Hacker News Reader

Comment by jszymborski | Hacker News Reader

Things I love about this:

I would have given my left ear to have a similar service growing up. There were a billion "free hosting" sites that let you throw PHP scripts up on them, and "free mysql" hosts that let you have a couple of free tables of X rows, which give a 12yo an incredible head start when it came to web-dev. The downside is that those sites were trying to push scuzzy gambling sites or were soft targets for hackers. This feels like a clean, modern reincarnation of that!

No, this isn't posterous where your creations will live forever, this is a little playground for those who don't know how to or rather not configure a VPS for a little toy they've made.

Great job!

(EDIT: Shout-out to 2008's T35.com and CJB.net and their free php hosting and short sub-domains https://web.archive.org/web/20080617010556/http://www.t35.co... , https://web.archive.org/web/20080408210303/http://www.cjb.ne...)

View on HN

Thank you for your kind words! In closing I can assure you that your creations will live forever on 1MB as long as you don’t delete your account and follow everything outlined on https://policy.1mb.site. Also pride ourselves in being more secure than your average free website host

Have you had a proper security review? I don't think you would have made that mistake with user-websites being able to log out the user if you had designed with security as an important objective.

Like, it's OK that you didn't, but maybe you should check that your entire public API (all microservices, UI, etc) will really be secure.

You will probably struggle to get a secure interface while user content is served from the same domain as your UI.

For reference @hopscotch appears to be referring to this post: https://forum.1mb.site/?t=1556326142930

I think the interaction in this forum thread says a lot about my focus on security. An issue was reported and I jumped on it immediately. I’m not going to sit here and claim to be perfect, but I am going to tell you that I work really hard to make sure I do stuff right and fix my mistakes ASAP. I have had white hat hackers review my API by the way and have patched reported security vulnerabilities.

Kudos for quickly adding an anti-csrf token to logout, but I agree with the grandparent that hosting arbitrary user content on the same TLD as the management interface is still problematic security-wise.

See github.com vs github.io[1], amazon.com vs. elasticbeanstalk.com, azure.com vs azurewebsites.net, etc... Every major company I know of that hosts arbitrary user content dedicates a TLD to it that's not shared by the management APIs.

[1] https://github.blog/2013-04-05-new-github-pages-domain-githu...

You likely want a separate domain indeed. See https://security.googleblog.com/2012/08/content-hosting-for-...

Sites like Tumblr do it and are fine, and they allow custom HTML and JS also. Cookies are HTTP only and inaccessible with JavaScript. And framing is blocked.

>I don't think you would have made that mistake with user-websites being able to log out the user if you had designed with security as an important objective.

Really? In my experience not many people care about logout CSRF, it's the lowest of low risk vulns that infosec consultants write in a report when they don't have any real vulnerabilities. I'm not sure its presence really says much about the site overall.

Effort is much better spent elsewhere - strict Content-Security-Policy, for example. Or, if there are 'real' CSRF vulns that actually do damage

How are you guaranteeing that sites on 1MB will live forever?

https://news.ycombinator.com/item?id=19774834

They are redefining "forever" to mean "until the service closes".

This reminds me of "lifetime" warranties on products where "lifetime" is defined as some arbitrary lifetime of the product, rather than the lifetime of the buyer.

That's...pretty much the guarantee for any product that claims "lifetime". The Tilley clothing company (best known for their hats) warrants many of their items "forever" as in (and I quote) "leave it in your will". That all goes out the window if Tilley goes out of business, however.

I don't know, that analogy doesn't quite seem right. This company is providing a service, not producing a product - it's more like if the Tilley clothing company said something like "we will continue manufacturing hats forever".

> In closing I can assure you that your creations will live forever on 1MB

I can assure you that the opposite is true. Tumblr deleted half their content. MySpace lost all their content. GeoCities lost everything. Facebook "accidentally" lost Zuckerberg's old posts and with all the money and software "engineers" in the world can't recover them. Startups and corporations that had the kind of money and technical expertise you could only dream of can't keep data forever. Don't get carried away and make promises there is no way you can keep.

EDIT: I see you've redefined forever in the fine print:

> 1MB is not a big company. This is a project funded, developed, and maintained by an individual. By subscribing to Pro you are helping keep this project online for years to come.

> (1) Forever or for the life of the project. 1MB isn't going anywhere, but we also can't predict the future. No refunds!

> GeoCities lost everything.

Small nitpick, but Yahoo deleted everything. Let's not forget how poorly run Yahoo is.

Thanks for the clarification. For the purposes of my argument, the reason why the data no longer exists is irrelevant.

While I'm not trying to invalidate your point, it seems that given the size of 1MB sites you could have a backup of a few milions of websites for under $1[0]. Also, while the maximum size is 1mb not all sites would use all available quota so the actual average size will probably be lower than 1 megabyte driving the cost down even further. This means that that even without VS's or other investors a single person would be able to cover the costs of keeping those sites. Well, assuming there is a will to do so.

[0] For example,archive storage at OVH runs at 0.0026$ per GB, so having a backup of 4 million 1mb sites would cost 1.04$/month for three copies of data.

> software "engineers" The quotes aren't necessary. They definitely have a few good software engineers, and this issue definitely isn't a technical one.

Sorry, that's just personal pet peeve. I like to take a dig at software programmers who call themselves software engineers.

I also notice the inflation of laissez-faire self titling but it usually doesn't bother me. Just the other day I met a flying machine service worker who proudly introduced himself as a copilot. Our train handling ancestry are locomoting over in their repositories about this!

Edit: it looks like these carcas pits are all calling themselves graves now ;-)

Just make sure it shows up on web.archive.org, then it should last pretty long at least.

I ran one of the larger free hosts and managed and hosted around 100 others; security is a big issue. If you get mildly popular the number of attacks will jump up. Hope you know more than I did and that the tech evolved enough; the hosts I built and managed were 10+ years ago and I had to create my own freehost specific patches to php, apache and mysql to protect from abuse. You do not do dynamic so that makes a large difference, still they will try!

Edit; we also made custom scanners for porn and phishing; especially phishing, at that time had a simply pattern; the phishing page(s) would have keywords in them and would not be linked anywhere on the domain while not being the index.html. That allowed us to move almost all of them automatically.

I think neocities.org is closer to what you describe in your first paragraph (and is also ad free and clean).

Can you run e.g. PHP scripts on Neocities? I know this is why I quickly outgrew Angelfire and kin as a kid....

AFAIK it is only static content.

for now :)

Forever.

To be fair though, I don't think that's a huge problem. Plenty of excellent static site generators exist (I use Jekyll) and truth be told if you want any real level of functionality this probably isn't the service for you anyway.

I suspect free-webhosts.com was a site you frequented, too?

God, I'm amazed it's still exactly how I remember it!

I wasted so much time on that gosh darn site...

I'm glad I'm not the only one that visited that website. I was there religiously. If you ever want to get all nostalgic and stuff my email is in my profile!

free.fr has been offering this, ad-free, since the 90s. It is Xavier Niel company, Free is a French ISP and he alos funded "42" : a private, nonprofit and tuition-free computer programming school IT school.

Reply on news.ycombinator.com