7 ms·
Show HN: An open-source media hosting site that's anonymous and fast
- Sir_Cmpwn 13y agoHi, I made this site with jdiez17 over the past few months. We'd love to hear your thoughts on our work.
- Titanous 13y ago"The only thing we store about you is your hashed IP address" The IPv4 address namespace is so small that brute-forcing hashes would be trivial, so this isn't an effective approach.
- jdiez17 13y agoUpdate: looks like it _will_ take a lot of time to bruteforce a single IP: >>> timeit.timeit('bcrypt.generate_password_hash("127.0.0.1")', "from app import bcrypt", number=10) 3.342690944671631
- jdiez17 13y agoTrue. We use 12 rounds of bcrypt, though, so they should be at least moderately secure. It's the best solution we've found so far... we'd be happy to hear alternatives that allow us to generate secure hashes for the IPs and allow us to ban people by IP if necessary. And yes, I know that 12 rounds of bcrypt doesn't mean much. It will delay brute force attacks, though.
- conductor 13y agoYou can only keep the last three bytes of the IP address (e.g. x.1.2.3). And ban only for short time (for example 1-2 hours) when required.
- Sir_Cmpwn 13y agoHm, not a bad idea. Thanks!
- samstave 13y agoBan all .gov and .mil known IPs. Ban all IPs owned by the MIC (KBB, BAA, Etc)
- deleted 13y ago[deleted]
- superuser2 13y agoWhat makes you think these people aren't capable of purchasing or routing through commercially available address space?
- samstave 13y agoThey are certainly capable of paying for it... the facts show though that they are typically not good at shielding their source IP. The wikipedia edit from the senate IP, the tracking of the SAIC IP to NSA etc... Its not a 100% guarantee - but it's a start.
- deleted 13y ago[deleted]
- sehrope 13y agoIf the only purpose is for IP blacklists (bans, dos, etc), then doing 12 rounds of bcrypt would be counter productive. It'd be a lot of CPU usage on your end. Especially if its done for every request. A better approach would be something quicker to compute but that you can destroy equally easily. Generate a random token that cycles every X minutes/hours. The HMAC the remote IP and this secret. Use the result for bans/rolling rate limiting. If you keep the token only in memory then you don't have to worry about the IP lists being leaked as they won't be recoverable.
- StavrosK 13y agoAn even better approach would be a Bloom filter.
- jdiez17 13y agoI've created an issue [1] to discuss this in GitHub - feel free to explain your ideas there and we'll figure out what would work best. [1] https://github.com/MediaCrush/MediaCrush/issues/116 https://github.com/MediaCrush/MediaCrush/issues/116
- dombili 13y agoMaybe I'm blind, but what's the file size limit?
- jdiez17 13y ago25MB. That's not actually stated on the website (good catch) but you can see it here, on the nginx config: https://github.com/MediaCrush/MediaCrush/blob/master/config/nginx.conf#L41 https://github.com/MediaCrush/MediaCrush/blob/master/config/...
- dombili 13y agoOh, thanks. I think this is a promising project but I'd like to point out a couple of things. I tried to upload 3 different files. 2x PNG file (no more than 1MB in total) and a gif file (~5MB). I was only able to upload one of them (one of the PNG files). I tried the upload the same files on 2 different browsers (Chrome 29.0.1547.49 & Firefox 23) in both normal and private mode but the result was the same. Maybe you're dealing with heavy traffic right now or maybe the problem was on my side. I hope I don't sound like I'm criticizing you (not that there's anything wrong with that), but I'm merely pointing out my experience in the first 5 minutes. I'll keep using the service to see if everything works out, though. Because I'm currently looking for a service like yours. Another point I want to make is the similar to the one I've already made. You need to provide more information about the service. Clearly since this is an anonymous service, users won't be able to sign up for an account to manage their files, but what happens when I upload my files? Are they going to be indexed by the search engines? How long are you going to keep my files online?
- Sir_Cmpwn 13y agoCan you link me to your failed images? I'll see what's up. Load isn't too terrible at the moment. As for information, I'll make sure it's more clear on the site, but I'll answer you directly as a temporary measure: When you upload your files, they disappear into our servers and can only be accessed by that URL. If you lost it, just upload it again, we'll hash it on the client before you actually do the upload. As for indexing, view pages are not shown in search engines. Your files stay there forever.
- imperialWicket 13y agoThis is awesome, and I really appreciate the effort toward privacy/transparency. Along those lines, supporting do not track is great, but why use GA at all? Just implementation ease? Is this something you plan to move away from?
- jdiez17 13y agoThanks! Well, GA is quite convenient - we get pretty graphs, realtime analytics and so on. It's not something we have considered moving away from, since it's trivial to disable it entirely. And it's not significantly worse than any other tracking tool.
- imperialWicket 13y agoI'd say it's substantially different from hosting your own Piwik, OWA, or even something like snowplow - where you could elect to avoid IP storage. That said, those all entail a lot of work and/or additional cost. You're also absolutely right that allowing users to disable it (and ads) is an amazing feature.
