7 ms·

Hi! I started Neocities. I read HN regularly. Neocities was actually launched and bootstrapped on HN about 3 years ago, and donations from HN users bankrolled

Hi! I started Neocities. I read HN regularly. Neocities was actually launched and bootstrapped on HN about 3 years ago, and donations from HN users bankrolled the first year of operating it. Things have been going really well, the site is growing and still sustains it's own existence through donations and supporter accounts. I still work on the site heavily. We're launching some big features soon (more space, Github webhook deploys, etc.). We just finished migrating to SSL (for everything, including hosted sites). I've had to do some pretty crazy stuff to make the site work, some of which is not documented well and I think the HN crowd would find pretty interesting. For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks. My new years resolution was to get better at writing about some of the crazy tech I've had to do for the site. If you're interested, there's an RSS feed you can subscribe to for our blog where it will be posted in the future: https://blog.neocities.org/feed.xml https://blog.neocities.org/feed.xml Again, thanks go to HN. Site literally wouldn't exist without it, you were basically our seed investor. Feel free to ask me questions, I'll try to answer. That's something you're supposed to do with your investors, right?

adrianm 10y ago
I'm sure you've heard this a million times by now, but I first got into web development because of Geocities in the mid-90s as a very young kid. Looking back, it was almost certainly the gateway drug that led me down the path to where I am today. So it's nice to know that something like this still exists and might inspire the next generation of programmers.
- kyledrake 10y ago
  Same here. HTML was my first language. I missed the creativity of the old web. Going from wide open blank slates to 140 characters is not my definition of progress. I do work very intentionally on not living in the past, though. The epiphany that led me to Neocities was that creating your own weird static HTML site was not an anachronistic activity, but rather something that was simply too early for it's time. I think it has become relevant and modern because of the massive improvements to HTML/CSS/JS. The theory seems to be panning out: https://neocities.org/browse https://neocities.org/browse
  - teleclimber 10y ago
    > Going from wide open blank slates to 140 characters is not my definition of progress. Why do you have to only use 140 chars? Frankly the "old web" is still there. You're just as free to create whatever you like using HTML and CSS and host it anywhere that works for you. In fact it's gotten easier: browsers are more consistent, CSS is getting more powerful, and there are a myriad static hosting options these days. So go build something creative! ..and then share the hyperlink in some 140 char social network.
    - khedoros1 10y ago
      > Why do you have to only use 140 chars? Sounds like a reference to Twitter. > Frankly the "old web" is still there. Frankly, a lot of it isn't. Culturally at least, even if some things like Tripod and Angelfire seem to still be around. Around the mid-90s, Geocities, Angelfire, Tripod, and similar hosts were the web to a lot of people, the way that Facebook and Twitter are the web to a lot of people now.
mrskeltal 10y ago
How much does hosting costs you at this moment?
- kyledrake 10y ago
  Just servers, about $550/mo once we launch the new infrastructure. That doesn't include the $10k I had to sink in to buy the equipment and IP addresses. Then pad the bill a lot of misc other nonsense: social media liability insurance (yes this is a thing), ARIN fees, LLC registration, a literal fax machine (for DMCA compliance), monitoring, etc. Grand total will hover around $1000. Architecture is a core + CDN model. The main servers run as a HA cluster in a datacenter, and then the anycast CDN caches content at the edge. It's not too far away from how S3+Cloudfront works or something like Cloudflare works. Nginx does all the heavy lifting, and the "front store" is just a giant blob of ruby: https://github.com/neocities/neocities https://github.com/neocities/neocities Not too bad for 110,000 web sites. Costs at this point are pretty stable for the next million sites (but surprises happen). I can double our bandwidth capacity for about $200/mo in less than a few hours if I needed to in a pinch.
  - mrskeltal 10y ago
    How much traffic do you get per day usually?
  - kyledrake 10y ago
    > How much traffic do you get per day usually? The sites average about 25 million unique views (IP address per hour) and 50 million hits per month. This increases about 20% per month, sometimes slowing down a bit, then shooting right back up again. Every once in a while a big site somewhere hotlinks an asset on Neocities and this skyrockets, but we just ask them to host the asset(s) directly and things go back to normal. Technically it's never caused any capacity issues, but obviously we don't want huge sites hosted elsewhere to use Neocities as a CDN.
    - mrskeltal 10y ago
      Awesome, thanks!
shams93 10y ago
Geocities was my first job out of school, at that time it took a small army of apache module c coders. Its awesome you're bringing back the concept, when Yahoo bought us out and then killed it they took out a huge part of the history of the early web.
