Personally I have used GitHub pages and cloudflare pages for hosting static sites and have been very happy with them considering the zero cost involved.
I don't think there is much difference between paying nearlyfreespeech (which I have done in the past) Vs using GitHub or cloudflare - you are still reliant on a third party for actual hosting. I don't really see any value in self-hosting myself - apart from nerdy satisfaction etc, I don't see the need.
The important part in my mind is the fact that I am manually controlling the assets - the HTML the images etc. Simple files on disk.
The git integration with GitHub and cloudflare though is obviously a huge boon though as now I have an off-site backup, and publishing is even more seamless than the old FTP/sftp days - just push to master from within vscode where you are editing the files anyway and it'll be live in 30 seconds (as well as backed up).
A huge advantage of GH / CF is that your site has a strong chance of outliving you, if that's something you care about.
If you're self hosting, either at home or on a VPS, you have to worry about domains expiring and credit cards being cancelled, which is inevitably going to happen if you don't have a succession plan in place. You could probably solve it with a bunch of lawyering, but that's expensive.
Free services don't have this problem. They can still go away, it's not a 100% guarantee, but it's a "might" versus a "definitely will"
20 years ago was 2006. The iPhone wasn’t out yet and the internet was far from how big it is today. These days GH and CF are giants that are synonymous for code storage and the domain resolution respectively. So it’s rather unlikely that these household names of the internet will go down the drain in the next decade.
Watch "The Social Dilemma" carefully, and you will understand it.
The problem with Big Tech is not that they "selling your data". This wouldn't be that profitable to them. The problem is that they make more money by having tons of users and being able to build really accurate consumer behavior models, which then can be used to be used as a way to change mass behavior.
The most direct way is of course by having hyper targeted advertising, but this also affects people in many other ways in ways that are not to the benefit of the user: consider how the applications are designed to maximize engagement instead of being made to help users directly achieve their goals.
When you are the one paying for the service, companies succeed when they serve you better, and the money they can get from you directly is order of magnitudes more than what they'd get by trying to monetize your attention indirectly.
When you're the paying customer, it's possible (but not guaranteed) that they could see privacy as product differentiation.
In other words, if company A and B both offer you a product for $N, but A protects your privacy better than B, then A might get more customers. This competitive advantage can be an incentive for privacy.
However, there definitely limitations. If the value of this competitive advantage is less than the revenue they make by selling your data, then it's not a strong enough incentive. It also only works if consumers care about privacy and take the time to factor it into their purchasing decision.
With a free service it's given because they have to monetize end of the day. For paid services different businesses will have different strategies. Some have a solid business model and are content with it, some want to differentiate themselves using privacy, some simply don't want to take the reputation risk that comes with moves like this. Will there be some sleazy bastards who take your money and your data (cough cough gith*)? Sure, but they will get found out eventually and astute people will be able to steer away.
That’s where being open-source is the hedge. I’m paying for your service and you still fuck me over, I have the option to self host. You start open-source and then start making the product worse? I’m forking and maintaining the old version.
So never bother with anything, am I right? Anything could be bad. Why eat the burger instead of the cyanide pill when there could be cyanide in the burger?
Clearly nobody thinks “paid = never selling data” and I have a hard time believing you actually think their argument is that simple and singular.
If something is paid + open source then you have a good starting point incentive wise for the provider but also if they mess with things under the hood someone will inevitably call it out and you can act accordingly. You also now have more options - you can fork it yourself, someone else may fork it and you can jump ship, etc.
The subthread was arguing about "paid," and you chose to make an argument about "paid + open source" because it was easier (you have no opponent), and then you chose to be condescending about it.
You’re right I accidentally added that element. But the core of my comment doesn’t change even if I remove that. Nobody thinks that “paid” = “not selling data” by default. And for them to act like that was asserted was a bit absurd.
Also I was not being condescending, I was expressing frustration. There has been a serious trend lately of people doing the worst possible interpretations of people’s comments and pulling “well actually…” style responses that borderline seem canned.
However, not paying does not mean that you necessarily become "the product".
Offering loss-leading products is a common business strategy and I'm perfectly okay taking advantage of this for hosting needs that fit a vendor's free tier.
Static hosting is very cheap to offer and gathering free tier users will gain developer mind-share, which helps the vendor can sell their truly money-making products. To pick a clear-cut example: AWS Lambda does not collect any additional data on free tier usage compared to paid usage.
Not really, not for 1¢/day. Most massive platforms that I use for free (Google Workspace, Cloudflare Pages, even Oracle Cloud always free tier) have outlived many low cost solutions I tried.
Nearlyfreespeech is a great service though not a 100% independent as your still relying on them. I think the closest you can get to 100% independent without running your own internet infrastructure is either port forwarding from your home (if allowed) or hosting a website through TOR which isn't too hard. You just have to download the browser and edit a config file (torrc) with the port you want on the network. Not ideal of course though because anyone who wants to visit your website will need the tor browser and explaining to people that your website is on the "dark web" is a little hard to do.
