Show HN: Dply – Free temporary Linux servers
dply.co
dply.co
We also provide the ability to create a button for your project allowing you to let people create a server with your service/project running on it for free to try it out. Create a yaml or bash user-data script and others can launch servers with it.
For the last 11 years on and off I've run a small Linux distribution. I work for a well known cloud host by day but in talking with users learned that it's a hassle sometimes to create an account, billing profile and all that when you just need to quickly test or share something so I built this in my free time.
Do you expect to make money on this?
Honestly, no idea. I have a decent credit grant that will cover free 2 hour servers for a while so it was worth trying out.
How do I log into my server?
All servers are created with ssh-key authentication only. You are provided the option to select from the ssh keys on your Github account when you create a server. Your key will be applied to the "root" account.
I am happy to answer any questions about dply.co and would love any feedback.
What's your anti-abuse policy/process?
Yes. You can create another server once the first expires but automating this process is not allowed and therefore we do not provide an API.
https://news.ycombinator.com/item?id=7490766
Just google aws bitcoin mining abuse and see what happens when shitty people have access to free servers.
Why aren't people using AWS free tier to Bitcoin mine?
Seems a bad prop.
As far as the API goes, I don't know if you're aware of how hacking works, but not having an api has protected exactly no one ever. Calling your application secure because "it has a button, not an API" is completely absurd. [2]
As far as costs, you understand that people do thousands of tasks on mechanic turk for pennies right? 5 clicks to make a penny or two isn't out of the question, EVEN WITHOUT AUTOMATION, when the cost for living in some parts of the world is egregiously low. [3]
[1] https://news.ycombinator.com/item?id=6818015
[2] http://www.seleniumhq.org/docs/01_introducing_selenium.jsp
[3] http://online-job-work.com/wp-content/uploads/2013/09/mechan...
You still have to invest either your time or hire someone to set things up for the mechanical turk setup - the opportunity cost you pointed out earlier. And pennies per turk isn't worth it if your ROI is micropennies per turk. Depending on how much friction there is, it may be cheaper to trick your turks into running the bitcoin miner on their own computers.
Not saying there's no potential for abuse - as you say, there is - but saying there's "no costs" and that "You literally can't lose" is about as accurate as saying there's "no profits" and that "You literally can't win". Unless CPU bitcoin mining is wildly more profitable than my understanding, given that you're competing against GPU and ASIC miners.
Maybe one of the alt-currencies that are supposedly harder to GPU mine...?
Or screen scraping. That's still a thing.
I understand hacking. I think this entire project is dead on arrival because it has no business value. He is offering to save me 2 cents at digital ocean and maybe profit if I pay 2x the DO price for a VM with less features. That is why this is a dead product.
Wringing your hands about being hacked to make $0.25 Bitcoin mining? That that is not the problem here.
Having the ability to add more time with Bitcoin or Alipay is also a plus for some people.
A tor bridge/relay might not be an issue but TOR exit nodes will almost certainly result in abuse complaints and action being taken.
> Yes.
Really what I was seeking is to clarify the ambiguity in the parent post's "yes but sometimes no" answer.
Presumably the creator has some limitation in mind such as one user can only spin up so many free 2-hour boxes per 24-hour period, 30-day period, etc. I don't think this was answered clearly as the current answer does not define any limitations which is presumably not reality or it would be abused.
We do not provide an API and automating server creation is a violation of our TOS and would be considered abuse.
When you need a server and can log in and fill out the form, you can create one :)
First impressions: From the sub-pages ("how it works" etc) you should add clearer links to the start page/maybe add a login button on those as well?
You should have some info about who you/your company are if you want people to maybe give you money (maybe that's even legally required)
1.) Our abuse processes. The goal in this area is to both be very strict in preventing abuse while trying to do so with as little inconvenience for legitimate users as possible and
2.) Testing the ROI. Cloud servers are really inexpensive for short periods and we will be testing conversion rates to see if the project can be self-sustaining through the added time model.
I could definately see this working out as a customer aquistion channel for DO, eith Dply getting a referral fee.
Automatic deletion, the built in user-data button system and our acceptance of Bitcoin and Alipay provide options that DO itself currently does not offer.
This is the MVP/Initial Beta of Dply and we're hoping to learn a lot from it. One thing we are testing is whether we'll see high enough conversion rates by users adding time to their servers to cover the costs of the free servers and hopefully make a profit. Acting as a DO referrer is a backup option that could add credit to the platform to help cover costs if the current model proves unsustainable.
