Why the hostility?

Question

The comment thread and reaction to the original poster of this question was completely out-of-line.

https://serverfault.com/questions/494996/what-are-the-bare-essentials-to-make-ubuntu-production-ready-for-a-public-websit

This went from something that could have been informative to a absurd attack on developers...

I'm not sure why people piled on the original poster. Some of the responses were disrespectful. Start-ups with dev-only teams are not an uncommon scenario these days, and there are plenty of situations where access to a qualified systems engineer isn't easy.

I understand that there's friction between the traditional systems administration community and the increased presence of DevOps and developer-driven architectures, but it's here to stay!! There will be more Ubuntu questions, more basic infrastructure inquiries from people who have had little experience with enterprise hardware and definitely more people who haven't "paid their dues" in the same way old-school sysadmins have... New paradigm.

But it's not an excuse to berate someone coming to Server Fault for help. "Hire a sysadmin" isn't constructive on its own...

Answer 1

As a long time lurker ServerFault is infamously known for its hostility. Several times I have considered reporting certain users due to their consistent history of attacking the OP and arrogance with their knowledge. That doesn't make a healthy Q&A site.

I also disagree with the idea that eliminating the "professional capacity" requirement will drive experts away. Take a look at StackOverflow's top monthly users, most have large amounts of reputation and experience. Even with the massive amount of low quality questions they are still doing fine.

In this case the main problem is not the question itself, its the broadness of the question. To me its perfectly reasonable to close the question as NARQ since building a public server means talking about OS level security, firewall security, application security, secure coding practices, etc. That's a lot for a single question

What I do NOT agree with are the multiple users who flat out attack the OP. Yes, in an ideal situation you would hire a sysadmin (or at least outsource it). However, in an ideal situation you would also hire a lawyer for every single non-critical law question you have instead of googling, hire a general contractor to install a dishwasher or stove, you would never fix your car yourself and instead go to a certified mechanic, and you would never attempt repairs computer or phone problems by yourself. However, I bet most people do things like this on their own even though there's risk of damaging something but ended up doing just fine in 90% of cases

The proper response would be similar to law questions: "IANAL, but..."

The proper and best thing to do is hire a sysadmin or at least outsource it. They will know how to secure the system better and manage it in a production environment.

If this is absolutely not an option, the following resources will be helpful in getting you started. Note that you have real risk of suffering downtime, security vulnerabilities, and system instability, but these resources will attempt to limit those. Try to make it a goal though to have a sysadmin as soon as you can

• link to the several hardening Linux/LAMP questions
• link to a description of different services
• link to why desktop GUI is bad on a server (multiple questions on this, could also use Windows Server Core as an example)

Now was that so hard? You've made very clear this is the wrong way to do things and may cause bad things, but have provided a long list of resources to help get the OP started. This both discourages the behavior but answers the question in a nice easy way. You get the best of both worlds

Answer 2

I've noticed a fair amount of hostility towards questions that originate from people who are obviously developers. In most cases, the negativity isn't as blatant as this example, but I frequently spot on topic questions being VTC as 'Off Topic' simply because a developer has asked the question.

Now according the FAQ, "Server Fault is for Information Technology Professionals needing expert answers related to managing computer systems in a professional capacity". It doesn't say it's for "System Administrators needing expert answers related to managing computer systems in a professional capacity".

A developer who is asking for help trying to set up a server for whatever reason, is somebody who is an Information Technology Professional that also needs help from experts related to managing computer systems in a professional capacity. So what's the problem?

The FAQ says nothing about Server Fault being exclusively for systems administrators to help other systems administrators. If this is the case, then I think the FAQ should be updated to reflect this.

It isn't unusual for somebody to be employed to develop software and manage computer systems, and as stated by the poster of the question, he believes he knows enough to implement any changes that are required, but just wants some pointers on what he needs to be looking at. Personally, I think the correct approach to the question would have been to either VTC as 'Not Constructive', and point the user to the FAQ, as I think they've asked an open ended/chatty question. Had the OP had asked for help with something specific, then it would have been a different matter.

Answer 3

1. What hostility?

   • Telling a developer "hire a sysadmin" might not be the answer he's looking for, but it's hardly hostile, disrespectful or unreasonable in response to a question that amounts to "what sysadmining do I need to do?" Of course, that's not exactly useful as an answer, hence it being said in the comments.
     