I am a little surprised that doing so isn't more popular on in the indie web scene though as you do it on hardware you own, from your home, and the tor network protects people from knowing your servers ip address if that's something you care about. You could even go to your domain provider and have one of your domains redirect to your .onion address so people don't need to memorize it.
There also used to be the beaker browser which let you create and host your own website directly from the browser but that project got shut down. Hopefully something similar will show up at some point. Maybe a website creating plugin for tor would be enough to make it more popular.
A source repo link often gets more traction here than a link to what might turn out to be a closed, probably subscription based, service. The repo's main readme likely links direct to the product/ service/other main location [if the forge isn't being used as that] or demo location [if a public demo instance exists] should that be where I want to go immediately.
Though maybe posting both the repo link and a "live" link would be better still.
I just happen to not self-host my own code base. But your acting like I paid a penny for that, and self hosting git isn't possible, and we aren't on a forum which exists on the commercial internet.
Why did you still not post an onion link? It's as if you feel people don't like onion links. Which is true, and it's why people don't post onion links.
Does it not demonstrate the trivialness of it which was the case I'm making?
I simply do not want to announce my address here, it's ancillary to the discussion...you shed a layer of security by deciding to make your address public, non of which would benefit the whole point of any of the services I linked.
Circling back to the main discussion of indie web, tor is a great alternative if your circle of visitors is of reasonable size and you want a place outside of the commercialized internet. It's available to anyone.
Paying the penny will certainly give you robustness and reliability...but honestly that's part of the fun of indie web.
>you shed a layer of security by deciding to make your address public, non of which would benefit the whole point
It's possible to host something with no intention of making it internet-public. I also have services like that, that I only use myself or with friends. GP argument is that they don't want to share the onion link to their website, because (bluntly) we are not invited. Onion domains are actually relatively private (i mean unguessable - unlike clearnet domains), so it's possible to host private websites without any additional authorization.
Having said that, onion links carry a implicit baggage, so while I think they're great for sharing things with (technical) friends or a private VPN, they're probably not the best way to host services intended for public.
> It's possible to host something with no intention of making it internet-public.
But this is completely opposite of what most people hosting pages online are doing. Ask a thousand people why they are using Github pages, or Vercel, or netlify... how many of them are not looking for a cheap/free way to have something in the public internet?
> You could even go to your domain provider and have one of your domains redirect to your .onion address so people don't need to memorize it.
Apparently [1] there are also ways that Tor Browser supports, for directing visitors to the onion address via the “normal” internet:
- Onion-Location
> The Onion-Location method was introduced on Tor Browser 9.5 as a way for service operators announce their Onion Services in their regular HTTPS sites. It's specified under tor-browser-spec's Proposal 100 - "Onion redirects using Onion-Location HTTP header".
- Alt-Svc
> Similar to Onion-Location, the Alt-Svc method also uses an HTTP Header (the Alt-Svc Header, specified by RFC 7838), which means that the user first need to access the regular site before their browser discovers the alternate Onion Service address.
> But contrary to Onion-Location, the Alt-Svc method:
> - Does not support an HTML tag, as it relies entirely in the Alt-Svc Header.
> - Is fully transparent: all the discovery and upgrade happens automatically, without user intervention.
- Additionally, they also speak of future possibilities for DNS or DNSSEC-based Onion Association.
Perfect is enemy of the good. Like you said, the only way to be truly independent if people ran their own infrastructure, and if all the hardware was as 100% FOSS.
Of all the compromises we have to do (relying on Telco providers, equipment manufacurers, etc), using Nearlyfreespeech is the less risky one. They have no history of abusing the trust users have placed on them, and service costs virtually nothing.
The internet isn't even capable of handling 8 billion people each with their own infrastructure. Even if everyone got IPv6 and their own PI address block, most DFZ routers can't handle that many routing table entries. Pooling resources is mandatory for the internet to work. However, there needs to be (and are) plenty of choices of who to pool with, so that you can find a trustworthy one.
Note: you don’t need to “download the browser” to use Tor. Tor is a service, not a browser. The “Tor Browser” bundles a privacy-friendly browser with the Tor service, for your convenience. You can run a Tor site on your headless server without installing any browser at all.
Few people host their websites as hidden services because it's just asking too much from anyone who uses your site.
Imagine you are in a conversation with a stranger. You want to show him your personal website. Consider the following two sentences. Which has the highest probability of actually helping him getting on your website?
"Go to myfirstnamelastname.com. Yeah, it's spelled with a K."
"Go to $FIFTYSIXRANDOMCHRACTERS.onion. Oh you need to use the onion browser. Let me help you install it on your phone. Can't find the service? Oh my bad it's actually $FIFTYSIXRANDOMCHARACTERS.onion. There you go."
i host myself with 2 fixed IPs from telekom germany business, its not as expensive as one might expect, under 90€ for a fiber and vdsl line, so next to hosting your own auth ns servers and mail you get failover at home which is nice.