I can see the potential for this in the following scenario:
People start using it to showcase the service/software by clicking on a button on GitHub.
Or imagine yet: going to the docker hub, clicking on a button, and getting a server with that up and running.
This might be huge. Providing support for an image with docker and allowing one to use docker compose or the such seems the way to go here.
If this post doesn't reach some of the projects with more potential, you should try to reach out to them yourself.
You should consider adding a "shutdown and delete" button to get rid of VMs when your users are done with them.
Would it be possible to offer a LAMP install for two hours?
This is my first try: I tested to create a "dply" button on https://dply.co/button. I tried not to fill out the form and clicked "CREATE BUTTON". The page replied with errors and their trace. SQL statements and other Ruby keywords were shown.
I think it would be better if there is an error handler, like a warning that form is not filled out completely.
I have this gut feeling that this service will make the cloud technology a bit more accessible for a budding to medium skilled developer.
Personally, I have hesitated a lot to try out AWS and other cloud services at college due to the "over billing nightmare" you have every time you sign up with the credit card. This is particularly an issue at the part of the world I come from. Hopefully, this will bring down that barrier and bring more college students in to experimenting with the cloud tech.
Also, considering the way client meetings getting rescheduled in many cases might help you in generating a lot of cash. ;) (If they haven't created it to restore state in their yaml or bash user-data script, of course!)
Just curious, is a $5/month DO server cost prohibitive in your neck of the woods?
Or maybe even less nefarious reports about people accidently ordering a bigger machine and forgetting about it until the month is over. Can result in 1+k bill as well.
Or the most talked about problem. Downloading something from the glacier.
They're mostly avoidable problems. And they still terrify people with little income
Minor question: are the servers configured for IPv4 only?
Please be more open about the pricing though. When the service costs are not upfront and are buried in the FAQs, I lose trust in the service.
Every real customer of yours will want to know what it costs. Have a simple pricing page at the very least, and link to it from the standard 'how does this work?' and other places. Just saying that you can pay $2 to keep your server running longer is not good enough.
Thank you for allowing Bitcoin. Many people don't have a credit card (everyone who has one gets it only because all the American companies require it, but I never needed one in the Netherlands or Germany, the two countries I have experience with).
Well done!
A few security aspects that I've noticed so far:
- calling the action(s) with an id that doesn't exist will show a pretty useful stacktrace, it should probably be disabled for production
- calling the action(s) with ids close to my server, I can do things to other people's servers (presumably, I didn't confirm the action for any of those, but I can at a minimum see what others have named their servers)
Not trying to be abusive, I just want to make sure we find the security bugs before the bad guys do, because I really like what you've built here.
He wants to make sure that everyone knows he's heard your suggestions and comments and is working on them.
An Expire Now option for free servers should be coming later today!
(No affiliations, I just find this mind blowing)
Edit: Multiple machines if your build is in parallel. Nice.
> Parallelism and SSH Builds
> If your build has parallel steps, we launch more than one VM to perform them. Thus, you’ll see more than one ‘Enable SSH’ and ‘Wait for SSH’ section in the build output.
[1]: https://circleci.com/docs/ssh-build/#parallelism-and-ssh-bui...
That's just the most trivial issue, though, and can be part way resolved by host blocking outbound in 25. You'll also get botnet C&C, hosting of illegal content, use to mask scanning traffic, etc. All of these are sometimes operated by people who do not have a problem with ephemeral services and will happily automate creating new accounts and setting up new "temporary" servers. Using github for authentication will partially help as github no doubt has mechanisms in place to limit automatic account creation, but I'd only trust that so far.
This is definitely for work you could live without, i.e. don't use it for production services. The automatically deleted approach as the first message does lower the trust of stuff not disappearing under your feet.
I think the homepage could do with explaining who it's intended for.
easy to deploy, easy to clean up afterwards. exactly how "Cloud" should be.
I'd find that very useful for demonstrating it to people, which... okay, might not be why you're running this. Nowadays I'm handing out shell accounts to my own server, which is mostly fine, but misses out on some of the functionality.
How am I billed?
Each Droplet is billed per hour up to its monthly cap.
Do I have to pay the cost of the server every time I create a new one?
