News for hackers. Stuff that matters.

fatchan

I would hope the invoice is 0 for that amount of traffic.
Re:Migrating the main Zig repository from GitHub to Codeberg on Wednesday November 26, 2025 @09:14PM (#46064752)
Github is by far the more woke platform, so I think you missed the point.
Re:Cloudflare Global Network experiencing issues on Tuesday November 18, 2025 @09:29AM (#45966554)
Once again vindicated by running my own CDN and not living with the irrational belief that everything needs cloudflare.
Re:YouTube downloaders (and how Google silenced the press) on Saturday September 20, 2025 @10:59PM (#45319648)
Yeah, currently hosting LLHLS edge nodes in US + EU and caching CDN worldwide. The base cost grows if you have an audience of e.g. 2000 live viewers for a 2mbps stream = 4gbps.

Could be a lot cheaper and less need for global distribution if low latency weren't a requirement. And by low latency I mean the video stream you watch is ~2s behind reality just like Youtube, Twitch, Kick, etc. If your use case is VOD or can tolerate 10s latency streaming, single PoP works fine.

The point is that if I chose Vimeo or AWS/GCP/Azure for this, at their bandwidth pricing my (in my opinion modest) usage would be costing tens of thousands of dollars monthly, which it most certainly does not.

Managed service pricing and the perception of it needs to change, because it feels like a sham once you actually do anything yourself.

Re:YouTube downloaders (and how Google silenced the press) on Saturday September 20, 2025 @10:51PM (#45319622)
You misread the bandwidth cost part of my comment.

A $28/mo (Australian) vimeo subscription, or the "Advanced" $91/mo plan include the same 2TB bandwidth/month for viewers of your videos.

If you upload a 100MB video and it gets 20000 views the whole way through, you are now in the "contact sales" category of pricing.

This is why Youtube has a monopoly, because you've been badly tricked into thinking this pricing is fair and that 2TB is in any way shape or form adequate.

Re:$100K fee added to H1B applications on Saturday September 20, 2025 @02:01AM (#45310834)
Hence https://jobs.now/

Get applying, every application sends a H1-B fraudster home (not, but we can wish).

Re:$100K fee added to H1B applications on Saturday September 20, 2025 @02:00AM (#45310825)
> When you see fraud, report it. https://www.uscis.gov/report-fraud/uscis-tip-form

And tell your manager explicitly and put it on the record that you reported it. Get fired in retaliation? Lawyer up.

Re:YouTube downloaders (and how Google silenced the press) on Saturday September 20, 2025 @01:25AM (#45310639)
People paying for managed services have no concept of bandwidth costs, so they probably think what you just described is impossible.

Bandwidth these days can be less than .25/m at a 100g commit in US/EU, and OVH is pushing dozens of tb/s.

Big ups on keeping independent.

Re:YouTube downloaders (and how Google silenced the press) on Saturday September 20, 2025 @01:19AM (#45310615)
Written by somebody who hasn't taken 1 look at yt-dlp source code or issues. Google regularly pushes updates that "coincidentally" break downloaders. The obfuscation and things they do to e.g. break a download by introducing some breaking code or dynamic calculation required only part way through the video is not normal. They are not serving a bunch of video files or chunks, you need a "client" that handles all these things to download a video. At this point, if you assert that Google doesn't want to secretly stop it, you are either extremely naive, ignorant, or a Google employee.
Re:Self Propagating NPM Malware Compromises over 40 Packages on Wednesday September 17, 2025 @07:50AM (#45274653)
1.2 million weekly downloads to this day, when we've had builtin padStart since ES2017.

Yes, I remember thinking at the time "how are people not ashamed to install this?"

Github is my push --mirror location, nothing more. Main is a popular Gitlab instance gitgud.io, and I host my own secondary mirror.

Gitlab is of course adding more AI and corpo garbage, and once they prevent disabling these "features" on community editions we'll see a fork of gitlab, probably.

The assertion that github is some bustling hub of opportunity is a strange one. At best you get people more likely to contribute because they already signed up, and a contribution from somebody not willing to sign up to another free service or simply email you an issue report is a contribution worth missing.

Re:Next.js Is Infuriating on Tuesday September 02, 2025 @06:47AM (#45101280)
I always use a custom server (even express will work) with next.js, because I found the middleware and edge stuff a load of overcomplicated BS. Client side works like regular react app, SSR for any pages where the initial props are just populated from the server site is easily controlled, and the whole system is simple to reason about. There are other frameworks out there to do this now, but I'm comfortable with this and it just works, so no reason to change.
Re:Oniux: Kernel-level Tor isolation for any Linux app on Sunday June 01, 2025 @12:01AM (#44148571)
No. First of all, just check for `navigator.brave`. If it exists, it's Brave. When I ran a .onion site I added a JavaScript check and if navigator.brave was present, it redirected users to a specific page saying:

> Hey, there's something funny about your Tor Browser. When browsing Tor hidden services (.onion), you should be using Tor Browser. Are you using an outdated version, or perhaps something else entirely?

Brave is chrome. Tor browser is firefox, has a bunch of tweaks, different default settings, and a different fingerprint. Also when browsing on Tor, you should disable JavaScript as it's a source of many vulnerabilities.

Hey, funny to see my project mentioned here also. Yes, similar in concept.

Some differences:

- Uses HAProxy (duh)

- Proof of work can be either sha256 or argon2

- Optional recaptcha/hcaptcha in addition to the proof of work

- Includes a script for your page that will re-solve the challenge in the background before the cookie expires

There's also a control panel, dns server, etc. I kinda built my own everything because I refused to use bunny/cloudflare/whatever.

One thing I will say though, is that proof-of-work alone isn't a solution for ddos mitigation and bot protection! I've seen attackers using a mass of proxies and headless browsers to solve the challenge, or even writing code to extract and solve the challenge directly (https://github.com/lizthegrey/tor-fetcher). To adequately protect against more targeted attacks, you need additional acl and heuristics, browser fingerprinting, tls fingerprinting, ip reputation, etc. I do offer the whole thing setup as a commercial service, but will refrain from too much shilling.

It's fun, and I love seeing similar softwares help fight the horde of AI scrapers :^)

Re:Ferron – a fast, memory-safe web server written in Rust on Saturday April 05, 2025 @06:35AM (#43592354)
Offering more detailed timeouts for other stages of the request would be great, too.

For example with HAProxy you can configure separate timeouts for just about everything. The time a request is queued (if you exceed the max connections), the time for the connection to establish, the time for the request to be recived, inactivity timeout for the client or server, inactivity timeout for websocket connections... The list goes on: https://docs.haproxy.org/3.1/configuration.html#4-timeout%20...

Slowloris is more than just the header timeout. What if the headers are received and the request body is sent, or response consumed very slowly? And even if this is handled with a "safe" default, it must be configurable to cater to a wide range of applications.