Deutsche Telekom is well known as one of the worst ISPs due to their peering policy. Basically all traffic in or out of DT to/from another ISP is either paid by that ISP at extortionate rates, or takes circuitous routes to avoid paying extortionate rates. For this reason I believe they should be boycotted.
This is a common pattern for ex-national carriers in many countries btw - they believe they should be paid by both sides for all traffic that traverses their network, not just by one side, because they feel like they are God of the Internet in that country.
Indeed. I also depend on my power company, the entire global supply chain to provide me with computers to purchase, copper mines for the networking cables I use, oil fields all over the globe for the plastic, etc etc etc.
This is a pretty weird article/movement.
The greatest hurdle is almost definitely a domain name, which if you want to own the content you have to get. Which even the cheapest would cost you around 6$ a year. (I'm ignoring the "tk" tld, which is kind of a honeypot)
And you can host for a static site for free in a million places. CDNs free tiers are enough for individuals.
I don't get the preoccupation with hosting your own server, what matters is that you own your own identifier (in this case a domain name) whatever it points is vastly less important.
There's negative curiosity involved in trying to reinvent the mid-90s web, but worse.
It's tragic that "your own domain and your own hand-written HTML" has somehow become a glorious ideal, and not a catastrophic failure of the modern imagination.
No one who is truly content-first and not tech-first is remotely (ha...) interested in any of this.
What content-first people want is a drop-in one-click package that sets up a server, secures it and keeps it secure, and installs something like Wordpress, but federated.
And is generally simpler, easier to set up, easier to use, and better.
And prettier.
(Email would be nice too, but we can't have nice things since the oligopolists locked that down with "spam filtering" of itty bitty private domains.)
Pick from a few themes, post, read, interact, leave the customisation and under-the-hood features until later, if you get around to it all.
That's it. That's a what will create a true content-first indienet.
Anything else is just FOSS tinkering for the sake of tinkering, not a credible attempt to create an open platform.
> The field of software engineering is dominated by the smart people that do something not because they have to but out of curiosity.
Emphasis mine.
We wish. I think the state of tech pretty conclusively demonstrates those people aren’t the ones who dominate. Money and power hungry tech bros do, which is why everything is shit and exploitative.
They’re both. There are finance tech bros “idea guys” whose aim is to be at the top of the company, and other tech bros who got into programming for the high salary and clout of being able to say they work at or are ex-employees of Facebook, or Google, or whatever.
This will get worse with new generations. They grow up on tables and phones where file system is a completely foreign concept. You need an app for everything.
I encountered juniors straight out of school who don’t know what tar is, or rsync, or what a symlink is.
It’s all learnable and everyone starts somewhere. But you’d think natural curiosity would kick in and they’d have picked up some of this on their own by the time they have a job.
I didn't even know about tar or rsync until I started to use Linux, and I don't really see how else one get to the point where you need to know about them. And even symlinks are still in my mind as 'shortcuts but [...]' (even though the other way around is probably more accurate). Even as a dev, it's very possible to go through life without touching Linux.
If you've built any open source software ever, it's pretty hard not to know of tar, even if you don't know exactly what it is. I think it's reasonable to expect anyone interested in computers would be familiar with common compression tools, let alone a CS major.
> I think it's reasonable to expect anyone interested in computers would be familiar with common compression tools
So 7zip and Winrar?
I joke, but only halfway. If you're only normal Windows user, you'd never hear of anything else (unless you want to go back to Winzip, which does still exist, but I've never heard of anyone using it any more).
If they were Windows game developers, they wouldn’t have to touch any of that. I guess it depends on where their interests lie and what platform they developed on.
But here’s one I heard literally two days ago: we counted three engineers (out of many) who knew that physical memory was not actually a giant flat space of contiguous addresses, and that there were multiple layers of address-mapping and region-joining glue logic between a program and the hardware, including in os libraries, and even inside the hardware.
Maybe knowing such information is archaic or useless for most engineers. But the good ones (or at least a certain flavor of the good ones) ask questions that lead them there.
How could it be? For example, each memory stick doesn't know beforehand what other memory sticks it will be used with, so the "physical" addressing of the memory on each stick has to be independent of the others, i.e. a local address, that gets mapped to a virtual one.
But that's not relevant? What would be relevant if, depending on where your bits are stored, acces time is significantly slower. If, regardless of where my data goes, my access time is constant then I do not care as a dev?
That's the abstraction I'm working with when coding. Which is necessary because in most cases this should be an implementation detail.
Really not caring about something also means not making a positive and false claim about it. What I said was relevant to that claim. That claim in turn was, according to your heuristics, not relevant (for daily coding).