No—you only need to pay for 1 hour of usage. For example, spinning up a new 512MB server just to test something for a couple of minutes will only cost you $0.0074
But I hope you will succeed because there will probably come a time when I need something like this.
* I love this idea. This is basically what I use Digital Ocean for, and this reduces the steps.
* I would like to see bitbucket sign-in and keys support.
* I missed the server name field on my first pass. My eyes were drawn to the drop-downs. So when I hit the submit I got an error and, even then, it took me a moment to see where the servername should go.
* I probably wouldn't have noticed the "create a button" if I hadn't read about it here.
* I agree with others that a "destroy" option would be nice.
* The button is cool.
This whole approach makes me want to start embedding cloud-init scripts in all my repositories. But then I loose using cloud-init for pulling down my personal dotfiles and preferred packages. I'll have to think about how to solve that.
Great idea! I hope this takes off.
Well now you can find out.
Edit.
ls -al / ls: command not found
etc.
Second, any plan other login/signup methods?
Cool idea, I'll play with it.
https://gist.github.com/AntouanK/190a8e255f0d370ec875f80eaa3...
Lines 1-9 can be the cloud-init you pass to the server. Lines 12-15, run them one by one. Done.
2 Days: $2
1 Week: $3
1 Month: $10
6 Months: $50
On a related note, does anyone know a good way to pay USD for things like this with a foreign (e.g. UK) bank account. If I use my UK VISA I get stung by my bank's criminal conversion change/rate. This is rarely something I need to do but it has arisen a few times now.
Credit cards tend to get much better deals.
I had a look at Monzo before but there was (and still is) a huge waiting list.
Primary use case is travelling abroad, but there's no reason it can't be used for purchases like this in foreign currencies (I've used it both ways myself).
[0] - http://supercard.io
Edit: http://198.199.73.132:8080 if you want to check it out in the next hour and a half
For deployment of small web apps, you have heroku, GAE and now, all of which offer "permanent" hosting.
^ This link will let you create an Ubuntu 16.04 server and will install and configure x2go and an XFCE desktop as soon as it boots. I prefer x2go since it runs over ssh and supports ssh-key authentication by default.
Cool service though!
I caught a bit of an awkward sentence on the FAQ though: "Unless specifically specified otherwise.."
Just "specified" will do :)
edit: the init scripts make setup easy:
How much longer? This can't be $1/HR
In the future if abuse becomes a problem we may consider things like requiring a certain amount of history in the Github account.
We have a lot of experience mitigating fraud and identifying fraudulent accounts. Might be able to give you a few pointers and save you some time.
I have a paid account and besides accessing the content, i can spin up to six virtual machine to test stuff, at no extra cost besides the montly fee.
I'd say a good next step would be to add some more user-data example scripts for common setups.
Awesome job!
1.) Our backend abuse procedures and methods for profiling abusive users to keep them from coming back.
2.) Whether enough people will choose to keep a server by adding more time to pay for the free ones. Each paid server covers the cost of over 100 free 2 hour servers.
We will continue to adjust things based on what we learn and in the future we may add things like a requirement of a certain level of activity and history on Github. Combined with being able to profile abusers this would create a high barrier to entry for anyone wanting to abuse the service without adding a big barrier for legitimate users.
Dply operates with DO's blessing but is otherwise unrelated in any official sense. We launched under a credit like those offered in the Hatch program for startups: https://www.digitalocean.com/hatch/
Do you have a way of preventing email spam and outgoing DoS attacks?
We're implementing a number of things to profile abusers and prevent abuse on the platform and will be strictly enforcing policies against abuse. The lack of an API and prohibition on automating the creation of servers combined with required Github profile for ssh keys help to make the service unattractive for most abuse cases. Our goal is to use these methods to prevent abuse while keeping a very low barrier to entry for legitimate users.
As for "similar color", the dply logo appears to be black. There is some blue (not the same blue) on the page, I guess?
Every link on the page is blue, as well as hovering (which is why I said their 'brand' color not their logo color)
http://i.imgur.com/Pnu6uU3.png
So, two websites, using the same font for their logo, and both using some shade of blue somewhere on the page?
If even with the processes we have in place, abuse becomes an issue we could require that the Github account used has a certain amount of history and activity (doing more to profile the user that way). All these things combined with no API and automation of creation being disallowed makes for a low ROI on an abuser's time compared to other services already available.
Why do this over simpler bandwidth throttling say after a certain threshold has been met?