So far I haven't solved the problem of keeping a non-trivial service without any interventions. How does running your servers and services on a PaaS provider solve the need for OS updates and security? What are your typical architecture and operations like?
I personally think that OS updates and security fixes/hardening are crucial in all cases if you're running any production site (and even for the dev environment). Granted, some of the colocation providers don't offer services like AWS VPC (and the associated SecurityGroups and ACLs) but that's pretty rare nowadays. In all cases, and Ops or a Sysadmin person is quite important for the stability of your business.
The only big advantage I see about using PaaS is the rapid and flexible provisioning of new instances in case you need them. That's why the best solution to me, so far, has been running a combination of bare-metal servers with optional provisioning of additional cloud instances if you need them. The price difference can go to orders of magnitude (even if you factor in the costs of paying somebody to be a system administrator and take care of your servers).
I personally think that OS updates and security fixes/hardening are crucial in all cases if you're running any production site (and even for the dev environment). Granted, some of the colocation providers don't offer services like AWS VPC (and the associated SecurityGroups and ACLs) but that's pretty rare nowadays. In all cases, and Ops or a Sysadmin person is quite important for the stability of your business.
The only big advantage I see about using PaaS is the rapid and flexible provisioning of new instances in case you need them. That's why the best solution to me, so far, has been running a combination of bare-metal servers with optional provisioning of additional cloud instances if you need them. The price difference can go to orders of magnitude (even if you factor in the costs of paying somebody to be a system administrator and take care of your servers).
Edit: added the last paragraph