This guy is right. Physical memory isn't flat. Every system with more than a few cores is NUMA. There are caches and cache lines. Memory channel interleaving. Ranks and banks and rows. Each DRAM chip keeps the last selected row and can access addresses within that row more quickly even if other accesses to other chips occur in the middle, unless a refresh cycle occurs.
It's all a layer below even OS programming. It's configured at the BIOS level and then performed in hardware. But that's the point, isn't it? Virtual memory is below the application programmer, too, but here we're chastising him for not understanding it. If we do that, shouldn't we equally chastise people for not understanding physical memory? Or speculative execution? Or head seeking and servo tracks? Or Ethernet line coding?
Even NUMA is a "flat space of contiguous addresses". There's no bank switching or whatever. Yes, the access times are non-uniform, but that's orthogonal. The point of my comment to the OP is that if you're going to be super-pedantic about this stuff, you need to get your terminology right.
Are we assuming x64? Many ARM systems have gaps in their physical address space. x64 can too but not always. For example the Gameboy Advance used the top 8 bits of the address to identify the peripheral that is accessed.
I wrote x86 assembly back when we were switching from real mode to protected mode, and I still have a feeling that I would not have been able to answer whatever question you asked there in a way that would satisfy you.
I also could no longer tell you how to balance a binary tree or implement Quicksort.
You seem to be under the impression that any part of the average contemporary identity-and-behavioral-development stack encourages asking questions. Babysitting/teach-to-the-test schools don't, authoritarian parents and community authorities and corporate overseers don't, consensus-manufacturing politicians and media don't. (Heck, even our national soccer team doesn't.)(That was a joke.)
Worse, people who find it within themselves to ask questions anyway frequently face silence or a smackdown. The Internet's Own Boy remains no longer with us.
For what it’s worth, I recently retired from a 30 year career as a developer and while I’m aware of all three of those things, I’ve never used any of them in or out of work.
And I’ve hosted my own web server these last 20 years.
I've got a friend, I'll call him Bob, mostly because Bob is nowhere near his real name and I'm about to say some not very flattering things about him. He is my friend and not my job colleague or anything, so there's certain objectivity to this, in fact I appreciate Bob and I wish nothing but the best for him.
Bob has been programming for a bit more than a decade. He is, barring the people I know from other countries, the best paid programmer I know, and I know well over a dozen.
Bob has no interest whatsoever in any programming language that is not what he has been using his whole career, nor does he have any interest or curiosity in dipping his toes in other related fields, web development, tinkering with arduinos, home servers... Nothing. Bob has not built a computer, ever, doesn't know how to do it, nor what each part in that object does, beyond the hard drive because he did plug an extra one once or twice.
More anecdotally I played some Factorio and Satisfactory with Bob, now I know these are not excellent representations, but I expected a degree of order, planning and foresight, I was very much surprised when facing the reality of none of that being present, and I very much did not expect to see the same thing the few times I've looked at his code, but I did see that same thing.
I promise you Bob doesn't make up for all of this in social skills.
Now, is Bob a good engineer? I really, really don't think so. Is he a curious person? A bit, not much, I get the feel he just ended in CS with no particular interest for it, but I'll say it again: He is the best paid programmer I know.
Is that frightening? Well yeah, in a way. It's also endearing in a "Well damn if this guy can do it then surely I can too" sort of way. Money is not everything of course, but it's as good of a proxy as any.
> Considering many people doesn't know what a file is, keeping the spirit alive is important, I think.
Files aren’t sacred. It’s actually troubling that many technical people never consider alternatives. Most of the worlds data today is probably not stored in filesystems, rather in databases and object stores that use custom storage backends.
I didn't make such claim, and there's no need to comeback with such force. A file is a good abstraction of what a "casual" user works with. E-mails, documents, images, videos. These are great applications for files. Also, while some people hate UNIX's "everything is a file" approach with a passion, it's a great way to allow people to explore what's behind the wallpaper they see every day.
You know what, these big databases and object stores are living on bog standard but scalable filesystems most of the time. Ceph, ZFS, Lustre, etc., and sharded/stored as files. There are some very high performance and bespoke systems out there [0], yet they also provide POSIX compliant filesystem views outside, not because they are sacred, but because it works.
Filesystems provide great utilities for making abstractions other than files, by using files as universal containers you can play with. Again, while they are not sacred, they are an important building block, and they're here to stay. Creating a custom storage backend, throwing away all filesystem stuff is a fool's errand, since filesystems handle much more than providing a tree and some attributes on that file/folder hierarchy. Since they are the first level on top of physical storage devices, they also take care of the device underneath them (e.g. TRIM, FFFS (Flash Friendly File System), etc.).
It's a great irony that E-Mails are already stored as human readable databases on disks.
After the nth time of my Android Chrome app silently corrupting and auto-deleting my browsing history (all of it; it's not a bug, it's the intended behavior!), would love to hear about a file alternative that's modular enough to resist that kind of catastrophic failure and interoperable enough to inspect/repair if anything ever happens.
how would any alternative design prevent intended behavior?