     

2. Turn it around.

   • Dear Stackoverflow, What coding things do I need to do for my web servers? I run a start-up that can't afford to hire programmers, so I'm just looking for the bare essentials I need to do get my production webservers coded.
     
     

3. This was never in danger of being anything informative.

   • This was textbook Not Construcitve / NARQ. Impossibly broad, a topic you could write a book on (in addition to the books that already exist on the topic), and at least 6 questions in one question post to boot.

   • We have a FAQ, which the OP obviously didn't read. It could possibly, maybe, with a lot of work be on-topic over at Unix and Linux, or even here, if there was a compelling reason to overlook the fact that the OP is not an Information Technology Professional, but at it heart, "what do I need to do to make my [Ubuntu] servers production-ready" is a book, not a good question for a Q&A site like ServerFault is supposed to be.

   • Serverfault is not a site to give 101-level Systems Administration advice to... well, users. That would be the unbearable part of my job, not anything I'm willing to do for free, off the clock. Again, this is supposed to a be a from IT pros, to IT pros site, so this kind of question simply doesn't belong.

Answer 4

This is going to be short because I think the other answers have the other angles covered.

There is very clearly an identity struggle going on here. I'm picking up three main themes:

• The "IT professionals" standard:
  It's hard to maintain in the face of least common denominator, but it's what makes this SE site unique.
• Not scaring away new users:
  Some people are genuinely clueless. Some are genuinely confrontational assholes who don't care about the rules and just want you to make their problem go away. Somewhere in the middle of there are well-meaning people who make mistakes, and potentially the next generation of SF users. These are the ones we don't want to scare away.
• Not having the time to invest in helping everyone who can't be bothered to read about our subject matter:
  Flies in the face of not scaring away new users at a glance, but not entirely. We can't afford to use a delicate touch in all cases or we'll never get anything done. Worse, we'll get burnt out from going through the motions constantly with people who aren't salvageable.

All of these points are legitimate when acting as checks and balances to each other, but cannot exist in vacuum. Speaking as a relatively new SF user but a decently experienced sysadmin: if you completely disregard any of these bullet points, the value of the site is destroyed in my eyes. Going "all in" with any single one of these approaches is self-defeating.

---

Ultimately, I think it comes down to this: we're all doing this in our spare time, and we can only afford to invest as much effort into things as a person is willing to put into a question.

New people will make mistakes, but so long as you can perceive effort or intent toward building a good question or contributing (even if misdirected, i.e. off-topic), it's worth an attempt to help steer them toward being better at doing so. The people who can't be bothered (and there are many) are the ones you can't afford to spend much time on, if any at all.

If in doubt, err on the side of helping someone out. If someone can't be bothered to put in the effort, be concise without being rude, or let your downvote do the talking. Just don't spend much time on them.

Answer 5

What's the problem with the comments?

I thought the comments were basically valid, if just a little bit harsh. I also agree with Michael Hampton in that the OP is the first one who bristled when they didn't get a nice answer chock full o' pointers and links for them to reference. I think the following comments were at least partly in reaction to the bristling by the OP when it became clear they didn't want to hear good advice. From a sysadmin perspective we would totally put the brakes on something like this if we saw it crop up in our environments, because we know better than to try and implement:

"...the minimum things we should do before going live in production to ensure that we don't subject the server to any security or other malicious exploits".

Since the OP doesn't have any sysadmins they don't have anyone on the inside telling them "maybe we should rethink this". They're a dev-driven shop as many start-ups are, and they will find out the hard way when they put an insecure server out there on the interwebs. Unfortunately, I think the OP walked away from their experience thinking most of the people on SF are rude and not helpful instead of going back to their team and saying "We should contract with a sysadmin to make sure we are deploying things properly and aren't putting insecure things into production."

"Here at Chotchkies we don't like to do the bare minimum..."

As we know, there is no such thing as "the minimum" when it comes to security. All it takes is one vulnerability and you are done, and the comments were in response to the lack of understanding of this concept in the OP's question. That plus it was impossibly broad to answer in the Q&A format of SF. Also we would never try to barely understand something, read a "Ubuntu for Dummies" hardening guide, throw it into production, and hope for the best without understanding the concepts behind the hardening guidelines and the best way to implement them.

