4 ms·

I think this is an excellent illustration of a situation where your users get a better experience by being asked to pay money than they get by being given servi

by patio11 12y ago

I think this is an excellent illustration of a situation where your users get a better experience by being asked to pay money than they get by being given services for free. Putting any pay gate in front of this will greatly decrease the amount of abuse you get. You'll still have abuse problems, but abuse is largely a matter of "outrunning your friend, not outrunning the grizzly." When you're free and automatable, you are the weakest link on the Internet for possible exploitation. Even though people can use e.g. stolen credit cards and fake data to sign up for services, you will no longer be the weakest link even with that trivial barrier, greatly decreasing the amount of abuse you'll suffer. This is why Appointment Reminder requires a CC upfront, by the way. I have very little desire to again be on a conference call with a lawyer and a police detective about violation of a restraining order made possible by an ex-husband being able to essentially proxy his harassing phone calls through my software. There exist a variety of potential scalable anti-abuse measures you could implement here. For example, I think that foo.ngrok.com should probably have a low, hard limit on how many IPs/regions/etc should be able to connect with to it. Nobody should be putting production systems on it, so if 100 IPs are connecting to one of the ngrok sites, that's likely either a) abuse or b) a use case which you should not be supporting on a free tier. Relatedly: the problem with abuse, here and elsewhere, isn't limited to "My hosting provider is opening tickets. If I don't catch one, the site shuts down." Abuse which your hosting provider doesn't catch is still abuse. You didn't get into the business to make the Internet a darker, more dangerous place. Make the necessary technical/business changes to avoid operating a public nuisance.

0xbadcafebee 12y ago
Your last paragraph isn't just related, it's the main issue. Before he concerns himself with how to prevent his business from being shut down he should consider if his business is doing more harm than good. By Monday there's going to be 10 job openings in the valley for a Technoethicist.
deleted 12y ago
[deleted]
inconshreveable 12y ago
I disagree with respect to a pay gate. A payment gate on ngrok, even something as simple as requiring a credit card number would pose a significant barrier for a large swath of ngrok users. As some motivating evidence I can tell you: I've had requests to support niche payment systems (whose names I can't even recall) because the country's credit card infrastructure is poor or not commonly used. I've had a number of people tell me that their credit card wouldn't process because their provider is not supported world-wide. ngrok is useful to students, some in high-school or even younger who surely don't have easy access to a credit card. Sure, I could make those people email me with special requests to get around the system, but that greatly degrades the experience and moves initial experience from joy -> frustrating. There are a number of possible technical solutions I would rather pursue first before greatly damaging first-time user experience and funnel.
- josephlord 12y ago
  Can you run your paying customers on a different system (preferably different host provider) to the free ones to prevent a ban triggered by the free users affecting the paying customers?
- biot 12y ago
  If you want to have ngrok as a free public service, then abuse will be hard to get around while keeping it fully featured. However, to preserve the initial user experience you could allow the first 5 IP addresses to access the tunnel of unvalidated accounts. This should let them experience the full benefits themselves and/or with their friends or a few remote services and can keep using it with only those first 5 IP addresses. Afterwards, they can jump through extra hoops to remove restrictions. For example: * Free plan: keep using it with up to 5 IP addresses. Rate limited to 512 Kbps total. * Lite plan: register by having us send you an SMS. Unlocks up to 10 different subnets (allows the entire /24 or /16 etc. network block based on whois lookup). * Home plan: pay us $X and remove all IP restrictions. Up to 5 simultaneous connections at 512 Kbps per connection. * Professional plan: pay us $Y and remove all IP restrictions. Up to 15 simultaneous open connections at 1.5 Mbps each. * Enterprise plan: need something custom? We're happy to put together a quote. This limits your exposure to abuse to the first 5 visitors without degrading the experience. Once that threshold is hit, you can response with a "429 Too Many Requests" type of server response, with a link to more info. You could also let users expire IP addresses/subnets, freeing up new connections from new IPs (with appropriate rate limiting). Successive levels of hoops, both free and financial, unlock additional benefits for those who want to pay for them.
8ig8 12y ago
> I think this is an excellent illustration of a situation where your users get a better experience by being asked to pay money than they get by being given services for free. I don't follow. As a prospective user, trying ngrok for the first time, how is my experience better if I'm required to pay to try it out versus jumping right in and creating my tunnel without creating an account or taking my credit card out of my wallet?
- cookiecaper 12y ago
  Your experience isn't better, except in the degree that the user base benefits from the increased morale, motivation, and time and monetary resources of the business owner. I think this is too intangible to really quantify. I suppose you also benefit from the health of the service's reputation -- if ngrok becomes known primarily for hosting illegal content, it'll most likely be blocked in a way that seriously harms the service you host through it. Patrick is definitely right that it's nice to be able to avoid widespread abuse as a business owner so that you don't have to deal with the cops, etc., but that doesn't have a direct effect on the users.
  - 8ig8 12y ago
    Me, being a dick (trying to make a point)... Does your mom give a shit about the so called user base? I'm a customer. I don't give a shit about the 'user base'. I don't even know what that means. I need run a test on some mobile layouts from my desktop. All this other BS means nothing to me right now. Why is this different from selling detergent in Target?
    - inportb 12y ago
      You're a customer. You don't give a shit about the 'user base'. You don't even know what that means. You need to wash some clothes at home. All this other BS means nothing to you right now. So you head over to Mallwart for some free detergent. Because you could jump right in without creating an account or taking your credit card out of your wallet, you have a vastly improved shopping experience compared to, say, buying detergent at Target. That's the difference. Putting up a paywall limits abuse at the expense of shopping experience.