But the most obvious alternative to a filesystem would be formatting a whole hard drive as an sqlite database. Obviously it would be a radical rethink in OS design.
There are also "single-level stores" from the last millennium - designs where there is no separation between volatile and nonvolatile storage. All memory in these systems is treated as nonvolatile. A Word document, for example, would be something like a suspended Word process. A directory is a process that only manages pointers to other files and directories. Obviously processes must be extremely lightweight in such a system. KeyKOS is an example of this and you can read papers about it and its Unix emulation layer. This is one of the many things humanity explored before settling on the hierarchical filesystem as the base layer of storage.
> But the most obvious alternative to a filesystem would be formatting a whole hard drive as an sqlite database.
At the end of the day, you'll be chasing pointers inside that SQLite database, where you store tables, indexes and such. Interestingly, this is how a filesystem works. Tables, indexes, redirections and fields. Very much like a database. EXT4 is a table of redirections, nothing fancy [0].
I agree that files aren't sacred, they are just another abstraction at the end of the day, but what the other user (I think) is referring to is the trend in which, as smartphone use becomes ubiquitous, users lose sight of the technical side of things.
It's not that the average user is ignorant of the many ways in which data can be stored and retrieved. It's that they are becoming ignorant of such abstractions existing altogether. It's hard to start thinking about how images are stored if all the user knows is "they are in the gallery".
It's sad that we need this new concept of "IndieWeb", as the whole Internet evolved into a monstrosity hosted and guardrailed by a handful of megacorporations. Hosting files became a privilege, when it should've been a (human) right all along.
edit: The tech to host yourself is obviously still there, but the _mindset_ changed to cloud only.
We are a long removed from when putting something in your public_html folder would instantly give you a personal web site. Not that I am saying people should still hand write html or anything but it was a very quick and natural way to participate back in the day. (A unix account usually gave you automatic p2p chat too using finger to see if your buddy was online and talk/ytalk to talk to them.) This was little less than magic at the time even when your friend was sitting on the terminal right next to you.
Perhaps useful for those training developers mentioned in some posts here who need the TIL experience with unix based systems. Free shell account on a netbsd unix, and I recollect that a small one-off donation provides access to Web space and other enhancements. Choose the login name wisely as that becomes the subdomain for the Web space.
Recently, I had to make a website for an event, so domain was needed, but what's cool with that is that the domain provider (Infomaniak, with which I am not affiliated btw), also provided 10 MB of storage which is large enough for a lot of things.
So for something like 5€ per year (still more than 1c per day...), you can get the domain and the website, which is not too bad
Github Pages is free hosting with domains and ssl, no bills, and has good longevity and prospects. I don't want to worry or think about a static site, and big players like Github and Cloudflare seem to fit that best.
1. Learn how you can get HTML generated from a human-readable and writer-friendly format, say, Markdown (plain-text). This can be Pandoc, a macOS/Win wrapper desktop UI over Pandoc, and many other tools that do this.
2. Learn the process (and the tools) to upload, or sync to a service that hosts the HTML (CSS+JS).
3. Learn the simple steps of owning of a domain, and updating the DNS to point to the right services, such as Github Pages, CloudFlare Pages, etc.
As you are not dependent on a particular tool/service/platform/company, you can walk out and host your files (the website content) elsewhere.
The post-processing of the raw (Markdown) articles/posts to HTML can be then automated with Static Site Generator if someone is willing to learn a little more on top of the above steps.
Of course, it is a fun and good thing to know HTML but that should be optional to the target of “Run your own website 100% independently.” With Github and Cloudfalre, you can hve it for $0 monthly. If they go kaput or stops free, someone will come up - walk out and walk in elsewhere.
> When your posts are individual HTML files (not Markdown files or database entries), they can finally be seen as the individual web pages that they truly are. And that means that you can really lean into making all of your posts unique! They don’t all have to be cookie-cutter paper-doll clones of one another; that’s just a bi-product of modern web publishing tools and the cultural influence that they have on our concept of a “blog”. You can now go ahead and make every blog post as special and individual as you’d like. Each post can have its own personality, baked right into its HTML. Individual style, individual appearance, even individual layout. Literally everything is possible with this approach.
HTML is human-readable and writer friendly. Humans - not even all of them CS students - were reading HTML,JS and CSS on websites and writing it all by hand in text editors for years before the "proper tooling" came along. It really isn't that difficult, especially if you're just dealing with simple websites, doubly so if you're on HN, you probably work with more complex languages on a regular basis.
If you really want to "learn and own a process" and be "100% independent" you should at least be able to understand and work with web languages natively.
Static site generators are nice (I use Nikola) and tools make things easier but but it's still dependency on third party tools if you don't understand or can't otherwise work with the output.
I write technical blog posts with visualizations and live demos. That usually means embedding a bit of custom javascript in the page for the demo. Or shipping custom wasm to enable extreme semantic model compression.
