4 ms·

One of the hosting providers should just give this kid a $5/mo VPS in perpetuity. Call it a marketing spend. His heart is totally in the right place - I really

One of the hosting providers should just give this kid a $5/mo VPS in perpetuity. Call it a marketing spend. His heart is totally in the right place - I really respect the thought he's put into his options, and contemplating the downsides of modern day options. The threat model he's worried about is quite real, and I don't think we really know how bad things can get when so much data is accumulated in one place. That said, I hope he doesn't give up the search for an alternative method, even if it's stashing a box in a hidden part of the library.

merlinscholz 5y ago
There already are tons of options for free VMs. I have 4 Oracle Cloud instances with 4 cores, 24gb RAM and 200gb disks total for this exact same use case. I suppose the author prematurely assumed all VPSs are costly or does not want to set up the networking themself.
- javajosh 5y ago
  I did a google search for "free tier vps" and sure enough, it does seem like the standard is roughly $300 in credit (AWS seems to do it differently). Which is enough for a small vps-like-thing for 5 years, or 4 large instances for a few weeks.
  - gzer0 5y ago
    The credit for AWS expires after 1 year. Azure credits expire in 90 days. GCP expire after 30. Whether all used or unused.
    - lostmsu 5y ago
      At least Oracle and GCP have always free instances, that never expire.
  - agwa 5y ago
    GCP's $300 credit is in addition to letting you run one free e2-micro instance indefinitely: https://cloud.google.com/free/docs/gcp-free-tier/ https://cloud.google.com/free/docs/gcp-free-tier/ "Free Tier: All Google Cloud customers can use select Google Cloud products—like Compute Engine, Cloud Storage, and BigQuery—free of charge, within specified monthly usage limits. When you stay within the Free Tier limits, these resources are not charged against your Free Trial credits or to your Cloud Billing account's payment method after your trial ends."
    - chlorion 5y ago
      I actually use the GCP free tier to run a few small things, it works really well for me! There is a small catch though, getting a static IP for the instance is not free, and your egress traffic starts costing after you reach 1GB outgoing data use in a months time. The cool thing is (afaict), getting a static IP and going over 1GB egress doesn't totally knock you out of the free tier, you just pay for the static IP and any data usage past 1GB. My setup ends up costing me under a dollar per month with a static IP and very light egress usage. The performance of the machine is not great but it's also not terrible consider the cost. I pretty sure you could run a small website and some other services on it no problem.
- andwaal 5y ago
  Actually WTF, the Oracle always free seems ludacris. I have just moved a couple of my personal projects from DO to Fly because of their amazing free tire, but Oracle's is in a completely different dimention.
  - oschvr 5y ago
    What !! Always free ? I'll check it out
  - systemvoltage 5y ago
    I have the same reaction. 4 vCPU + 24GB for free, WTF? I wonder what that's costing them.
    - hotpotamus 5y ago
      Yep, I switched and got a buddy over to them as well. As far as what it's costing them, cloud hosting is a high margin business and it gets them on the map I suppose. I'm hesitant to do actual business with Oracle, but if they provide competent commodity cloud hosting for cheaper than the other guys, why not?
    - cosmie 5y ago
      Plus 10TB of outbound bandwidth. That's my favorite part of Oracle's always free tier[1], in comparison to other offerings. [1] https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...
  - spiffytech 5y ago
    The catch is they're Arm servers, so you'll have to check if that's a match for whatever you want to run.
  - thegeekpirate 5y ago
    Be warned that they disable free accounts at random, and support will not respond to you. There's many threads in the subreddit about this, and it also happened to me personally.
- Gatsky 5y ago
  Any performance benchmarks?
ushakov 5y ago
you can find cheap deals on LowEndBox (not affiliated) https://lowendbox.com https://lowendbox.com
smasher164 5y ago
The thing about the threat model is that in the worst case, DDOS protection is about power -- specifically, infrastructural power. It runs in contradiction to decentralization efforts.
- javajosh 5y ago
  Well maybe it should be easier to signal every middlebox that just delivered a nasty segment that you hated that segment and want the sender never contact you again. Should be a disallowed route, with a reasonable decay. Eventually they will exhaust all possible routes to you, to the boundary of the middleboxes they can get to disregard your request. My understanding is that this would require a change to TCP/IP itself, and NATs make this system probably unworkable in IPv4. But it would result in a truly distributed ddos protection. This also brings to mind the nightmare scenario of exponentionally larger parts of the IPv6 space hoovered up to satisfy the needs of spammers. Imagine burning 1 ip address per message!
  - titanomachy 5y ago
    This is the first time I've heard this idea and I love it. There should absolutely be a standard for this. EDIT: Ok, I thought about this a bit... would it actually work? Would the packets just find another path, and actually end up using more network resources as they traverse successively longer routes? There's a trust issue, too: how far up the chain do you propagate the signal "suspected abuse from this host"? How hard would it be to abuse this system to censor people you don't like?
    - javajosh 5y ago
      >would it actually work? I don't have a mathematical proof, just an intuition about how the graph (nodes are routers, links are routes) would change in time. Yes, the packets might find another path, at least at first, but each time the recipient signals rejection every intermediate goes dark. Eventually, the sender will be surrounded, at some radius, by dark nodes. The best case is if the bad sender is rejected very quickly. >how far up the chain All the way, as close to 100% as possible. I would want this to be part of TLS encrypted socket such that either side of the socket can signal unhappiness with the counterparty, and have that be respected. This should be difficult to spoof, so you'd have to pick a way to signal it within the TLS stream, and do packet inspection at the middleboxes. (I never said it would be an easy solution!)

