4 ms·

> Work: https://pachyderm.com/ https://pachyderm.com/ Well, I know what I'm not using if I ever have a need for an ML pipeline.

jrockway 4y ago
Yeah, that's fine. If you want to spend 20,000 hours rewriting our 100% open-source product from scratch because we used to have a hosted offering that was overrun by fraud and I made a rash decision in the middle of the night, feel free! Recommend just downloading the source from Github though and using our work for free. That is absolutely the best way to stick it to me for sharing my thought process on HN. (Use the 19,9999 hours you saved to listen to enjoyable music or hang out with friends! It's fun!) Like I said, I was paged in the middle of the night because protonmail accounts were being created at a rate of hundreds per second to use our hosted free trial to mine crypto. So I blocked the domain name. I'm not saying this is wonderful or anything, but it is what I had to do at the time. I see that my post got massively downvoted, but this is the thought process for people administering things. You get overrun and then you make a rash decision. I basically had the choice to to block protonmail from using the free trial, eliminate free trials, or require everyone in the Universe to type in a credit card, pay their bill and not dispute the charges for 90 days. I chose the first one. Free trials continued for the vast majority of the world. But hey, we ended up deciding not to do the cloud offering (in part because of this), so maybe I fucked up that decision. I'll definitely be thinking about fraud/risk from day 1 the next time I do a cloud service, so that innocent users of email domains abused by fraudsters are not unfairly discriminated against. I didn't do it the first time, and that's on me. I just wanted to share the thought process of someone in the trenches; not make a value judgement of your email provider! You as an individual user of some service can't be held accountable for the actions of the other users of that service. I get that and I feel bad about what I did at the time. But, having been where the UK government is, I totally get where they're coming from. That's all I wanted to say. Protonmail can do some vetting of their customers, so that their emails become more trustworthy, if they feel like it. That would make their product more valuable for all the legitimate users.
- wink 4y ago
  All you're really saying 'freemail is bad because of abuse, gmail is just too big to fail', which is not a whole lot of news after 25 years on the internet, I guess that's where some of the downvotes come from.
- ping00 4y ago
  Appreciate the thoughtful answer despite the downvotes; I didn't consider how bad fraudulent email creation still is -- would CAPTCHA protection have solved this issue? I'm picturing a web GUI for your product, but I see a console offering on your website too.
  - jrockway 4y ago
    They weren't actually doing much automation for account creation; we would see accounts created from mobile phone providers using mobile UAs, and then after they had an API key we'd see the accounts used from compromised cloud hosting accounts. (Free CI trials were probably a big chunk of this too, but I can't prove that.) The mistake we made was really being too generous with free trials; you need the compute to test our product, but free compute is something you just can't give out these days because of the crypto gold rush. I signed up for fly.io recently and they just ask you for a credit card as soon as you hit "create account". We were scared of that at the time, but I thought it was completely reasonable.

jrockway 4y ago

Yeah, that's fine. If you want to spend 20,000 hours rewriting our 100% open-source product from scratch because we used to have a hosted offering that was overrun by fraud and I made a rash decision in the middle of the night, feel free! Recommend just downloading the source from Github though and using our work for free. That is absolutely the best way to stick it to me for sharing my thought process on HN. (Use the 19,9999 hours you saved to listen to enjoyable music or hang out with friends! It's fun!) Like I said, I was paged in the middle of the night because protonmail accounts were being created at a rate of hundreds per second to use our hosted free trial to mine crypto. So I blocked the domain name. I'm not saying this is wonderful or anything, but it is what I had to do at the time. I see that my post got massively downvoted, but this is the thought process for people administering things. You get overrun and then you make a rash decision. I basically had the choice to to block protonmail from using the free trial, eliminate free trials, or require everyone in the Universe to type in a credit card, pay their bill and not dispute the charges for 90 days. I chose the first one. Free trials continued for the vast majority of the world. But hey, we ended up deciding not to do the cloud offering (in part because of this), so maybe I fucked up that decision. I'll definitely be thinking about fraud/risk from day 1 the next time I do a cloud service, so that innocent users of email domains abused by fraudsters are not unfairly discriminated against. I didn't do it the first time, and that's on me. I just wanted to share the thought process of someone in the trenches; not make a value judgement of your email provider! You as an individual user of some service can't be held accountable for the actions of the other users of that service. I get that and I feel bad about what I did at the time. But, having been where the UK government is, I totally get where they're coming from. That's all I wanted to say. Protonmail can do some vetting of their customers, so that their emails become more trustworthy, if they feel like it. That would make their product more valuable for all the legitimate users.

wink 4y ago
All you're really saying 'freemail is bad because of abuse, gmail is just too big to fail', which is not a whole lot of news after 25 years on the internet, I guess that's where some of the downvotes come from.
ping00 4y ago
Appreciate the thoughtful answer despite the downvotes; I didn't consider how bad fraudulent email creation still is -- would CAPTCHA protection have solved this issue? I'm picturing a web GUI for your product, but I see a console offering on your website too.
- jrockway 4y ago
  They weren't actually doing much automation for account creation; we would see accounts created from mobile phone providers using mobile UAs, and then after they had an API key we'd see the accounts used from compromised cloud hosting accounts. (Free CI trials were probably a big chunk of this too, but I can't prove that.) The mistake we made was really being too generous with free trials; you need the compute to test our product, but free compute is something you just can't give out these days because of the crypto gold rush. I signed up for fly.io recently and they just ask you for a credit card as soon as you hit "create account". We were scared of that at the time, but I thought it was completely reasonable.