I do this by pushing content from my machine to github pages which is wired up to my subdomain.
If github pages stops being a good, free option for this, I will find another. Not sure I would call this "hardcore" really.
this would work if we had free DNS. solving DNS to be trully decentralized and free is something for years I wish I had more time to work on and build
key properties:
1. everyone can be a registar. your localhost too
2. blockchain proof of ownership and discovery (certs, not proof-of-work, fast and cheap ledger)
3. everyone can be a CA (self-signed certs pinned in blockchain)
4. no fixation on static IPs (inspired by Cloudflare Tunnels, Tailscale). IPs are ephemeral.
5. blockchain/P2P discovery of domains
but it is all fantasy without real browsers support (Chrome, Safari). 99.999% of traffic is locked there, and both controlled by monopolies Google / Apple. and you cannot even build your own browser (Apple App Store will not allow it). Maybe alternative stores and some proxies / translation layer from normal web to this web would help.
Zooko's Triangle says you can't build a name resolution system that's secure, human readable, and decentralised.
DNS is secure (in Zooko's terms - means you can be certain a domain only has one correct resolution) and human readable.
.onion is secure and decentralised.
Petnames (as in I2P) or /etc/hosts are human readable and decentralised.
Also any centralised secure system will quickly have all the names squatted if they are free. It's bad enough at current prices. For instance every dictionary word under .com is already taken. If they cost nothing it would be every pronounceable sequence of up to 12 letters.
Nothing is actually stopping you running "weird DNS" on your home network if you implement the DNS protocol towards clients. I suggest you get familiar with the program Unbound. It's very common for networks to use alternative DNS if only to address the devices on the network.
Also IPs weren't originally meant to be ephemeral. You can get an address block registered to you (v6 only of course, there's no more v4) for a pretty reasonable nominal fee.
You can’t build your own engine outside of the EU, but you can still build on top of the existing Safari engine. What you’re describing is technically possible.
However, why would a company build something just for a handful of people?
I guess if you are Epic games, and you do not want to be blocked or controlled by App Stores, or pay 30% paycut. maybe you would build and support independent (from google/apple monopoly) interenet stack.
or if you are EU/China and do not want google DNS and networkign layer owning entire EU/China
in all cases they would still want centralized control by each state/company.
how to align incentives of someone who can actually pull this off and still keep it decentralized is a big question.
so the only way to make this happen is independent SWEs build their own browser. AND significant portion of users will start use it exclusively AND it survives and crashes competition from OS controlled browsers (Chrome/Safari) AND OS does not block/remove them from OS controlled app stores (which they can and regularly do, just look at "Hey" or "Brave").
you got to go full own hardware stack. now only China can reallistically pull this off.
China has own hardward stack. (actually entirety of all hardware stacks. it is all build there).
China has own playstores or higly regulated versions of Apple/Google play stores.
China has mini-apps ecosystem which is more resilient to App Store whims.
and pretty much China is only place that can reallistically negotiate and push back to Google/Apple.
nobody else can stand a chance.
so free web is only possible in China pretty much. and future of free web is there.
if it was up to corporate monopolies (MSFT, Google, Apple) they would shut down whole web and remove other browsers from OS they control, and be gatekeepers of entire internet unless govenrment threaten them break them up or block them.. oh wait.
I appreciate the sentiment but can't quite tell who the author is targeting. Is it people who don't even know what HTML is, or those who are technical enough to have considered tradeoffs between web hosting options?
For complete beginners, I made https://weejur.com , which is designed to make it easy for even a complete beginner to paste in HTML and get it hosted on GitHub Pages for free. (And is also hosted itself on GitHub for free!)
I don't get it. I've been doing this for over 20 years exactly the same way. I even ran a business. The server I rent is $2/month. I read nothing new in anything in that article.
To me this "knowledge" seems to be a crutch. Real knowledge would show how to do it on their own as thousands of us have done for decades and still do today.
oh yeah, how my opinion changing:
- in schools I used HTML+CSS to make my own site during homework
- after that I understand that no one truly create sites this way. You need JS, framework, database, etc, etc
- now I returned back - I really need only my text editor and HTML+CSS
I self host my site [1] on an old Mac mini in a Swift backend and sqlite database. Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good.
Yup, I have a similar setup where I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server, which proxies the traffic to the server under my own roof. No Cloudflare!
I have something similar. I use Cloudflare tunnels too but also their CDN which is free (for now).
That's the only thing I haven't really been able to figure out how to do on my own. Back in the day, hosting a static site from my crappy DSL connection was basically no problem and most people who were accessing my site were probably in my timezone. Now with how big the web is and how many bots there are, I worry about the quality of self hosting without a CDN.
Bots are over-fearmongered. Yes, you get a lot of bot traffic to any website. No, it isn't a ddos unless you make it a ddos by making your server do 10 seconds of computation on every page load. Just keep an eye on server load so you know when a solution is actually needed, and you'll be fine. Install Anubis if you want to, but there are even simpler checks, like requiring an image or CSS file to be loaded or setting a cookie or putting a simple redirect in JavaScript or meta-refresh.