- djsumdog 10y ago
  Wow, that's got to be an amazing piece of history on your resume. Yahoo killed a lot of things to take their devs (Astrid tasks is another great example). I think Archive.org has a lot of the old Geocities sites.
- kyledrake 10y ago
  Thanks! Next time I'm in LA* let's meet up. I've met a few GeoCities veterans randomly and it's always a great conversation. * GeoCities started in LA, I'm just assuming you still live there.
- cableshaft 10y ago
  I still have a clone of my geocities site in my archives. It was the first website I made, and highlighted my love of video games, anime, and adnd. It was so 'massive' it had to span two geocities accounts to hold it (different links went to different sites). I made a lot custom graphics for the site too, which helped me practice using Photoshop, which has helped me ever since, letting me mock things up and still look decent before real artists get their hands on them. In fact several games I've made I just used my own graphics and they still found success.
vr46 10y ago
Are you going to put a watermark in the bottom corner of user pages? :D That was the biggest controversy I remember back then!
- kyledrake 10y ago
  N E V E R. And no advertising on sites, ever. This is our golden rule. My goal is to never make any changes to other people's sites. The only exception I'm giving myself is for an extreme emergency, such as a major security problem. It's never come up, I doubt it ever will. During the SSL transition there were a few sites I helped convert to SSL, but that was with permission from the site owner. I remember the watermarks. They sucked.
  - DanBC 10y ago
    I'd be happy if there was an option that allowed you to "skimlink" (or similar) my tiny neocities site.
  - vr46 10y ago
    You could have an opt-in so people could participate in "neighbourhood celebrations" and all show a ribbon for a particular event, say, TimBL's birthday or something, like Google Doodles. Either way, this is bloody awesome, good luck with it all.
- dkresge 10y ago
  Ha, the "geobug" -- pretty advanced for the time I thought. And while still annoying, it was much better than the full page interstitial ad.
robto 10y ago
I vaguely remember something about making the sites available through ipfs. What was that like and what came of it?
- kyledrake 10y ago
  The sites are still all being archived through IPFS! The link of the latest archive was temporarily removed from the site profile, but it's coming back soon when we launch the new IPFS infrastructure (weeks not months). The first IPFS implementation was experimental, the next version is going to be pretty amazing. Stay tuned. Using Neocities with IPFS has been really great for stress testing, as we have a lot of content and it links to itself in really weird ways. It's discovered some performance bottlenecks that the IPFS devs have been able to solve. The result is that the newest IPFS implementations are much, much better for massive datasets. I'm a very strong believer in the distributed web. I think it's the future of static web content. People much smarter than me think it's the future of the dynamic web too, but I'm pretty single-focused on the static side of things right now.
  - wscott 10y ago
    You are doing a pretty huge service to the IPFS project just by trying to use it at this scale. I would love a blog post giving your experiences using it. One of my main complaints about IPFS is that it is very hard to have visibility into the project if you are not willing to follow all the github issues.
    - e12e 10y ago
      This is great. Between neocities and https://pinbits.io/ https://pinbits.io/ it appears we're starting to see real and useful applications for ipfs :-)
craigcannon 10y ago
Unrelated note. If anyone knows the Geocities founders I'd love to interview their first employee for our Employee 1 series. Craig@YCombinator.com
- kyledrake 10y ago
  David Bohnett was the founder and probably knows who that is. I'll send you an email with how to contact him. These days he is a VC based in LA and does a lot of philanthropy: http://www.bohnettfoundation.org http://www.bohnettfoundation.org He has one of the original enigma machines: http://www.latimes.com/entertainment/arts/culture/la-et-cm-imitation-game-enigma-machine-david-bohnett-20150122-story.html http://www.latimes.com/entertainment/arts/culture/la-et-cm-i... And here's a very good hour-long interview with him about Geocities, can't recommend this enough: http://www.internethistorypodcast.com/2015/05/david-bohnett-founder-of-geocities/ http://www.internethistorypodcast.com/2015/05/david-bohnett-...
  - craigcannon 10y ago
    Thanks!
otoburb 10y ago
>>For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks. Will subscribe to your RSS feed, but wanted to specifically say that I for one would love reading about your cheap anycast network setup & operations framework. Thanks again for the original Geocities rescue and great work on the direction that Neocities is heading!
pryelluw 10y ago
Shoot me an email (profile) and I'll help you figure out the content. No bs or strings. Just giving back as a former user of your product.
luka-birsa 10y ago
Please share the anycast implementation story. Would love to know how you implemented on the cheap.
luka-birsa 10y ago
Please share the anycast implementation story. Would love to know how you implemented on the cheap.
achairapart 10y ago