merlinscholz 5y ago

There already are tons of options for free VMs. I have 4 Oracle Cloud instances with 4 cores, 24gb RAM and 200gb disks total for this exact same use case. I suppose the author prematurely assumed all VPSs are costly or does not want to set up the networking themself.

javajosh 5y ago
I did a google search for "free tier vps" and sure enough, it does seem like the standard is roughly $300 in credit (AWS seems to do it differently). Which is enough for a small vps-like-thing for 5 years, or 4 large instances for a few weeks.
- gzer0 5y ago
  The credit for AWS expires after 1 year. Azure credits expire in 90 days. GCP expire after 30. Whether all used or unused.
  - lostmsu 5y ago
    At least Oracle and GCP have always free instances, that never expire.
- agwa 5y ago
  GCP's $300 credit is in addition to letting you run one free e2-micro instance indefinitely: https://cloud.google.com/free/docs/gcp-free-tier/ https://cloud.google.com/free/docs/gcp-free-tier/ "Free Tier: All Google Cloud customers can use select Google Cloud products—like Compute Engine, Cloud Storage, and BigQuery—free of charge, within specified monthly usage limits. When you stay within the Free Tier limits, these resources are not charged against your Free Trial credits or to your Cloud Billing account's payment method after your trial ends."
  - chlorion 5y ago
    I actually use the GCP free tier to run a few small things, it works really well for me! There is a small catch though, getting a static IP for the instance is not free, and your egress traffic starts costing after you reach 1GB outgoing data use in a months time. The cool thing is (afaict), getting a static IP and going over 1GB egress doesn't totally knock you out of the free tier, you just pay for the static IP and any data usage past 1GB. My setup ends up costing me under a dollar per month with a static IP and very light egress usage. The performance of the machine is not great but it's also not terrible consider the cost. I pretty sure you could run a small website and some other services on it no problem.
andwaal 5y ago
Actually WTF, the Oracle always free seems ludacris. I have just moved a couple of my personal projects from DO to Fly because of their amazing free tire, but Oracle's is in a completely different dimention.
- oschvr 5y ago
  What !! Always free ? I'll check it out
- systemvoltage 5y ago
  I have the same reaction. 4 vCPU + 24GB for free, WTF? I wonder what that's costing them.
  - hotpotamus 5y ago
    Yep, I switched and got a buddy over to them as well. As far as what it's costing them, cloud hosting is a high margin business and it gets them on the map I suppose. I'm hesitant to do actual business with Oracle, but if they provide competent commodity cloud hosting for cheaper than the other guys, why not?
  - cosmie 5y ago
    Plus 10TB of outbound bandwidth. That's my favorite part of Oracle's always free tier[1], in comparison to other offerings. [1] https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...
- spiffytech 5y ago
  The catch is they're Arm servers, so you'll have to check if that's a match for whatever you want to run.
- thegeekpirate 5y ago
  Be warned that they disable free accounts at random, and support will not respond to you. There's many threads in the subreddit about this, and it also happened to me personally.
Gatsky 5y ago
Any performance benchmarks?

ushakov 5y ago

you can find cheap deals on LowEndBox (not affiliated) https://lowendbox.com https://lowendbox.com

smasher164 5y ago

The thing about the threat model is that in the worst case, DDOS protection is about power -- specifically, infrastructural power. It runs in contradiction to decentralization efforts.

javajosh 5y ago
Well maybe it should be easier to signal every middlebox that just delivered a nasty segment that you hated that segment and want the sender never contact you again. Should be a disallowed route, with a reasonable decay. Eventually they will exhaust all possible routes to you, to the boundary of the middleboxes they can get to disregard your request. My understanding is that this would require a change to TCP/IP itself, and NATs make this system probably unworkable in IPv4. But it would result in a truly distributed ddos protection. This also brings to mind the nightmare scenario of exponentionally larger parts of the IPv6 space hoovered up to satisfy the needs of spammers. Imagine burning 1 ip address per message!
- titanomachy 5y ago
  This is the first time I've heard this idea and I love it. There should absolutely be a standard for this. EDIT: Ok, I thought about this a bit... would it actually work? Would the packets just find another path, and actually end up using more network resources as they traverse successively longer routes? There's a trust issue, too: how far up the chain do you propagate the signal "suspected abuse from this host"? How hard would it be to abuse this system to censor people you don't like?
  - javajosh 5y ago
    >would it actually work? I don't have a mathematical proof, just an intuition about how the graph (nodes are routers, links are routes) would change in time. Yes, the packets might find another path, at least at first, but each time the recipient signals rejection every intermediate goes dark. Eventually, the sender will be surrounded, at some radius, by dark nodes. The best case is if the bad sender is rejected very quickly. >how far up the chain All the way, as close to 100% as possible. I would want this to be part of TLS encrypted socket such that either side of the socket can signal unhappiness with the counterparty, and have that be respected. This should be difficult to spoof, so you'd have to pick a way to signal it within the TLS stream, and do packet inspection at the middleboxes. (I never said it would be an easy solution!)