Cloudflare tunnels are pretty cool. Do you segregate your server from your home domain too? Little weird having cloudflared on my home network. It make things a little more annoying but I haven’t bothered to fix it since I dev on the same production server.
> Cloudflare tunnels for free. I could replace that with port forwarding
You could replace it with something better, like pangolin, either their cloud or even self host it too, and that way you can tunnel to other stuff like if you have a media server where you can watch your movies from anywhere in the world.
Not sure if it is still like this, but jellyfin used to leak massive amounts of metadata. For example by checking the thumbnail paths (which were unauthenticated) you could see what shows/movies someone had.
Might want to warn the "friend" if they don't have auth on the tunnel itself.
They can also take action if they decide you're wasting their bandwidth or (especially) cache space. It's not allowed to host video files on any free cloudflare plan due to cache space.
Well this is great, even going further and hosting the site itself and serve it instead of webhosts, but, now we have domains issue, a domain registrar hijacking your domain, which is your life work, email, etc., so there’s a need to have a free tld that’s uncontrollable by any entity, .onion isn’t practical obviously.
There's no such thing as a TLD that's uncontrollable by any entity. How would you imagine such a thing working? Whatever you imagine: how does it stand up to me editing the hosts file, or the browser's source code?
>There's no such thing as a TLD that's uncontrollable by any entity.
Think .crypto but without the ability to upgrade the smart contract to censor domains. The registry is spread out across a whole decentralized network of computers of which has another decentralized network of computers that proxy requests exists.
>how does it stand up to me editing the hosts file, or the browser's source code?
No one can force you to resolve domains YOU don't want to. You can of course blow up your computer and then you definitely can't resolve the domain. What people mean is that the user is free to still resolve it if they want.
> The registry is spread out across a whole decentralized network of computers of which has another decentralized network of computers that proxy requests exists.
Ultimately, someone has to be in control of who is or is not part of that decentralized network that is the registry. (Or, alternatively phrased, how are you preventing me from saying "I'm part of the .crypto registry, totes.")
Aside from that, the root nameservers is still an entity that is controlled (by ICANN, specifically).
Blockchains have complicated permission systems which isn't the same as having no permission systems. Remember when Vitalik reversed a DAO smart contract transaction he disagreed with? It leaves a cloud of mistrust over Ethereum to this day. There's no reason to think it couldn't happen again.
What does "the user is free to still resolve it if they want" mean in a world where people do not control, or even understand, the software running on their computers? (Because I can tell you, I certainly don't.) This abstraction is a nice idea, but it's unrealistic as part of a serious threat model. Does Joe Q. Public know about the hosts file, or how the Windows network stack selectively overrides its entries, or how some of the Linux userspace uses systemd-resolved, or the things that I don't even know to write here? I'M not the one resolving domains: the software running on MY computer is.
And even if I'm a super genius who's written my own full-stack operating system on my souped-up speccy, I'm still bound by the laws of information theory. If you need information that you don't have, you're necessarily requesting it from a source (here, a computer) external to you (here, outside your control). A complicated network protocol doesn't make that fact go away, and doesn't allow you to ignore it. (It might mitigate various censorship or spoofing approaches, but you only know that if you check: the abstraction won't save you merely by virtue of being an abstraction.)
Note that most ISPs don't allow it on residential plans, but also won't stop you unless you actually create some kind of problem (no ISP actively polices it). If you're rich you can pay more for a business plan (at your home) which would explicitly allow it.
It's fine to host something for friends on a residential ISP. They don't care. If you want to make it a public website it's more uncertain. Still don't worry though, because they won't just ban you from the internet. Worst you'd get is a phone call telling you to stop it.
It's good advice, but one need not even include the "upload it to a web server" these days now that home connections are so fast. Install some static webserver on your desktop computer (nginx, caddy, whatever), forward the port 80 at your router to it's lanip:80, and just save .html and files to the web directory using your normal desktop interface. It doesn't matter if you shut off the computer sometimes. Uptime doesn't matter. Optionally file transfer (rsync, etc) this local copy to a VPS or something like the author suggests.
Indieweb receiving of webmention only requires the ability to log HTTP POSTs to some url endpoint. Or you can use one of third party services servers to receive that interact with your website via with 3rd party javascript applications you include on your webpage. Sending webmention can be done with cURL, even HTML forms, or again, 3rd party JS includes.
However, it'll also bring all the bots and "wild west" of the internet to your house when you run your web server from home, and for anyone who has a couple of spare dollars, it's a much wiser choice to run a small VPS elsewhere to weather the storm.
