Hacker News Reader

Comment by seba_dos1 | Hacker News Reader

Except it's not, not really - it's hosted by Cloudflare which even requires you to enable JavaScript to pass.

I've got a pentium 90 I occasionally turn on and I'll reply again when I do here. Hosting stuff from it is wildly taxing. It's on my internal network and I proxy it through apache over a raspberry pi. But it does genuinely serve content to the proxy - which does not cache it.

The machine runs netbsd with apache and has 128MB of memory and, as a cheat I'll admit, uses a SD/IDE bridge device to go to an ATA/100 interface (my older compatible PATA drives were failing on it ... I think there's some shelf-life degradation on those things although I never actually looked it up).

But even on the 100MB/s nic, the thing is unacceptably slow in serving pages. Maybe modern apache not being designed for 1994 hardware has something to do with it. I have some bullshit toy webserver I wrote, geez, 18 years ago, I wonder if it will be faster (https://github.com/kristopolous/apac) ... exciting things to look forward to after I bike home from this coffee shop.

That weird readme was some kind of pre-markdown markdown I had made and have long lost the interpreter for.

update: just tried compiling it. still works and serves pages. I like how I had SunOS support, lol. It's probably comically insecure so have fun I guess?

Here's the pentium 90 running apache: http://bootstra386.com/~hn/

This was a cute blast from the past, thanks for sharing.

it's worth noting, this is a public machine. You can log into it and even make your own account

It's wild to see what's actually slow that's imperceptible now and what claims to be intel 586 32-bit compatible which actually no longer is.

The server may be 24 years old and serving pages, but it's only serving them to the Cloudflare cache, which is kinda meh.

It's not, Cloudflare is just being used for rate limiting / ddos protection here.

Never needed that on my server that's now also a decade old laptop. At least, not for the kind of attention HN#1 gets you (perhaps r/all #1 would be different). I can also imagine it being useful if you run a site that attracts controversy, or if your livelihood depends on it but you're not big enough to have your own datacenter and people want to extort that. Neither is really the case for me, I guess people don't put enough crap on my unfiltered file upload service for me to need big brother protection

I think it's a reasonably good precaution to take with a 24 year old server. I'd imagine on hardware that old you could easily get DOSed by a single mean client (or a web scraper bot with bad behavior), so a ddos isn't even needed.

Also this is available on Cloudflare's free plan so it's much safer to take the precaution in case you might need it down the line, rather than get taken down and have to fiddle with setting up Cloudflare on the spot.

You can also kill my server with a single client. Nobody has for the ~15 years that I've hosted on old laptops now. I've run game servers, a wiki mirror, file upload sites, a Tor exit node, torrent seeding, recently a VM image for a malware analysis course, all sorts of random tools and scripts, you name it; various different audiences but most with some technical know-how, yet nobody has felt the need.

People have messed with things and found bugs (so far always reported more-or-less ethically), and lots of scanners go across the Internet daily, but I've never seen a deliberate take-down effort. (Kind of wondering whether I'm calling that upon myself now, but so be it. Let's see what happens.)

This fear of having to react to a DoS attack by knocking on big brother's door and thus preemptively knocking, it's so anti self hosting mentality, but is also pervasive throughout the self hosting community, I really don't understand it.

The chance that someone wants to connect to your ancient server from an ancient client that can't pass Cloudflare's DDOS protection is probably way higher than someone wanting to DDOS it. (For example, most people may not realize that Cloudflare DDOS basically makes the website inaccessible via TOR for many people.)

Preemptive protection against attacks that never come makes the internet worse for everyone.

This old chestnut again, really? You can whitelist Tor without any issues on CloudFlare. It's one of the first things most people do. Read the documentation.

And service owners go out of their way to check the CF settings and opt in to the darknet... how often exactly?

It's implied with CF that you block people they can't track and prove to be innocent. Hence this old chestnut still existing: it's no joke.

It's gotten somewhat better now that CF is using proof-of-work DDOS protection vs the older captchabullshit, but if you browse the web on Tor you will find LARGE numbers of sites that are CF blocking you.

(Props to HN, it works over tor)

You can even serve up websites via the Tor network instead of using exit nodes: https://developers.cloudflare.com/support/firewall/learn-mor...

If users choose to use a non-standard method to access a service that's not actively supported by the service provider, that's on the user.

How can you tell the difference between cloud flare caching and cloud flare ddos alone?

The "CF-Cache-Status: DYNAMIC" response header seems to indicate that the file was not cached.

https://developers.cloudflare.com/cache/about/default-cache-...

> Cloudflare does not consider the asset eligible to cache and your Cloudflare settings do not explicitly instruct Cloudflare to cache the asset. Instead, the asset was requested from the origin web server. Use Page Rules to implement custom caching options.

That's correct. The only cached resources on this page are the gifs, jpgs, pngs and favicon.

The html page and the hit counter (counter.pl) aren't cached.

I can't even pass with everything enabled (again). I've tried refreshing fifteen times now to try to hit it and I give up.

You cannot have nice things these days anymore, it seems :-/

Still happy to see this project online

Its using cloud flare as a cloud flare tunnel. Still hosted in the cobalt server.

I immediately close the browser tab every time I see the cloudflare spinner.

Very few websites are worth supporting the massive MITM that is cloudflare.

I just see "Enable JavaScript and cookies to continue" and leave.

You're not running arbitrary code on my machine without earning my trust first.

Unfortunately due to a huge volume of spam and bot attacks, we have to turn on maximum Cloudflare settings. Otherwise the server simply can't stay online with the current interest level.

Reply on news.ycombinator.com