News for hackers. Stuff that matters.
Re:NeverSSL by hk__2 on Saturday November 02, 2019 @07:09PM (#21430760)
http://neverssl.com/changes

> I also want to keep neverssl.com ad free, but as it's now costing me about $2,000 a year to host it, […]

Wait, how could hosting a static website cost $2k/year?!

Re:NeverSSL by Iv on Saturday November 02, 2019 @08:43PM (#21431203)
I have been using http://perdu.com/ for 20 years for that purpose.

Simple, probably a 386 computer plugged in somewhere. Never changed.

It is just a joke, the domain means "lost" in French and says "Lost on the internet? Don't panic! We are here to help you: * <- you are here"

Hasn't changed in 20 years, has no javascript, no tracker. Exist since before websites had ads everywhere, and know it would be laughable to put ads on it.

Re:NeverSSL by hirako2000 on Saturday November 02, 2019 @11:33PM (#21431949)
Beware, sometimes the browser will make you think it fetched the page, but it's cached.. Don't panic, there is perdu.org (no cache directives)
Re:NeverSSL by ancarda on Sunday November 03, 2019 @06:18AM (#21433235)
Just to let you know, https://perdu.com/ actually loads for me (note the scheme is https).

I have HTTPS Everywhere (Extension from EFF) configured to try to automatically upgrade to HTTPS. Works for a lot of websites that have TLS without defaulting to it.

NeverSSL actually does not have anything on port 443, so will work even if browsers start trying to upgrade people to HTTPS.

Re:NeverSSL by cbsks on Sunday November 03, 2019 @11:15AM (#21434707)
I used to use http://purple.com, which for many years was just a blank website with a purple background. Then a few years ago the domain was sold to a mattress company :(
Re:NeverSSL by Zarel on Sunday November 03, 2019 @05:20AM (#21433094)
I have a similarly funny one I like to use for this purpose: http://zombo.com/
Re:NeverSSL by stjohnswarts on Sunday November 03, 2019 @02:34PM (#21436035)
Looks like pi-hole is blocking it, any idea why? or did it get hackernews'd?
Re:NeverSSL by exikyut on Sunday November 03, 2019 @05:43AM (#21433146)
I am confused but glad I enabled Flash for that.
Re:NeverSSL by jcelerier on Sunday November 03, 2019 @06:29AM (#21433273)
ow, I've shared perdu.com a few hundred times I think - that is one of the first websites I stumbled upon on the internet when I was in junior high.
Re:NeverSSL by detaro on Saturday November 02, 2019 @07:12PM (#21430770)
from the same page:

> it's just a simple website hosted on AWS

lots of ways of spending a lot of money on hosting a website on AWS. Hard to judge precisely without traffic numbers.

Re:NeverSSL by manigandham on Saturday November 02, 2019 @07:36PM (#21430885)
That page says 6 million hits per day.
Re:NeverSSL by pmlnr on Sunday November 03, 2019 @03:57AM (#21432850)
1 raspberry pi 4 could handle this...
Re:NeverSSL by lonelappde on Sunday November 03, 2019 @09:34AM (#21434065)
Who's opinion carries more merit regarding how a thing can be built? Someone who has built the thing or someone who hasn't?

I'm continually stupefied by how willing so many HN commenters are to publically advertise their ignorance by giving useless advice to actual experts.

Re:NeverSSL by pmlnr on Monday November 04, 2019 @05:38AM (#21440390)
I was about not to bother to respond, but I have a few minutes.

There is an assumption that if there's nothing really visible made by one person it means they don't know what they are talking about. So, background: I'm a linux sysadmin at a very large internet company, and has been running hobby and small business sites for 20 years parallel to this. About a decade ago I wrote cache plugins for WordPress and run a lot of tests of 128MB VPS machines to see when they break. The traffic from neverssl.com really should be fine on a Raspberry Pi 4, because the whole app, including the temporary redirect db needed would easily fit in memory. The OS can be read-only, so the SD card wouldn't wear out either, and the Pi 4 has a Gbit link. But as it's been pointed out, the internet uplink could indeed be a problem, so instead of that, there's Hetzner: 33€/m gets you unlimited traffic, 2GB RAM, 320GB HDD. That's 400€/year, and that's all the cost. Note: Rpi4 has 1-4GB RAM.

Next time please consider that people may actually know what they are talking about even if they don't have their name attached to an "internet scale" service.

Re:NeverSSL by KnMn on Sunday November 03, 2019 @06:01AM (#21433182)
On whose internet?
Re:NeverSSL by morpheuskafka on Saturday November 02, 2019 @10:11PM (#21431580)
You can put an S3 Website behind a Cloudflare distribution (with SSL not enabled) and do it all on the free tier, as far as I know.
Re:NeverSSL by baby on Saturday November 02, 2019 @09:33PM (#21431415)
that's either a lie, or that's because the owner doesn't care about saving costs.