Kyle, I wonder if you had any trouble or how much trouble you had with some kind of abuse (spam etc.) or DMCA in those three years. I'm very happy this project is still going strong!
- kyledrake 10y ago
  We get a small amount of SEO pagerank garbage and phishing attacks (most of which don't actually work because we don't support HTTP POST). We have user reporting and detection code that catches basically all of it, the scammers get sick of getting banned within a few hours (on average) and leave to find a host that's... not as good at this. Our policy is to remove phishing and spam and report it to stop spam services. The major reason for this is that I want to keep our nose clean for pagerank purposes. I don't want Google to decide we're just a garbage dump and dock all our sites in search results. I surmise (rather, I hope) that our pages have a much higher rank than many other free hosting providers (and even some major social networks) because we work so hard to be proactive on this problem. I wish Google provided better resources for this than they currently do. I'd love an API to report SEO pagerank spam, for example. Right now I have to do it manually with a form. Abuse was not a reason, it was the reason we ended up rolling our own anycast CDN with our own ASN (https://whois.arin.net/rest/asn/AS395409 https://whois.arin.net/rest/asn/AS395409). Abuse reporting goes to whomever owns the IP address, so our hosting providers would get these complaints. There was a real concern we would lose our hosting providers. The important thing to understand is that most hosting providers think you're just running a Wordpress blog, so if there's an abuse complaint they just think your blog got hacked and treat you accordingly. If you want to be an ISP, learn BGP, the cloud will not save you. We don't get many DMCA takedowns, it's usually something really dumb and arbitrary. One of the reasons for this is probably that we blacklist certain types of file formats (such as videos and mp3s). The idea with Neocities is to use it to make web sites, so for free sites, we only allow file types useful for making web sites. Supporter accounts are not subject to these restrictions. We used to get more classic spam (porn, "dick pillz", etc.) but not as much these days because it isn't as effective. That spam tended to hover around whatever social ill Americans were experiencing. For example, before the Affordable Healthcare Act kicked in, we got a lot of online pharmacy drugstore spam preying on people that couldn't afford their medicine. It might come back if they start dismantling the ACA. As for comment spam (for the main site), we have strict requirements to allow commenting. You have to wait a week, make a site, update it at least a few times, and do some other specific things before you can comment. That's not only helped with spam, it's also helped to deal with jerks. It's hard to stay mad enough at something to wait a week while engaging in psychological sublimation, just to leave a turd on someone's site profile at the end of it.
ajacksified 10y ago
I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went something like this: Me: "I've created a PR to allow .cur and .mid files, like the good ol' days." You: "Wtf is a .cur?" Person 2: "It's windows cursor format." You: "(many paragraphs, tl;dr: Sorry, but we're not recreating Geocities.)" ~ one year later ~ You: "I caved. I've merged, sorry for being a dick." After so long, I'd completely forgotten about the PR and found it hilarious that you eventually merged my PR. I'm happy to see things continue forward :D
- kyledrake 10y ago
  I've been thinking about flipping it around - instead of whitelisting certain files, simply blacklisting the problem formats. Thanks for reminding me.
  - ReverseCold 10y ago
    I think a whitelist is better, there can be a ton of file formats that have vulnerabilities in their readers.
    - kyledrake 10y ago
      True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.
      - erikpukinskis 10y ago
        I don't think you necessarily need to keep up! Just keep moving and you'll get what you need over time.
      - e12e 10y ago
        On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests? Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1]. Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-) [1] http://voss.fhs.no/english/information-about-voss-folkehogskule http://voss.fhs.no/english/information-about-voss-folkehogsk...
gwu78 10y ago
You should write up that piece on "cheap" global anycast. Let me make a wrong guess to give you motivation: you had to physcially visit IXP's across the globe to set IP's on network interfaces of computers you rented there?
- nickpsecurity 10y ago
  I'd be interested in that, too. Collecting everything I can on cheap implementations of ISP's, WAN's, etc from those that pull it off. Might help others later.
brazzledazzle 10y ago
I'd love to hear about your experience with building the anycast network.
type0 10y ago
I wonder if you have any plans for u2f two factor authentication (or even TOTP)? For people that are in the process of learning HTML, u2f seems like the only secure option because the mental overhead needed to grok ssh usually is too big.
MicroBerto 10y ago
What's your take on censorship? For instance, if there were scandal allegations involving your favorite politician, and a Neocities user was writing about them, would you take the pages down at their request?

