4 ms·

Replit used to be good. I can open up a page and start writing code. But now it requires an account, and the UI feels less responsive than before.

by poyu 5y ago

jonny_eh 5y ago
> But now it requires an account Considering how costly it is to run the service, requiring a free account feels pretty fair.
- paulgb 5y ago
  Especially since if you offer generic compute without any form of registration, you're basically inviting people to mine crypto with your AWS bills, which is something they've experienced: https://news.ycombinator.com/item?id=26682237 https://news.ycombinator.com/item?id=26682237
  - williamstein 5y ago
    At https://CoCalc.com https://CoCalc.com we offer generic compute without any form of registration required (see https://cocalc.com/auth/try https://cocalc.com/auth/try). And indeed, crypto mining is a periodic headache for us. I think Replit used to have a model that made it much easier for them to offer something without registration, because they supported client side Python, etc., via Emscripten. However, they eventually seem to have moved away from that.
    - paulgb 5y ago
      I realize that this is a car-and-mouse game that you might not want to talk about in public, but are there techniques that you’ve found to work? Is just throttling the CPU for anon accounts sufficient to make it not worth the trouble?
      - adgjlsfhk1 5y ago
        requiring credit cards doesn't even work. they just use stolen ones.
      - williamstein 5y ago
        Yes, there are many techniques we've tried for around a decade, with each being a filter that helps a certain amount, and nothing being a magic bullet. This doesn't really answer your question, but maybe gives a sense of perspective at least. I've run a range of sites that provide free online compute to people for over 20 years, starting with sites related to number theory that I hosted at Berkeley back in the late 1990s. Cryptocurrency mining wasn't a problem for the first 10 years, since cryptocurrency didn't exist. Before cryptocurrency, the problems were mainly spammers sending out spam emails, people launching attacks or abusively trying to exhaust all resources (disk, cpu, memory, etc.). People using up all resources became a lot easier to deal with the advent of cgroups and Docker (VM's were not a solution since they are too expensive to allocate for each free user). The next useful filter is to completely disable the network, except for paying customers: this dramatically reduces malicious use, since it's not possible to use CoCalc to launch outgoing DDOS attacks, run port scanners for weaknesses, etc. Disabling the network also discourages crypto miners, since the default crypto mining software typically communicates over the network with a mining pool. Of course, some small percentage of crypto miners will: (1) use a stolen credit card, or (2) manually upload data from a mining pool and manually copy their results out, and similar issues. You then have to deal with each of these problems, and they do cost you time and money. The goal is that they cost you less than the value that comes from having non-paying users, and so far that is the case for us. For (1), using Stripe helps a lot with stolen credit cards, since Stripe is quite good at detecting and preventing use of stolen cards, but they definitely aren't 100%. Regarding (2), there's really no way around having to develop heuristics and scans of your infrastructure to look for malicious and costly behavior, and manually look into it. Indeed, some technique involve silently throttling abusers, so they hopefully don't even realize their attempt to waste your resources is failing. There's also a discussion of this problem linked to from a big red box at https://sagecell.sagemath.org/ https://sagecell.sagemath.org/ All that said, providing compute as a free service to mathematicians at least, isn't hopeless! People appreciate what we do, and the jerks who try to wrecks things for the rest of us haven't succeeded.
- benatkin 5y ago
  How many zillions of languages can be run client-side with Emscripten and WASM? That isn't why - they're just optimizing the funnel and not caring if hackers think it's cool anymore.
- api 5y ago
  There are billions of devices in peoples' hands that can run code, but no it all has to be hosted at insane expense because cloud.
- wly_cdgr 5y ago
  It's fair, but fair is not the same as good

Replit used to be good. I can open up a page and start writing code. But now it requires an account, and the UI feels less responsive than before.

by poyu 5y ago

Replit used to be good. I can open up a page and start writing code. But now it requires an account, and the UI feels less responsive than before.

jonny_eh 5y ago

> But now it requires an account Considering how costly it is to run the service, requiring a free account feels pretty fair.

paulgb 5y ago
Especially since if you offer generic compute without any form of registration, you're basically inviting people to mine crypto with your AWS bills, which is something they've experienced: https://news.ycombinator.com/item?id=26682237 https://news.ycombinator.com/item?id=26682237
- williamstein 5y ago
  At https://CoCalc.com https://CoCalc.com we offer generic compute without any form of registration required (see https://cocalc.com/auth/try https://cocalc.com/auth/try). And indeed, crypto mining is a periodic headache for us. I think Replit used to have a model that made it much easier for them to offer something without registration, because they supported client side Python, etc., via Emscripten. However, they eventually seem to have moved away from that.
  - paulgb 5y ago
    I realize that this is a car-and-mouse game that you might not want to talk about in public, but are there techniques that you’ve found to work? Is just throttling the CPU for anon accounts sufficient to make it not worth the trouble?
    - adgjlsfhk1 5y ago
      requiring credit cards doesn't even work. they just use stolen ones.
    - williamstein 5y ago
      Yes, there are many techniques we've tried for around a decade, with each being a filter that helps a certain amount, and nothing being a magic bullet. This doesn't really answer your question, but maybe gives a sense of perspective at least. I've run a range of sites that provide free online compute to people for over 20 years, starting with sites related to number theory that I hosted at Berkeley back in the late 1990s. Cryptocurrency mining wasn't a problem for the first 10 years, since cryptocurrency didn't exist. Before cryptocurrency, the problems were mainly spammers sending out spam emails, people launching attacks or abusively trying to exhaust all resources (disk, cpu, memory, etc.). People using up all resources became a lot easier to deal with the advent of cgroups and Docker (VM's were not a solution since they are too expensive to allocate for each free user). The next useful filter is to completely disable the network, except for paying customers: this dramatically reduces malicious use, since it's not possible to use CoCalc to launch outgoing DDOS attacks, run port scanners for weaknesses, etc. Disabling the network also discourages crypto miners, since the default crypto mining software typically communicates over the network with a mining pool. Of course, some small percentage of crypto miners will: (1) use a stolen credit card, or (2) manually upload data from a mining pool and manually copy their results out, and similar issues. You then have to deal with each of these problems, and they do cost you time and money. The goal is that they cost you less than the value that comes from having non-paying users, and so far that is the case for us. For (1), using Stripe helps a lot with stolen credit cards, since Stripe is quite good at detecting and preventing use of stolen cards, but they definitely aren't 100%. Regarding (2), there's really no way around having to develop heuristics and scans of your infrastructure to look for malicious and costly behavior, and manually look into it. Indeed, some technique involve silently throttling abusers, so they hopefully don't even realize their attempt to waste your resources is failing. There's also a discussion of this problem linked to from a big red box at https://sagecell.sagemath.org/ https://sagecell.sagemath.org/ All that said, providing compute as a free service to mathematicians at least, isn't hopeless! People appreciate what we do, and the jerks who try to wrecks things for the rest of us haven't succeeded.
benatkin 5y ago
How many zillions of languages can be run client-side with Emscripten and WASM? That isn't why - they're just optimizing the funnel and not caring if hackers think it's cool anymore.
api 5y ago
There are billions of devices in peoples' hands that can run code, but no it all has to be hosted at insane expense because cloud.
wly_cdgr 5y ago
It's fair, but fair is not the same as good