I've hosted more dynamic webpages with large amount of traffic on servers that were costing me 20$/month.

Re:NeverSSL by eyjafjallajokul on Sunday November 03, 2019 @01:47AM (#21432552)
The owner is Colm MacCárthaigh https://twitter.com/colmmacc. He's a Senior Principal Engineer at AWS Networking and is the author of s2n - https://github.com/awslabs/s2n.

I'm pretty sure he knows what he's doing and it costs what it costs for a reason.

Re:NeverSSL by 9HZZRfNlpR on Sunday November 03, 2019 @02:12AM (#21432598)
No doubt he is smart, but it literally costs so much because he is using extremely expensive tools for that. It's literally static content.
Re:NeverSSL by diminoten on Sunday November 03, 2019 @04:09AM (#21432888)
Maybe, but there are a bunch of smart folks here too, and no one can come up with a good reason for this costing $2k/year.

It's possible $166/mo is not enough of a hit on his income so as to be worth spending time optimizing (unlikely considering how little time it'd seemingly take to optimize), or since he works for AWS it could be sponsored (which would mean he has to justify the continued cost to his bosses when they ask about it).

All valid reasons, but not technical ones. Either there's some aspect of implementing this that we're not thinking of, or there are non-technical reasons involved that we're simply unaware of.

Re:NeverSSL by hkai on Sunday November 10, 2019 @12:58AM (#21496648)
That's probably true. I'm paying around 70 USD per month for Azure Functions (an equivalent of AWS Lambda) because they charge like crazy for disk read/writes and my application is quite tiny, definitely could fit on a raspberry pi. But I don't bother to optimize.
Re:NeverSSL by lonelappde on Sunday November 03, 2019 @09:36AM (#21434075)
You know what else no one here has done? Built something cheaper and posted a link.
Re:NeverSSL by hk__2 on Monday November 04, 2019 @05:33PM (#21447347)
> You know what else no one here has done? Built something cheaper and posted a link.

Thousands of people have built that for the past 20+ years without posting a link.

Re:NeverSSL by heavenlyblue on Sunday November 03, 2019 @10:34AM (#21434439)
Why would I as a user care to use that instead?
Re:NeverSSL by diminoten on Sunday November 03, 2019 @01:05PM (#21435461)
I hear it's expensive! :D

But seriously, someone could probably fork and then convert his existing GitHub repo into a GH page...

Re:NeverSSL by why-oh-why on Sunday November 03, 2019 @09:44AM (#21434118)
What a waste of money. The code is hosted on GitHub and it takes 1 minute to move the site to GitHub Pages.

$0/year, forever.

Re:NeverSSL by ric2b on Sunday November 03, 2019 @01:07PM (#21435469)
Can you get github pages without TLS? Usually that would be stupid but in this case it's the core feature of the website.
Re:NeverSSL by xyst on Saturday November 02, 2019 @07:20PM (#21430816)
AWS costs add up over time. $166 per month is not bad, especially if it's a high volume traffic site.
Re:NeverSSL by dev_dull on Sunday November 03, 2019 @12:01AM (#21432070)
I don’t understand. What’s the pricing costs? Bandwidth? Instance hours? S3? A database?!?

This website can literally be hosted on a free tier at almost any major cloud provider.

Re:NeverSSL by ac29 on Sunday November 03, 2019 @01:55PM (#21435785)
Free tiers usually only give you a paltry amount of egress bandwidth, like 1GB. This site is serving 6,000,000 hits a day, according to the author. At 2.8kB/hit, its using a little under 17GB/day. Still, that shouldn't cost $2000/year - one would think serving a couple hundred hits/second of static, easily cached data could be done with something like lightsail for $10/month or less.
Re:NeverSSL by PuffinBlue on Monday November 04, 2019 @05:39AM (#21440392)
You could do it on Digital Ocean or Linode or Vultr or many other providers for $5 a month and use just over half the included bandwidth.
Re:NeverSSL by KnMn on Sunday November 03, 2019 @06:05AM (#21433188)
$20/month for hosting, $146/month for the webmaster's fee.
Re:NeverSSL by artursapek on Saturday November 02, 2019 @07:12PM (#21430774)
Bandwidth, maybe? That page is 53.8 KB total. $2k does seem high though.
Re:NeverSSL by maltalex on Saturday November 02, 2019 @07:36PM (#21430884)
A GB of outbound transfer on AWS costs about 0.09$.

