Self-hosting costs attention, not money
More than a year ago, I switched to Ghost as a self-hosted version. A few months ago, an injection attack placed a script in the then unpatched version of my hosted blog (it happened to many blogs). It sat there for about a week and possibly distributed malware freely through a script tag appended at the end of the page. It did that by obtaining an integration key through the injection vulnerability and then in turn with that updating every blog post on my page.
Cleaning that mess up required going to the database, removing every script tag. It required manually rotating every API/access key, because the feature that does that in a click was not yet released. I was naive for thinking that the little attention I gave it was enough. In fact, it became a liability. The time and effort required between a vulnerability becoming known and being exploited is decreasing.
Of course, unpatched and publicly known vulnerabilities have been with networked computing from the get-go. But for a long time, finding new vulnerabilities to exploit required manual scripting, or targeting, where the bottleneck was human. Open LLMs are highly capable nowadays, and they lack the safeguards required to prevent attacks from happening.
Those running systems bear the responsibility to keep them patched and secure. But it's starting to become a squeeze. A new kind of extortion emerged in the last year: (manually) breaching low effort "vibe-coded" (you could say slopped) SaaS apps. If I am being cynical, the models create an interesting economy on top of what tey produce, based on the value of siphoning off customer/personal data.
While the cost of creating a unit of software is realistically going down, the cost of maintaining that piece of software, especially hosting it on the web, will increase. Automated tools exist for that, but require setup, attention and knowledge about them. And that attention and time is already a scarce resource, better spent sharing knowledge than on maintaining the infrastructure around it.
But considering that -- how would one go about sharing their thoughts? Most of them can be placed on an axis of user/publisher control. The range goes from "free" platforms (think social media) and free blogging services (also niche services) to paid blogging services and finally self-hosted websites.
The large companies have an offer: post there, they'll take care of security (it is less likely their system gets breached than an unpatched server), they will even provide an audience. However, as we've seen with X, most once semi-public posts were put behind a login wall, and scraping, even for research and public interest, was made nearly impossible. The same goes for various communities, like a Discord server.
Of course, there are places like free blogging platforms such as WordPress or Blogspot, or any niche version of similar sorts, but those also come with limitations. Some limitations are reasonable due to their target audiences.
Paid blog hosting versions, like GhostPro, are certainly a sweet spot. And perhaps, they provide a good deal considering time and cost, but are again less capable than self-hosting.
That price for control has thus increased. You get freedom, but also responsibility, and that responsibility is pricy.
This is a problem: there are good reasons for retaining control while not being able to bear the cost. How should one speak up with an unpopular opinion? A public forum that pushes engagement metrics is possibly not the right place (it costs a great deal of attention). A personal blog may be the right location, but it is likely to be attacked automatically. Even possibly serving malware to interested people is a risk some might not want to accept. In turn, the opinion stays either completely offline, or behind a wall.
How to deal with it then?
If you want to publish and can bear the costs, a paid service may be right for you, and the value provided does amortize when you take in your own time. For everybody else, the next best solution is to lower the attack surface: reduce the use of dynamic systems (CMS, open APIs) and serve static pages. Proactively monitor your server and any admin API that is open using alerting rules, so you don't need to open the monitoring dashboard. If you have a community engaged with your blog, the cost of running a dynamic system might be worth it. Setting up automatic container updates and alerting might be closer to your liking than running a build script every time you write a new blog post. Be decisive about what you're willing to trade.
The ideal space does not exist, but every space comes with a tax on your attention. In the end, it's about making that attention expenditure worthwhile, or at least a price you're willing to spend for what you have to say. I will be evaluating whether it is feasible to have a whole CMS running, considering I am posting not nearly as much as I wanted to in the first place.