5 ms·

I think I know why it is susceptible to deadly hugs: "This site is being served to you by a real, live Alpha Micro Eagle 300 running AMOS 2.3a and AlphaTCP!"

ashleyn 7y ago
I can only imagine the buffer overflow bugs present in that network stack. Great gimmick, but we're long past the point where you can throw something like this online.
- timthorn 7y ago
  Well, they obviously can, because they did. :) I would have thought that the script toolkits are unlikely to find a working RCE against an Alpha. They might cause a DoS, but then again so might an HN post... Edit: of course, it's not an Alpha! Ahem.
  - SwellJoe 7y ago
    It is an Alpha, according to the site text ("Alpha Micro Eagle 300"), just not a DEC Alpha processor. Seems like it's probably a 68000?
    - classichasclass 7y ago
      It's a 68EC030.
      - SwellJoe 7y ago
        That's not so tiny. Many of the servers that ran the early internet were about that powerful (and, many even running on that very chip). It's interesting that they used the MMU-less version. I would have assumed that since it was a multi-tenant server, they'd want memory management ASAP.
        classichasclass 7y ago
        You'd think that, but protected memory has never been (much of) a thing with AMOS. There used to be an ugly bug where a POKE from AlphaBASIC could get you operator, for example. That got closed but similar exploits are undoubtedly possible, so most of the VARs dealt with the problem by just never letting users near a dot prompt (recall they just served vertical markets with their own bespoke software like PoS, CRM, call management, etc.).
- ASalazarMX 7y ago
  If it isn't crashing, it's likely fine unless someone purposefully targets it. I'd keep it online for bragging rights, ideally on read-only storage (or periodic filesystem checksums), and retire it the first time it's hacked.
- classichasclass 7y ago
  There are heaps of them, no doubt. It's actually protected by a reverse proxy firewall. The machine does serve the requests, but the reverse proxy drops ill-formed ones.
ASalazarMX 7y ago
I can't find a link, but back in the 90s, someone published a website being served by a retro (IIRC) computer to Slashdot. It was surprisingly resilient to the hug of death because the content wasn't dynamic and it served clients serially.
- SwellJoe 7y ago
  There used to be a web server running Contiki on, I think, a Commodore 64. Which is amazing even if it only serves one client at a time. I dunno if that's the one you're thinking of, but it's the most amazing "can we put a webserver on X" story I know of.
  - ASalazarMX 7y ago
    It might be. Also, it might have been the early 00s instead of the late 90s. Curse my teflon memory. Edit: it probably was. More on retro web servers here https://twitter.com/ServersOld https://twitter.com/ServersOld I'd post a website instead of a twitter handle, but it seems most results I find online point to his expired oldservers.net site.

ashleyn 7y ago

I can only imagine the buffer overflow bugs present in that network stack. Great gimmick, but we're long past the point where you can throw something like this online.

timthorn 7y ago
Well, they obviously can, because they did. :) I would have thought that the script toolkits are unlikely to find a working RCE against an Alpha. They might cause a DoS, but then again so might an HN post... Edit: of course, it's not an Alpha! Ahem.
- SwellJoe 7y ago
  It is an Alpha, according to the site text ("Alpha Micro Eagle 300"), just not a DEC Alpha processor. Seems like it's probably a 68000?
  - classichasclass 7y ago
    It's a 68EC030.
    - SwellJoe 7y ago
      That's not so tiny. Many of the servers that ran the early internet were about that powerful (and, many even running on that very chip). It's interesting that they used the MMU-less version. I would have assumed that since it was a multi-tenant server, they'd want memory management ASAP.
      - classichasclass 7y ago
        You'd think that, but protected memory has never been (much of) a thing with AMOS. There used to be an ugly bug where a POKE from AlphaBASIC could get you operator, for example. That got closed but similar exploits are undoubtedly possible, so most of the VARs dealt with the problem by just never letting users near a dot prompt (recall they just served vertical markets with their own bespoke software like PoS, CRM, call management, etc.).
ASalazarMX 7y ago
If it isn't crashing, it's likely fine unless someone purposefully targets it. I'd keep it online for bragging rights, ideally on read-only storage (or periodic filesystem checksums), and retire it the first time it's hacked.
classichasclass 7y ago
There are heaps of them, no doubt. It's actually protected by a reverse proxy firewall. The machine does serve the requests, but the reverse proxy drops ill-formed ones.

ASalazarMX 7y ago

I can't find a link, but back in the 90s, someone published a website being served by a retro (IIRC) computer to Slashdot. It was surprisingly resilient to the hug of death because the content wasn't dynamic and it served clients serially.

SwellJoe 7y ago
There used to be a web server running Contiki on, I think, a Commodore 64. Which is amazing even if it only serves one client at a time. I dunno if that's the one you're thinking of, but it's the most amazing "can we put a webserver on X" story I know of.
- ASalazarMX 7y ago
  It might be. Also, it might have been the early 00s instead of the late 90s. Curse my teflon memory. Edit: it probably was. More on retro web servers here https://twitter.com/ServersOld https://twitter.com/ServersOld I'd post a website instead of a twitter handle, but it seems most results I find online point to his expired oldservers.net site.