If the page is 55KB, that means that a single GB is about 18K page loads, but let's make that 15K page loads due to various overhead.

To spend 2000$, you'd need to send about 22TB, which are about 330M page loads.

Re:NeverSSL by eatbitseveryday on Saturday November 02, 2019 @07:51PM (#21430958)
> To spend 2000$, you'd need to send about 22TB, which are about 330M page loads.

That equates to 330M/365d = ~900k loads per day.

> it's now grown to about 6 million hits per day, and that's just the traffic that makes it through to the landing page [0]

So he's paying a discount, even.

[0] http://neverssl.com/changes

Re:NeverSSL by ComputerGuru on Saturday November 02, 2019 @07:46PM (#21430925)
But that’s not accounting for gzip.
Re:NeverSSL by gruez on Saturday November 02, 2019 @08:23PM (#21431111)
This. Firefox's dev tools says 3.38KB transferred (including redirect and favicon). Taking that into account, it's closer to 5 billion page loads.
Re:NeverSSL by wincy on Saturday November 02, 2019 @09:44PM (#21431465)
Well if he’s getting 6 million a day that’s a little over 2 billion hits a year. Maybe he’s overprovisioned an AWS instance or something.
Re:NeverSSL by bbernoulli on Saturday November 02, 2019 @10:22PM (#21431642)
I think he's including the transfers from twitter in the 55kb (which is over 50k of it), which wouldn't cost him anything personally
Re:NeverSSL by PuffinBlue on Monday November 04, 2019 @05:33AM (#21440370)
Looks more like 2.7KB and then it loads some resources from Twitter to make up the rest of the size.
Re:NeverSSL by c22 on Saturday November 02, 2019 @07:29PM (#21430861)
When used "properly" it should take even less bandwidth.
Re:NeverSSL by NilsIRL on Sunday November 03, 2019 @10:06AM (#21434239)
The website redirects to a random subdomain which could explain the cost, but even then 2k sounds like a lot.
Re:NeverSSL by laurent123456 on Sunday November 03, 2019 @03:17AM (#21432763)
It just takes a few badly behaved scripts constantly polling the domain.
Re:NeverSSL by Evanbenn on Saturday November 02, 2019 @07:12PM (#21430773)
right! they need to set up a cloudflare proxy, or have github host it for example.
Re:NeverSSL by lima on Saturday November 02, 2019 @07:16PM (#21430798)
Can't do any useful caching for a purposefully cache-busting website
Re:NeverSSL by notatoad on Saturday November 02, 2019 @09:01PM (#21431293)
it's not cache-busting, it's captive-portal busting. there's no reason it couldn't be cached on some service that charges less for bandwidth than AWS does.
Re:NeverSSL by ixxivvix on Sunday November 03, 2019 @12:52AM (#21432267)
Although yours is a valid reason, but I’ve had a colleague of mine who isn’t savvy enough to use this when they need to connect, but they told me they stopped using it because it would show them the page even though they haven’t connected yet because their browser cached the page somehow. I’ve adjusted by using a private/guest browsing mode to open this page but the cache busting cuts it easier for people who have no knowledge of caching.
Re:NeverSSL by lonelappde on Sunday November 03, 2019 @09:37AM (#21434086)
Ctrl-shift-R solves that?
Re:NeverSSL by efreak on Saturday November 09, 2019 @07:11PM (#21495454)
Only if you have a keyboard. If I'm on a captive portal, most likely I'm on my phone.
Re:NeverSSL by homero on Sunday November 03, 2019 @03:26AM (#21432785)
Re:NeverSSL by hn_throwaway_99 on Saturday November 02, 2019 @07:19PM (#21430809)
I'm pretty sure GitHub would require SSL, no?
Re:NeverSSL by morpheuskafka on Saturday November 02, 2019 @10:13PM (#21431588)
Not on a custom domain--it's optional, and you have to have a CAA policy that will allow them to get an SSL cert for your domain and agree to allow them to do so. It's only required for github.io subdomains.
Re:NeverSSL by rumblefrog on Saturday November 02, 2019 @07:35PM (#21430880)
There's an option to enforce it.
Re:NeverSSL by moltar on Saturday November 02, 2019 @09:05PM (#21431301)
Ya maybe use Netlify? It’s free!
Re:NeverSSL by jamietanna on Sunday November 03, 2019 @05:27PM (#21437157)
Not for the amount of bandwidth they'd be using. Netlify's free tier only covers 100GB, which recently I've been finding I've been getting very close to maxing out in my personal site so I can only imagine for a site like that!
Re:NeverSSL by ape4 on Saturday November 02, 2019 @07:13PM (#21430779)
With no graphics