adrianm 10y ago

I'm sure you've heard this a million times by now, but I first got into web development because of Geocities in the mid-90s as a very young kid. Looking back, it was almost certainly the gateway drug that led me down the path to where I am today. So it's nice to know that something like this still exists and might inspire the next generation of programmers.

kyledrake 10y ago
Same here. HTML was my first language. I missed the creativity of the old web. Going from wide open blank slates to 140 characters is not my definition of progress. I do work very intentionally on not living in the past, though. The epiphany that led me to Neocities was that creating your own weird static HTML site was not an anachronistic activity, but rather something that was simply too early for it's time. I think it has become relevant and modern because of the massive improvements to HTML/CSS/JS. The theory seems to be panning out: https://neocities.org/browse https://neocities.org/browse
- teleclimber 10y ago
  > Going from wide open blank slates to 140 characters is not my definition of progress. Why do you have to only use 140 chars? Frankly the "old web" is still there. You're just as free to create whatever you like using HTML and CSS and host it anywhere that works for you. In fact it's gotten easier: browsers are more consistent, CSS is getting more powerful, and there are a myriad static hosting options these days. So go build something creative! ..and then share the hyperlink in some 140 char social network.
  - khedoros1 10y ago
    > Why do you have to only use 140 chars? Sounds like a reference to Twitter. > Frankly the "old web" is still there. Frankly, a lot of it isn't. Culturally at least, even if some things like Tripod and Angelfire seem to still be around. Around the mid-90s, Geocities, Angelfire, Tripod, and similar hosts were the web to a lot of people, the way that Facebook and Twitter are the web to a lot of people now.

mrskeltal 10y ago

How much does hosting costs you at this moment?

kyledrake 10y ago
Just servers, about $550/mo once we launch the new infrastructure. That doesn't include the $10k I had to sink in to buy the equipment and IP addresses. Then pad the bill a lot of misc other nonsense: social media liability insurance (yes this is a thing), ARIN fees, LLC registration, a literal fax machine (for DMCA compliance), monitoring, etc. Grand total will hover around $1000. Architecture is a core + CDN model. The main servers run as a HA cluster in a datacenter, and then the anycast CDN caches content at the edge. It's not too far away from how S3+Cloudfront works or something like Cloudflare works. Nginx does all the heavy lifting, and the "front store" is just a giant blob of ruby: https://github.com/neocities/neocities https://github.com/neocities/neocities Not too bad for 110,000 web sites. Costs at this point are pretty stable for the next million sites (but surprises happen). I can double our bandwidth capacity for about $200/mo in less than a few hours if I needed to in a pinch.
- mrskeltal 10y ago
  How much traffic do you get per day usually?
- kyledrake 10y ago
  > How much traffic do you get per day usually? The sites average about 25 million unique views (IP address per hour) and 50 million hits per month. This increases about 20% per month, sometimes slowing down a bit, then shooting right back up again. Every once in a while a big site somewhere hotlinks an asset on Neocities and this skyrockets, but we just ask them to host the asset(s) directly and things go back to normal. Technically it's never caused any capacity issues, but obviously we don't want huge sites hosted elsewhere to use Neocities as a CDN.
  - mrskeltal 10y ago
    Awesome, thanks!

shams93 10y ago

Geocities was my first job out of school, at that time it took a small army of apache module c coders. Its awesome you're bringing back the concept, when Yahoo bought us out and then killed it they took out a huge part of the history of the early web.

