server, and a couple others. Android ain’t gonna cut it.
Big problem: updates for something that is directly exposed to internet
Some low end devices will stop getting security updates 6 months after launch because the OEM launches a new model every two weeks and obviously doesn’t have resources to dedicate to it
In some cases, even high end devices don’t get updates and are discontinued internally shortly after launch, for example the Xiaomi mix 3 5g
Yes, root and custom ROMs could solve the problem, but not as easy as regular Linux where you just use a package manager to update. First issue is needing to wipe after updates and you have to reinstall and reconfigure everything
@Wander @selfhosted this whole “We are walking about with entirely reasonable servers in our pockets for reasonable scales - why doesn’t it feel like that?” thing is in my brain quite a bit.
@benjohn @selfhosted 6-8 GB of RAM with powerful CPU and GPU that was designed to run games and can in some cases run small AI models is nothing to scoff at imho.
@Wander @selfhosted I have conversations with peers where they talk about “servers” and “computers” as if they figure them as quite distinct things.
@selfhosted Update:
- Just to clarify, the the whole point is that Android makes it easy for less tech oriented people to host small single user / family services.
It does not need to be perfect, have massive throughput or allow for massive amounts of read/write cycles.
If people can host their own media server like Jellyfin or note taking apps like Joplin instead of using commercial services by simply installing an APK on an old phone they can leave connected at home, that’s already a big win.
- Regarding device longevity, Android 13 apparently supports / will support full KVM emulation. Windows can be run if you have root while android based VMs are expected to be possible without the need for root. Since this type of virtualization allows VMs to run their own kernel, keeping the “server app” updated should allow the user to be protected even if the host OS is outdated as long as these server-app-VMs are trustworthy themselves.
deleted by creator
@leggylav @selfhosted OMG, yes, thank you <3
I finally feel understood now :vlpn_cry:
deleted by creator
I feel like Android is adding some new power saving “feature” with every version to kill all the useful stuff I want to keep running in the background.
Last stupid thing I remember was when it removed my CalDAV synchronisation because I haven’t been “using” the CalDAV app for some months.
Not to mention all the times it decides to kill something you want to use because it thinks the RAM would be more needed elsewhere. Honestly my 128 MB RAM Nokia N900 could run more apps at the same time than my 4 GB RAM Fairphone.
Thanks for the monthly reminder to open DavX5 🤣
Just use raspberry pis and Linux. You’ll have better support.
Then ditch the raspberry pi and get an sff PC that has an x86 processor in it.
Pass, I’ll take the cluster of raspberry pis for the same cost… For the purpose of self hosting my cluster is going to out perform your x86. Like why are you going to spend hundreds of dollars for an x86 that will do fine when you can spend $50 for a pi that will also do fine?
Then you can just cluster those pis and get redundancy
You’ve got it backwards, a small x86 box is more cost effective for better performance. With a raspberry pi you’re paying for the form factor (and often scarcity)
You’ve got it backwards. A small x86 is a hundreds, and a rpi is 50… Like come on… Cost for performance isn’t even a question…
Y’all… I thought you’d be better at tech than Reddit… this is sad
You can get a wyse thin client on eBay for $50, and if you’re clustering the pis it’s not $50 anymore, so you can get a real computer on woot in the $150 range.
Either of those options will run circles around a pi/pi cluster.
holy shit I haven’t thought about that webside in over a decade. Do you have personal experience purchasing self hosting stuff from there?
I’ve bought a couple old SFF PCs and tablets from there for low powered workstation stuff.
For self hosting I end up with rack mount dell servers when the prices fall off a cliff; right now it’s the 13th gen stuff that’s super cheap.
Please learn to read. Again. I thought I wasn’t on Reddit anymore.
$50 for a pi. Not for clustering. For one. That’s it.
An X86 PC is gonna cost you hundreds. That’s how I can cluster rpi, for the same cost. I hope you now know how to do basic math.
Insulting my reading ability and math skills would work better if you weren’t making a fool of yourself.
