Pico.sh – SSH powered services for developers
pico.sh
pico.sh
I hate when i see fun side projects that cost the same as full subscriptions to other products. There's only a handful of $15/m services i "want" in my life.. it really raises the barrier to entry when i'm so aware and averse to subscription costs.
Yet $2/m? Instantly sold on that price. It's a fun price, it looks like a fun product, it lines up perfectly for me. It's silly that the price has me almost more interested than the product. Love it
Thanks for this, i plan to try it out!
Any thoughts on how the review will happen when that barrier is reached?
Really glad to see more projects like pico.sh embracing low cost, no frills, indie services. https://99.dev
Am i being too generous?
Further, we are mostly targeting individual/small teams who want to rapidly prototype on the web. We provide enough convenience features (e.g. zero-install, multi-region, site analytics, tunnel connect/disconnect notifications, easy script automation) to entice users to keep their prototypes running in "prod" as long as possible before they feel the need to provision their own VPS.
We could go upstream and try to target larger teams/companies, but honestly, this is just fun for us to do on the side.
We don't make any guarantees about uptime at this point but we take it very seriously (we have alerting and respond quickly) and treat it like our day-jobs (I work at a paas and antonio is a platform engineer wizard).
Happy to answer any questions!
I noticed this mention here [0]:
Because in our Go SSH server we re-implement rsync, many options are currently not supported. For example, --delete and --dry-run are not supported.
Upload your static site to us:
rsync --delete -rv ./public/ pgs.sh:/mysite/
A ssh or TUI frontend for some git/forge host like: https://forgejo.org/ would be pretty cool!
Also, take it from someone who has been running services over port forwards for years. You want to set ClientAliveInterval and ClientAliveCountMax in sshd_config on the server (if you have not already). Users should be encouraged to set ServerAliveCountMax and ServerAliveInterval In ssh_config on their machines. Furthermore, it would be best if the tunnels were run by daemon tools and had ExitOnForwardFailure set as part of the command that is run. The ssh command used at the client side likely also should set -nNT. It is also good practice for the machines running ssh to have dedicated accounts for the tunnels such that their daemon tools scripts are essentially two lines, a shebang followed by exec setuiduid user ssh -i ...
Finally, if people want to do very low overhead and highly secure setups, they should bind the services that they reverse forward to unix domain sockets locally and reverse forward the local unix domain sockets over ssh to remote unix domain sockets. They can use a file mode sticky bit on the parent directory to make the local Unix domain socket accessible by the ssh command running on its own user, which locks things down locally fairly nicely. A typical process running on the machine will not be able to talk to the reverse forwarded service thanks to the Unix file permissions. Lastly, using ed25519 or ecdsa ssh keys would make the initial connection process very quick compared to using RSA.
sish was actually my first foray into SSH apps. It was a lot of fun to write and pretty much implements tunnels with a routing system on top. It manages connectivity, routing, and reverse proxying all within user space. No namespaces required!
tuns can actually even tunnel UDP traffic over SSH, also entirely in user space. Docs for that can be found here: https://pico.sh/tuns#udp-tunneling
Where are your servers located?
What about TOFU and MITM would you like them to respond to? TOFU isn't inherently a bad thing. Neither is MITM. It depends on the threat model, the actors involved, etc.
Your comment (and the snarky followup) imply they're doing something wrong, but it's unclear what.
You can receive their public keys out-of-band through an https-authenticated connection. Which means their approach to "the initial trust problem" is _not_ "trust on first use".
Currently their host key page is only linked once at the bottom of their page and isn’t referenced in any onboarding docs, so effectively onboarding encourages “yolo”, and if users aren’t savvy they’re likely putting other things at risk, whatever their keys happen to also have access to.
The other argument that comes up here then is “well mitms are rare so this doesn’t seem like a big problem in practice”, however there are actually great targets here, for example you go to a conference and hijack the WiFi, then spend your time in hallway track advertising these services to your targets. This kind of thing has a high success rate.
The web improves on this problem with PKI, though similar phishing tactics exist in a similar situation where you encourage people to sign up explicitly guiding them to an incorrect domain, but propensity for using search in address bars strongly helps resist this too.
SSH is terrible for this use case, no matter how it makes people feel.
Would you be willing to share how it’s doing on the business side? Hints on how you’ve grown users or how many folks are willing to subscribe?
I’d love to build a service (in a different domain) that operates as simply as this.
Yes, absolutely. Here's our year-end-review where we talk numbers: https://blog.pico.sh/status-011
Ultimately, what keeps us going is we want these services to exist for our own side-project development and it's an extra boost of motivation when others use our services.
All of our marketing is through HN/lobsters/reddit since that's our target demo.
customdomain.example.com. 300 IN CNAME tuns.sh.
_sish.customdomain.example.com 300 IN TXT "SHA256:mVPw"
What I want to do is:
1- to create a custom domain ON tuns.sh (or another Pico service)
2- redirect this custom domain to another DNS (such as a Load Balancer, an API Gateway, etc.)
Something like: {username}-{proj}.tuns.sh. 300 IN CNAME myalb-123abc.amazonaws.com.
And the two authors, qudat, and antoniomima are active on HN, as their responsive comments here demonstrate. Just good work all around.
