[tallanvor]

There is always going to be a point of failure. For many of us, self-hosting on a dedicated server, VPS, or some sort of cloud service is much better than keeping the hardware to do it at home.

My stuff is spread out among a dedicated server and 3 VPS's. --I could and should drop one of the VPS's, but if it'll take me a couple of hours, it's just not worth it until I actually have the time to spare.

[npodbielski]

It depends of your needs and resources of course but you can keep in some drawer or basement some old or small PC and you basically do not have to spend money on this, but for paid servers you have to spend 20-50$/month for something sensible. 1tb of backup in some s3 service costs like 120$ per year, and 1TB is not that much. In reality paid servers will be close to 1k$/year and in that price you can have sensible machine.

[tallanvor]

Sure, I could get a server at home, but then I have to figure out how to make it quiet enough that I don't notice it while keeping it from overheating - something that's hard enough to do with the equipment I already have. And then I have to worry about what happens if somebody decides to have fun trying to DDOS something on my home connection. Again, easier to rent a dedicated server so I don't have to worry about it.

[npodbielski]

I guess it depends on your country climate, here, where I live in the basement I have steady 22-23 degrees C, so not a problem really. Also I do not have even GPU there which is the most problematic part usually.

About DDOS, you should not your server directly connected to the internet. Use some router or managed switch first. Usually it have already some kind of protection on whatever device is connected to your internet provider infrastructure.

Another question is why would anybody DDOS you? You are not important enough. When I bought domain and connected it to my VPS - I got almost instantly visitors (probably bots looking for new domains being registered) trying bruteforce an access. And I almost instantly blocked Root login and Password auth. They were still trying to login. So I moved the port to higher one. It was calm for few months and then they found new port and again tried to ram it down. So I blocked IPs only to predefined set.

It was exactly the same when I opened my server to the internet with new domain. From that point of view it does not matter if this is your machine, VPS or dedicated server on some rack somewhere. You are responsible for its security.

[debian3]

When I read that someone disable password login (rightfully so), then they take additional steps to stop some bots to randomly brute force them with a password…