I gave you an example of a $50 x86 PC and mentioned the more expensive options because you brought up building a pi cluster in your first response to me, at which point you’re not talking about spending $50 anymore.
The main point is that either the thin client or the slightly more expensive computer will runs circles around your pi(s) for the same price.
@Wander @selfhosted also, don’t forget that it’s easy enough to run Linux on Android: https://f-droid.org/en/packages/tech.ula/
@ahoyboyhoy @selfhosted Nice. I remember trying it out once. Actually I might use that to follow my own advice and self-host at home once I retire my current phone.
True, I haven’t had the need because I know how to run stuff on a server, but for personal files it’s probably better to host things at home.
I’ve already heard of people using Termux to host services on their old phones. Seems to work well.
Think about it, those phones might work right now but in 10 years their Android versions will not support anything, they wont even have root certificate updates breaking SSL, the kernel will be missing support for whatever people need and whatnot. Maybe the phones won’t even boot because some key will expire somewhere… let alone security vulnerabilities.
in 10 years? Is that a big deal? I’ve never had a single computer for 10 years.
deleted by creator
Just look at the past, software and hardware as way simpler and way less locked down and it doesn’t work out. Just try to use a Windows XP to access the Internet and/or install modern software.
deleted by creator
All you have to do is look at the present… Android phones don’t have super long software support. Best you’re looking at is maybe 5 years. So, the user saying 10 years is well past that mark.
Looking at the present, I’m not aware of android devices not booting 10 years after they were released. In fact, my 2013 MotoX is still a perfectly usable phone for many purposes. I had to use it for a few weeks a couple years ago because my phone broke.
@Wander @selfhosted I have old Pixel phones with LineageOS installed, but I haven’t found a good way to prevent battery inflation. I’d love a way to limit charge to 50% or to bypass the battery altogether.
Try acca
@ahoyboyhoy @selfhosted How old is the phone and what version of the OS are you using? I was under the impression that modern phones bypass the battery when connected to the charger and having full charge.
Regarding limiting the charge, I believe there’s some software calibration you can do which would allow you to set it to 50%. I’m no expert in battery or repairs at all, so someone else might have a better idea.
Pretty cool concept actually. upcycling old tech does seem to be a selfhosting hobby. I see a lot of criticism that I think doesn’t really see the value proposition. You should be able to root the device and install a new OS. I wonder how limited the bandwidth would be though, and whether it’d be worth the cost to get adapters, if they exist, to allow more throughput. I do like the concept though.
If I’m just using them as a glorified small Linux box it could work pretty well. If you’re going to host services that don’t require a ton of bandwidth you don’t need a hard line or anything. Hell my Plex server is using WiFi (802.11ax but still) and it delivers 4K just fine.
Shit, I run plex of my synology ds1621+ and it chokes on 4k regularly. This is with a cabled connection. It’s almost certainly the CPU though. These things are weak as hell. What’re you running plex on ?
Admittedly the server on which it’s running is pretty beefy and I don’t let it transcode. I’ve got enough disk space that if something spends time transcoding I just optimize it to a new version of the file.
By bandwidth I was speaking in terms of network only, but if you were to run it on a simple server that didn’t do any transcoding it might be ok.
Ah ok makes sense. Yeah it’s definitely not latency or throughput causing stuttering for me. Gonna definitely be the anemic CPU. Luckily I have an extra laptop that I haven’t used in years that would make a perfect addition to the homelab. Can just through linux on it and use it as a plex/roon server
Yeah my server is an i5 using an onboard GPU so it’s nothing crazy but it’s got 80TB of drive space, so I optimize for what I put my money into.
Hell, sometimes it’s even easier to copy the data to my gaming rig, transcode it, and rsync it back. If I’m done playing for the night and about to go to bed and I have like a TV show or something I know has to be transcoded, I’ll just queue up a job and let it run while I’m sleeping and script it so it rsyncs everything back when it’s done transcoding.
That’s definitely a good call. Before I even had a NAS, I’d just throw some movies and stuff on my macbook when I had to travel. Problem is that when you’re loading it up, you think you know what you’ll want to watch and then later you just wish you had different choices.