djsumdog 10y ago
Wow, that's got to be an amazing piece of history on your resume. Yahoo killed a lot of things to take their devs (Astrid tasks is another great example). I think Archive.org has a lot of the old Geocities sites.
kyledrake 10y ago
Thanks! Next time I'm in LA* let's meet up. I've met a few GeoCities veterans randomly and it's always a great conversation. * GeoCities started in LA, I'm just assuming you still live there.
cableshaft 10y ago
I still have a clone of my geocities site in my archives. It was the first website I made, and highlighted my love of video games, anime, and adnd. It was so 'massive' it had to span two geocities accounts to hold it (different links went to different sites). I made a lot custom graphics for the site too, which helped me practice using Photoshop, which has helped me ever since, letting me mock things up and still look decent before real artists get their hands on them. In fact several games I've made I just used my own graphics and they still found success.

vr46 10y ago

Are you going to put a watermark in the bottom corner of user pages? :D That was the biggest controversy I remember back then!

kyledrake 10y ago
N E V E R. And no advertising on sites, ever. This is our golden rule. My goal is to never make any changes to other people's sites. The only exception I'm giving myself is for an extreme emergency, such as a major security problem. It's never come up, I doubt it ever will. During the SSL transition there were a few sites I helped convert to SSL, but that was with permission from the site owner. I remember the watermarks. They sucked.
- DanBC 10y ago
  I'd be happy if there was an option that allowed you to "skimlink" (or similar) my tiny neocities site.
- vr46 10y ago
  You could have an opt-in so people could participate in "neighbourhood celebrations" and all show a ribbon for a particular event, say, TimBL's birthday or something, like Google Doodles. Either way, this is bloody awesome, good luck with it all.
dkresge 10y ago
Ha, the "geobug" -- pretty advanced for the time I thought. And while still annoying, it was much better than the full page interstitial ad.

robto 10y ago

I vaguely remember something about making the sites available through ipfs. What was that like and what came of it?

kyledrake 10y ago
The sites are still all being archived through IPFS! The link of the latest archive was temporarily removed from the site profile, but it's coming back soon when we launch the new IPFS infrastructure (weeks not months). The first IPFS implementation was experimental, the next version is going to be pretty amazing. Stay tuned. Using Neocities with IPFS has been really great for stress testing, as we have a lot of content and it links to itself in really weird ways. It's discovered some performance bottlenecks that the IPFS devs have been able to solve. The result is that the newest IPFS implementations are much, much better for massive datasets. I'm a very strong believer in the distributed web. I think it's the future of static web content. People much smarter than me think it's the future of the dynamic web too, but I'm pretty single-focused on the static side of things right now.
- wscott 10y ago
  You are doing a pretty huge service to the IPFS project just by trying to use it at this scale. I would love a blog post giving your experiences using it. One of my main complaints about IPFS is that it is very hard to have visibility into the project if you are not willing to follow all the github issues.
  - e12e 10y ago
    This is great. Between neocities and https://pinbits.io/ https://pinbits.io/ it appears we're starting to see real and useful applications for ipfs :-)

craigcannon 10y ago

Unrelated note. If anyone knows the Geocities founders I'd love to interview their first employee for our Employee 1 series. Craig@YCombinator.com

kyledrake 10y ago
David Bohnett was the founder and probably knows who that is. I'll send you an email with how to contact him. These days he is a VC based in LA and does a lot of philanthropy: http://www.bohnettfoundation.org http://www.bohnettfoundation.org He has one of the original enigma machines: http://www.latimes.com/entertainment/arts/culture/la-et-cm-imitation-game-enigma-machine-david-bohnett-20150122-story.html http://www.latimes.com/entertainment/arts/culture/la-et-cm-i... And here's a very good hour-long interview with him about Geocities, can't recommend this enough: http://www.internethistorypodcast.com/2015/05/david-bohnett-founder-of-geocities/ http://www.internethistorypodcast.com/2015/05/david-bohnett-...
- craigcannon 10y ago
  Thanks!

otoburb 10y ago

>>For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks. Will subscribe to your RSS feed, but wanted to specifically say that I for one would love reading about your cheap anycast network setup & operations framework. Thanks again for the original Geocities rescue and great work on the direction that Neocities is heading!

pryelluw 10y ago

Shoot me an email (profile) and I'll help you figure out the content. No bs or strings. Just giving back as a former user of your product.

luka-birsa 10y ago

Please share the anycast implementation story. Would love to know how you implemented on the cheap.

luka-birsa 10y ago

Please share the anycast implementation story. Would love to know how you implemented on the cheap.