I run a B2B SaaS. Support costs is what eats you alive: in case of a complex B2B app anything below $40/month is unsustainable. This is of course better for simpler apps/services, but even there you have to be super careful.
It does also mention there is a $0 "Starter" tier.
(I found that link on this page:
EDIT: Mention the Starter tier.
Back in early 2000s I ran a shared webhosting business, most customer's were savvy at the time and it was kind of a "you're on your own, let me know if the infra is acting up" type arrangement. I ran it with about 2000 customers for a year or so solo and only got about 2 support emails a day. Back then, 24-72 hour response was acceptable so I never needed to be a 24/7 resource.
Similarly, if you think 1000 B2B SaaS subscriptions is an easy-to-achieve number, I'd wager a bet you haven't run a B2B SaaS business.
Roughly, the calculation is: at $40/month, a single subscription brings in $480/year. That means you can safely afford to spend roughly one hour of support on a subscription PER YEAR. If you spend more than 2h, you are definitely in the red. And you will get support requests, of all kinds: the ones you expect, and then all the stuff about lost passwords, inability to log in, network problems, lost invoices, requests to change the billing period, requests for invoices from last year for a customer that has since canceled and been deleted, data export/import, etc.
People who haven't run a business routinely underestimate the costs of running a business and imagine that these numbers mean that business owners are buying yachts and private jets. People who have run a business realize that it's much more difficult to make ends meet than it seems.
I agree to an extent. But it largely depends on the complexity of your offering. If all you do is expose flat data through an API, you can maybe get away with an API Gateway x Lambda x DynamoDB combo, which would cost virtually nothing as the free tier is very generous.
Just my 2c.
Especially with B2B, it's easy to underestimate the support load for non-technical issues.
How does that factor into the $40/month price point ?
In terms of the costs to run a saas, we are actively monitoring hardware utilization and resource allocation. Antonio and I have a lot of experience building and running saas (and paas) products so we feel confident we can manage whatever usage comes our way. We have also been strategic in terms of the services we provide in an effort to keep service support manageable.
Currently you can get some basic email, web hosting, etc. for a one time $1 donation. You can get more for a one time $36 donation.
They also have internal “forums” and chat and such as well as offering a bunch of related services like VPS, dial up, VPN, a Minecraft server, etc. Realistically, you can get a lot more for a lot less with modern hosts but between nostalgia and the limited environment having a particular kind of charm, it is kinda neat.
I joined SDF last year and was disappointed. I was willing to tolerate the limitations (eg. can't change your shell unless "validated"; can't even 'touch' a file...) in exchange for community but it's a ghost town. To make matters worse, IRC for new users is only available on a Sunday!
I would love to give it another shot but I don't understand what its value is in 2025.
Going to poke at it this week myself. Looks like a healthy competitor to PikaPods for the basic stuff.
Keep up the good work!
After I opened my blog, they launched prose.sh, and rest of the services soon after, but since I settled on my blog, and didn't want to change horses, and they discontinued lists.sh, I had to part ways with them.
I admire what they've built though, and wish them best of luck.
This looks like a decent article, will read later.
https://medium.com/@rogergalo/learn-how-easy-is-to-bypass-fi...
Now, if your company is actually blocking the SSH protocol, you’ll have to do something like tunneling SSH through SSL, which is also possible… but not as easier IIRC.
I keep a machine which has sshd listening on the IMAPS port (993) for when I'm traveling. It's amazing how many free networks don't allow ssh, but with -J and sshd on port 993, that really doesn't matter.
You probably aren't supposed to update your personal website and stuff when you are working for your company anyway.
There are a couple oddities I found in the UI.
1. When you sign up the prompt says “signup”. I didn’t know what it wanted. I finally just guessed username and that was right.
2. I couldn’t get tokens to create (which they say are highly recommended). I hit c for create, entered a name, press enter. Nothing.
OP increase your prices!
How do you prevent abuse, like illegal material?
That's a bit over-exaggerated, it certainly isn't fun, nor very interesting, but it's doable, even for smaller organizations. Today is even easier as classification/labeling ML models are pretty good even without any fine-tuning/training on your own dataset.
Not heavy at all, they're really tiny in the grand scale of things and can easily run on CPU only unless you're wanna classify 100s of items per second.
https://lowendbox.com/blog/2-usd-vps-cheap-vps-under-2-month...
For many years now I've been hosting my IRC bouncer on a $13/yr VPS at netcup and it has been more stable than some of my other VPSes.
Right now we run some ML models to check for illegal content and then respond immediately with the ban hammer.
We also monitor content published on our platform with some admin tools we built.
> Promotion/rollback support > Managed HTTPS for all projects > Promotion and rollback support
"Promotion and rollback support" twice...
Don't upload "hate speech" (i.e. demeaning race, gender, age, religious or sexual orientation, etc.)
Don't upload material that is threatening, harassing, defamatory, or that encourages violence or crime
https://github.com/picosh/pico/blob/main/cmd/pastes/ssh/main...
These looks like they are the code for the pastebin.
There’s a bunch of other code related to their other services in that repo and in their other repos as well.
Not any others have this callout, though, from the rsync man page:
> For remote transfers, a modern rsync uses ssh for its communications, but it may have been configured to use a different remote shell by default, such as rsh or remsh.
Edit: Found it already. I was definitely thinking of Putty.