Hacker News Reader

Comment by javajosh | Hacker News Reader

One of the hosting providers should just give this kid a $5/mo VPS in perpetuity. Call it a marketing spend. His heart is totally in the right place - I really respect the thought he's put into his options, and contemplating the downsides of modern day options. The threat model he's worried about is quite real, and I don't think we really know how bad things can get when so much data is accumulated in one place.

That said, I hope he doesn't give up the search for an alternative method, even if it's stashing a box in a hidden part of the library.

View on HN

There already are tons of options for free VMs. I have 4 Oracle Cloud instances with 4 cores, 24gb RAM and 200gb disks total for this exact same use case. I suppose the author prematurely assumed all VPSs are costly or does not want to set up the networking themself.

I did a google search for "free tier vps" and sure enough, it does seem like the standard is roughly $300 in credit (AWS seems to do it differently). Which is enough for a small vps-like-thing for 5 years, or 4 large instances for a few weeks.

The credit for AWS expires after 1 year. Azure credits expire in 90 days. GCP expire after 30. Whether all used or unused.

At least Oracle and GCP have always free instances, that never expire.

GCP's $300 credit is in addition to letting you run one free e2-micro instance indefinitely:

https://cloud.google.com/free/docs/gcp-free-tier/

"Free Tier: All Google Cloud customers can use select Google Cloud products—like Compute Engine, Cloud Storage, and BigQuery—free of charge, within specified monthly usage limits. When you stay within the Free Tier limits, these resources are not charged against your Free Trial credits or to your Cloud Billing account's payment method after your trial ends."

I actually use the GCP free tier to run a few small things, it works really well for me!

There is a small catch though, getting a static IP for the instance is not free, and your egress traffic starts costing after you reach 1GB outgoing data use in a months time.

The cool thing is (afaict), getting a static IP and going over 1GB egress doesn't totally knock you out of the free tier, you just pay for the static IP and any data usage past 1GB. My setup ends up costing me under a dollar per month with a static IP and very light egress usage.

The performance of the machine is not great but it's also not terrible consider the cost. I pretty sure you could run a small website and some other services on it no problem.

Actually WTF, the Oracle always free seems ludacris. I have just moved a couple of my personal projects from DO to Fly because of their amazing free tire, but Oracle's is in a completely different dimention.

I have the same reaction. 4 vCPU + 24GB for free, WTF? I wonder what that's costing them.

Yep, I switched and got a buddy over to them as well. As far as what it's costing them, cloud hosting is a high margin business and it gets them on the map I suppose. I'm hesitant to do actual business with Oracle, but if they provide competent commodity cloud hosting for cheaper than the other guys, why not?

Plus 10TB of outbound bandwidth.

That's my favorite part of Oracle's always free tier[1], in comparison to other offerings.

[1] https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...

What !! Always free ? I'll check it out

The catch is they're Arm servers, so you'll have to check if that's a match for whatever you want to run.

Be warned that they disable free accounts at random, and support will not respond to you. There's many threads in the subreddit about this, and it also happened to me personally.

Any performance benchmarks?

you can find cheap deals on LowEndBox (not affiliated)

https://lowendbox.com

The thing about the threat model is that in the worst case, DDOS protection is about power -- specifically, infrastructural power. It runs in contradiction to decentralization efforts.

Well maybe it should be easier to signal every middlebox that just delivered a nasty segment that you hated that segment and want the sender never contact you again. Should be a disallowed route, with a reasonable decay. Eventually they will exhaust all possible routes to you, to the boundary of the middleboxes they can get to disregard your request.

My understanding is that this would require a change to TCP/IP itself, and NATs make this system probably unworkable in IPv4. But it would result in a truly distributed ddos protection. This also brings to mind the nightmare scenario of exponentionally larger parts of the IPv6 space hoovered up to satisfy the needs of spammers. Imagine burning 1 ip address per message!

This is the first time I've heard this idea and I love it. There should absolutely be a standard for this.

EDIT: Ok, I thought about this a bit... would it actually work? Would the packets just find another path, and actually end up using more network resources as they traverse successively longer routes?

There's a trust issue, too: how far up the chain do you propagate the signal "suspected abuse from this host"? How hard would it be to abuse this system to censor people you don't like?

>would it actually work?

I don't have a mathematical proof, just an intuition about how the graph (nodes are routers, links are routes) would change in time. Yes, the packets might find another path, at least at first, but each time the recipient signals rejection every intermediate goes dark. Eventually, the sender will be surrounded, at some radius, by dark nodes. The best case is if the bad sender is rejected very quickly.

>how far up the chain

All the way, as close to 100% as possible. I would want this to be part of TLS encrypted socket such that either side of the socket can signal unhappiness with the counterparty, and have that be respected. This should be difficult to spoof, so you'd have to pick a way to signal it within the TLS stream, and do packet inspection at the middleboxes. (I never said it would be an easy solution!)

Keyword here being "nasty". You'd need some sort of trust metric to identify malicious clients. This becomes harder with botnets that lay dormant on regular users' systems.

Reply on news.ycombinator.com