achairapart 10y ago

Kyle, I wonder if you had any trouble or how much trouble you had with some kind of abuse (spam etc.) or DMCA in those three years. I'm very happy this project is still going strong!

kyledrake 10y ago
We get a small amount of SEO pagerank garbage and phishing attacks (most of which don't actually work because we don't support HTTP POST). We have user reporting and detection code that catches basically all of it, the scammers get sick of getting banned within a few hours (on average) and leave to find a host that's... not as good at this. Our policy is to remove phishing and spam and report it to stop spam services. The major reason for this is that I want to keep our nose clean for pagerank purposes. I don't want Google to decide we're just a garbage dump and dock all our sites in search results. I surmise (rather, I hope) that our pages have a much higher rank than many other free hosting providers (and even some major social networks) because we work so hard to be proactive on this problem. I wish Google provided better resources for this than they currently do. I'd love an API to report SEO pagerank spam, for example. Right now I have to do it manually with a form. Abuse was not a reason, it was the reason we ended up rolling our own anycast CDN with our own ASN (https://whois.arin.net/rest/asn/AS395409 https://whois.arin.net/rest/asn/AS395409). Abuse reporting goes to whomever owns the IP address, so our hosting providers would get these complaints. There was a real concern we would lose our hosting providers. The important thing to understand is that most hosting providers think you're just running a Wordpress blog, so if there's an abuse complaint they just think your blog got hacked and treat you accordingly. If you want to be an ISP, learn BGP, the cloud will not save you. We don't get many DMCA takedowns, it's usually something really dumb and arbitrary. One of the reasons for this is probably that we blacklist certain types of file formats (such as videos and mp3s). The idea with Neocities is to use it to make web sites, so for free sites, we only allow file types useful for making web sites. Supporter accounts are not subject to these restrictions. We used to get more classic spam (porn, "dick pillz", etc.) but not as much these days because it isn't as effective. That spam tended to hover around whatever social ill Americans were experiencing. For example, before the Affordable Healthcare Act kicked in, we got a lot of online pharmacy drugstore spam preying on people that couldn't afford their medicine. It might come back if they start dismantling the ACA. As for comment spam (for the main site), we have strict requirements to allow commenting. You have to wait a week, make a site, update it at least a few times, and do some other specific things before you can comment. That's not only helped with spam, it's also helped to deal with jerks. It's hard to stay mad enough at something to wait a week while engaging in psychological sublimation, just to leave a turd on someone's site profile at the end of it.

ajacksified 10y ago

I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went something like this: Me: "I've created a PR to allow .cur and .mid files, like the good ol' days." You: "Wtf is a .cur?" Person 2: "It's windows cursor format." You: "(many paragraphs, tl;dr: Sorry, but we're not recreating Geocities.)" ~ one year later ~ You: "I caved. I've merged, sorry for being a dick." After so long, I'd completely forgotten about the PR and found it hilarious that you eventually merged my PR. I'm happy to see things continue forward :D

kyledrake 10y ago
I've been thinking about flipping it around - instead of whitelisting certain files, simply blacklisting the problem formats. Thanks for reminding me.
- ReverseCold 10y ago
  I think a whitelist is better, there can be a ton of file formats that have vulnerabilities in their readers.
  - kyledrake 10y ago
    True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.
    - erikpukinskis 10y ago
      I don't think you necessarily need to keep up! Just keep moving and you'll get what you need over time.
    - e12e 10y ago
      On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests? Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1]. Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-) [1] http://voss.fhs.no/english/information-about-voss-folkehogskule http://voss.fhs.no/english/information-about-voss-folkehogsk...

gwu78 10y ago

You should write up that piece on "cheap" global anycast. Let me make a wrong guess to give you motivation: you had to physcially visit IXP's across the globe to set IP's on network interfaces of computers you rented there?

nickpsecurity 10y ago
I'd be interested in that, too. Collecting everything I can on cheap implementations of ISP's, WAN's, etc from those that pull it off. Might help others later.

brazzledazzle 10y ago

I'd love to hear about your experience with building the anycast network.

type0 10y ago

I wonder if you have any plans for u2f two factor authentication (or even TOTP)? For people that are in the process of learning HTML, u2f seems like the only secure option because the mental overhead needed to grok ssh usually is too big.

MicroBerto 10y ago

What's your take on censorship? For instance, if there were scandal allegations involving your favorite politician, and a Neocities user was writing about them, would you take the pages down at their request?