- philtar 13y agoI've found piwik to be unusable for large datasets
- imperialWicket 13y agoHow large? Piwik is really ancillary to the discussion at hand, but I often see the claim that Piwik can't handle busy sites, and it's important to quantify the claim. I've had success (and others report similar behavior) with 500,000+ hits per day. http://piwik.org/docs/optimize/ http://piwik.org/docs/optimize/ reports adequate support to higher levels. It's quite easy to set this up with EC2 + RDS, and using autoscaling gets you a very resilient solution that can easy handle those numbers. Also, in the case of mediacru.sh, many of the optimizations have little impact since they optimize for reporting on the already-gathered analytics. With only two analytics viewers/users - this is not much of an issue. If you're doing more than 1mil per day, then I think something like snowplow, a commercial solution, or a fully custom solution are appropriate anyway.
- burntsushi 13y agoStellar work. Your openness about everything is incredibly refreshing, and integration with RES was an awesome move. It's an easy choice to make the switch! I am seriously impressed. I loaded up your README on github and had your app running within 10 minutes locally---including `gif` uploads. That's just really nice craftsmanship that is usually missing in fresh projects. Giant kudos to you guys. (There were a couple trivial steps I had to do that weren't documented. I submitted a pull request. [1]) [1] - https://github.com/MediaCrush/MediaCrush/pull/108 https://github.com/MediaCrush/MediaCrush/pull/108
- Zanely 13y agoHmm. Weird i tried this with two of the same MP3 files and it didn't change the file size & quality is the same? :/ Original: http://151.236.11.202/mp3/2.mp3 http://151.236.11.202/mp3/2.mp3 Converted: http://151.236.11.202/mp3/1Vzigd0EXPo1.mp3 http://151.236.11.202/mp3/1Vzigd0EXPo1.mp3 Any suggestions?
- Sir_Cmpwn 13y agoActually, we don't do any processing on mp3 files yet. The following files are compressed to the best of our ability: GIF, JPG, PNG, MP4, OGV, SVG. Got an idea for a good way to compress mp3 files?
- przemoc 13y agoDemo page [1] uses gif made from Chuunibyou demo Koi ga Shitai! [2] anime. Was it totally random choice or MediaCrush crew did it purposely (aside from showing big difference)? Apparently many geeks are after anime, but sadly overall plot-quality of them deteriorates slowly almost each year. That said, Chu2koi was actually one of better series in 2012 Q4 (with nice visual side too). To be less off-topic: good job on making it, openness and finally shipping it. [1] https://mediacru.sh/demo [2] http://en.wikipedia.org/wiki/Love,_Chunibyo_%26_Other_Delusions
- bluefinity 13y agoI thought 2011 and 2012 were pretty good. 2011 had Fate/Zero, Madoka, Steins;Gate, Hunter x Hunter, Mawaru Penguindrum 2012 had From the New World, Jojo's Bizarre Adventure, Humanity has Declined, Mirai Nikki, Hyouka 2013 has.. uh.. Attack on Titan, I guess?
- jdiez17 13y agoHeh, it's certainly not random choice. Sir_Cmpwn is a massive anime geek. Personally, I'd have used a cat gif.
- leke 13y agoAny plans to feature a site search?
- jdiez17 13y agoNope, kind of goes against the idea - there's no way for you to "discover" uploads to mediacrush. We don't even allow crawlers to index media pages.
- aeon10 13y agofrom what I've seen this is all free. which is ofcourse great. and open source too. But I wonder if you guys have a business model? I mean somebody has to pay for those servers right?
- jdiez17 13y agoWe don't have a business model right now. At this stage we're just trying to build a service with the best possible experience for the users. Monetization will come later, we can afford to pay server and bandwidth bills for now. Our only source of income is donations and the advertisements that we show exclusively on the home page. You can check all of our accountability at https://mediacru.sh/transparency https://mediacru.sh/transparency, by the way.
- aeon10 13y agoBrilliant. I wish you guys the best of luck. I hope all of this pays off in the end and you guys can make this awesome product profitable, because I hope to be using this for a long time :)
- denzil_correa 13y agoIt would be nice if you could convert videos from Youtube and convert them into a GIF
- BinaryBullet 13y agoThis is great! Any plans to have an API that other products/services can use? Is it against the TOS to post to /upload from a different domain? I'll be working on a site soon that might allow some type of media upload. Would it be okay to use mediacru.sh for something like that? I could see "free hosting" getting really expensive for you guys though, especially if you allowed hotlinking, etc. Anyways, best of luck to you. Hopefully this becomes profitable for you.
- Sir_Cmpwn 13y agoYou're free to use our API. There's some shitty "docs" here: https://github.com/MediaCrush/MediaCrush/issues/50 https://github.com/MediaCrush/MediaCrush/issues/50
- BinaryBullet 13y agoAwesome. Thanks again!