It was also obvious from the OP that they didn't want to understand anything about what they were asking. They just wanted some guide or basic pointers to doing the "minimum" to get their code or whatever into prod, which goes against the grain of every decent sysadmin. This being the case, nobody here wants to give pointers or waste their time on any amount of half-hearted advice to an OP who doesn't even want the full answer in the first place. So what happens? The "old salts" who have been on here awhile cut right to the chase, because they have seen this whole thing play out before and they know better. They know whatever they say isn't really going to be implemented well or at all so they want nothing to do with it and discourage the whole thing altogether.

How could things have gone differently?

Well, nothing was really wrong with the content of the comments since they spoke the truth. The way in which that content was delivered could have been a little softer like saying:

"Your question is far too broad to be answered in a Q&A format like SF. I suggest you start with understanding the OS better instead of focusing 100% on the app side of it before you decide to throw it into prod, because if you don't, you will have many more issues down the road."

Or maybe we could come up with a canonical answer on why the OP's general approach is not a good idea, and why baking in good sysadmin practices from the beginning is a good idea? Whether or not they accept it is up to them, but at least they may not feel like their wrist just got slapped for asking something that is perfectly acceptable to ask on SO... Ahh... I think therin lies the answer that keeps surfacing time and time and time and time again... SF is not like SO and nobody coming to the site realizes it despite the many discussions and attempts at differentiating SF from its bigger, older brother. I'm not going to try and offer any suggestions on successfully doing this other than saying one thing:

Maybe SF should take it's own advice, admit that the community does not know how to accomplish this and contract with a marketing person/company who has experience on how to differentiate SF from SO enough so that it will be obvious to new people coming to the site.

Finally, lain mentions that SF "...has unfortunately descended to the lowest common denominator and like so many other places is just somewhere else for the clueless, feckless, hapless ... to to ask crappy questions." The last part is true since SF is open to anyone to ask questions, but as far as I know it is still up to the "old salts" to ensure that the first part never happens by shooting down questions like this in one way or another.

Answer 6

The hostility both on this site and on SO sadden me greatly. To my surprise, I discovered just now that the SF FAQ explicitly covers "civility" under the "Etiquette" section:

Civility is required at all times; rudeness will not be tolerated.

The proper way to handle the referenced question, and any overly broad questions generally, would have been to close the question and add a comment pointing to the FAQ.

It's disingenuous to cite the FAQ as a reason to close questions while simultaneously violating the FAQ to berate and abuse others.

I think the real problem is that the SE sites won't just accept 'broad' questions. As there are many such questions with excellent (and comprehensive) answers on the various sites, it's obviously not true that the sites can't handle such questions. And it would certainly simplify a lot of people's searches for relevant info to be able to expect such questions on these sites. Why couldn't the "... bare essentials ..." question have been such an example?

Answer 7

The question itself probably needed more details and that kinda didn't reflect what the OP had done (which was bad). I might not asking questions on SF as much as I wish I could (or answering), but if I did, I'd want to provide as much information on what I'm doing.

If I'd asked this question, I'd have started with - not all of this would be best practice, but its a good starter

"I'm running $webserver with $mods, $database on (the same/seperate) server allowing access to $specific/any ip address, and using $programming_language. I've also put in place key based/password based logins. $class_of_people have access to the system through a group/account." Asking what he's done so far might have narrowed the scope of the question.

On SF's part, I've noticed massive pride in the number of questions that are closed. People run out of closevotes routinely. Quality control is awesome but, if we're going to try to balance having quality questions with not scaring newbies right as soon as we get here, we're probably going to have to engage in some handholding. Keep closing shitty questions, but rather than saying "hire a sysadmin", maybe we can point out what would make the question itself better - where something is explicitly out of the FAQ's scope, point out the specific part. THEN close the question.

I hate to say it, but I sort of think closing the question as quickly as it was was part of the issue - a lot of this might have been, I suspect better off posted as an answer, without a character limit. Could we have gone "You're better off hiring a sysadmin, since there's many broad areas of security" posted a VERY broad answer, and handled this better?

I guess we do have a site culture that dosen't suffer idiots gladly. I think thats great, and I've learnt a lot from you guys. I do think its possible to balance QC with not being SE's dark scary place.

Answer 8

Original question was WAY too broad. Akin to asking: I'm starting a new company, what are the basic things I need to do to prepare i.e. HR policies, plan for bad debt collection, accounting software we need, payroll, that sort of thing.

Just securing a server alone is a non-trivial task. There are many tools and techniques. If you're a developer, imagine someone asks you: I need to make a database, what's are the basic things i need to do make it efficient and secure?