by patio11 12y ago

0xbadcafebee 12y ago

Your last paragraph isn't just related, it's the main issue. Before he concerns himself with how to prevent his business from being shut down he should consider if his business is doing more harm than good. By Monday there's going to be 10 job openings in the valley for a Technoethicist.

deleted 12y ago

[deleted]

inconshreveable 12y ago

I disagree with respect to a pay gate. A payment gate on ngrok, even something as simple as requiring a credit card number would pose a significant barrier for a large swath of ngrok users. As some motivating evidence I can tell you: I've had requests to support niche payment systems (whose names I can't even recall) because the country's credit card infrastructure is poor or not commonly used. I've had a number of people tell me that their credit card wouldn't process because their provider is not supported world-wide. ngrok is useful to students, some in high-school or even younger who surely don't have easy access to a credit card. Sure, I could make those people email me with special requests to get around the system, but that greatly degrades the experience and moves initial experience from joy -> frustrating. There are a number of possible technical solutions I would rather pursue first before greatly damaging first-time user experience and funnel.

josephlord 12y ago
Can you run your paying customers on a different system (preferably different host provider) to the free ones to prevent a ban triggered by the free users affecting the paying customers?
biot 12y ago
If you want to have ngrok as a free public service, then abuse will be hard to get around while keeping it fully featured. However, to preserve the initial user experience you could allow the first 5 IP addresses to access the tunnel of unvalidated accounts. This should let them experience the full benefits themselves and/or with their friends or a few remote services and can keep using it with only those first 5 IP addresses. Afterwards, they can jump through extra hoops to remove restrictions. For example: * Free plan: keep using it with up to 5 IP addresses. Rate limited to 512 Kbps total. * Lite plan: register by having us send you an SMS. Unlocks up to 10 different subnets (allows the entire /24 or /16 etc. network block based on whois lookup). * Home plan: pay us $X and remove all IP restrictions. Up to 5 simultaneous connections at 512 Kbps per connection. * Professional plan: pay us $Y and remove all IP restrictions. Up to 15 simultaneous open connections at 1.5 Mbps each. * Enterprise plan: need something custom? We're happy to put together a quote. This limits your exposure to abuse to the first 5 visitors without degrading the experience. Once that threshold is hit, you can response with a "429 Too Many Requests" type of server response, with a link to more info. You could also let users expire IP addresses/subnets, freeing up new connections from new IPs (with appropriate rate limiting). Successive levels of hoops, both free and financial, unlock additional benefits for those who want to pay for them.

8ig8 12y ago

> I think this is an excellent illustration of a situation where your users get a better experience by being asked to pay money than they get by being given services for free. I don't follow. As a prospective user, trying ngrok for the first time, how is my experience better if I'm required to pay to try it out versus jumping right in and creating my tunnel without creating an account or taking my credit card out of my wallet?

cookiecaper 12y ago
Your experience isn't better, except in the degree that the user base benefits from the increased morale, motivation, and time and monetary resources of the business owner. I think this is too intangible to really quantify. I suppose you also benefit from the health of the service's reputation -- if ngrok becomes known primarily for hosting illegal content, it'll most likely be blocked in a way that seriously harms the service you host through it. Patrick is definitely right that it's nice to be able to avoid widespread abuse as a business owner so that you don't have to deal with the cops, etc., but that doesn't have a direct effect on the users.
- 8ig8 12y ago
  Me, being a dick (trying to make a point)... Does your mom give a shit about the so called user base? I'm a customer. I don't give a shit about the 'user base'. I don't even know what that means. I need run a test on some mobile layouts from my desktop. All this other BS means nothing to me right now. Why is this different from selling detergent in Target?
  - inportb 12y ago
    You're a customer. You don't give a shit about the 'user base'. You don't even know what that means. You need to wash some clothes at home. All this other BS means nothing to you right now. So you head over to Mallwart for some free detergent. Because you could jump right in without creating an account or taking your credit card out of your wallet, you have a vastly improved shopping experience compared to, say, buying detergent at Target. That's the difference. Putting up a paywall limits abuse at the expense of shopping experience.