[Internet facing router with up to date firmware] --> HTTPS --> [separate VLAN DMZ] --> [my hardcore IndieWeb VM/k8s/bare-metal whatever] --> [x No outbound access / paranoid local firewall inside the VM x]
[My home computer] --> SSH --> [my hardcore IndieWeb local cloud]
In 20 years of managing server fleets, I always had the pleasure of watching bots taking a dig at my server(s) the moment I give their public IPs and enable their interfaces.
For someone who knows what they are doing, it's more like mosquito noise, a mere nuisance, but even then, using a rock solid system with all updates installed carries the risk of having a zero-day.
If your server is networked to the rest of the house, and if somebody manages to get in, then it's all fun(!).
For 20 years this was not really an issue. From 2010 to 2020 there wasn't a single nginx cve that applied to my simple static setup. There were literally only a handful of remote CVE at all. With the advent of LLM AI exploit finding there have been 2 CVE this year that I had to look in to. Neither actually applied to me, but it is a different world out there.
That said, the practice of running a modern corporate web browser that auto-executes all programs sent to it from arbitrary unknown third parties is a way, way, way bigger and more common and likely attack surface than a simple static webserver serving files in directories.
You need a static IP address for this to work is the downside, and depending on where you live and who your provider it it can be difficult and/or expensive.
You can programmatically update DNS whenever your dynamic IP changes. One issue though is that some residential ISPs prohibit webhosting in their terms.
you can go ipv6 only, any good isp will give you a static /56 for free. practically none of your users have ipv4 only devices when every major os has been dual stack by default for like 15 years. if your isp cant give you one its time to switch as soon as you can.
Ehh my ISP at home is still ipv4 only. The amount of ipv6 capable connections only just passed 50% worldwide a few months ago.
I don't think ipv6 only is feasible yet unless your audience is exclusively in Asia where ipv6 uptake is much higher due to them running out of ipv4 years ago
You can get a Hurricane Electric free static v6 tunnel.
They have poor reputations and are blocked from streaming sites and so on. But when you're the server, that doesn't affect you.
Note that you need a static v4 and DMZ because the tunnel protocol is a very simple one - presumably because they run it on giant routers. It just puts a v4 header in front of the v6 header. No TCP or UDP.
In practice, I found cloudflare necessary to deter bots/crawlers. It is indeed fairly cheap, but you're still dependent upon three entities you don't really control: the DNS, the host, and Cloudflare.
Fixed IP would be a way to go. Some people pick dynamic dns server so they can periodically update if their IP changes. But IMO it's just too complicated. I don't think there's a good way to go around ISP restrictions, especially in USA.
I host my site on my own home server, but I do have a proxy ec2 server to tunnel public traffic via wireguard back to my home server. This keeps things a bit more protected and my router/home network not directly exposed. I'm also not locked into AWS, I just use them for convenience, but could get any other cheap proxy to run wireguard. No dependency on tailscale either, it's just nicer interface to wireguard. Wireguard config is like 5 lines btw.
Personally I have used GitHub pages and cloudflare pages for hosting static sites and have been very happy with them considering the zero cost involved.
I don't think there is much difference between paying nearlyfreespeech (which I have done in the past) Vs using GitHub or cloudflare - you are still reliant on a third party for actual hosting. I don't really see any value in self-hosting myself - apart from nerdy satisfaction etc, I don't see the need.
The important part in my mind is the fact that I am manually controlling the assets - the HTML the images etc. Simple files on disk.
The git integration with GitHub and cloudflare though is obviously a huge boon though as now I have an off-site backup, and publishing is even more seamless than the old FTP/sftp days - just push to master from within vscode where you are editing the files anyway and it'll be live in 30 seconds (as well as backed up).
A huge advantage of GH / CF is that your site has a strong chance of outliving you, if that's something you care about.
If you're self hosting, either at home or on a VPS, you have to worry about domains expiring and credit cards being cancelled, which is inevitably going to happen if you don't have a succession plan in place. You could probably solve it with a bunch of lawyering, but that's expensive.
Free services don't have this problem. They can still go away, it's not a 100% guarantee, but it's a "might" versus a "definitely will"
How many free hosts from 20 years are still alive? Not many.
20 years ago was 2006. The iPhone wasn’t out yet and the internet was far from how big it is today. These days GH and CF are giants that are synonymous for code storage and the domain resolution respectively. So it’s rather unlikely that these household names of the internet will go down the drain in the next decade.
!RemindMe 10 years
Shoutout 250m.com, you’re not forgotten
When you pay for something, you stop being the product and become the customer instead. That's a big deal.
I've never understood this mentality. Why can't they still sell your data after you pay them? Porque no los dos?
Watch "The Social Dilemma" carefully, and you will understand it.
The problem with Big Tech is not that they "selling your data". This wouldn't be that profitable to them. The problem is that they make more money by having tons of users and being able to build really accurate consumer behavior models, which then can be used to be used as a way to change mass behavior.
The most direct way is of course by having hyper targeted advertising, but this also affects people in many other ways in ways that are not to the benefit of the user: consider how the applications are designed to maximize engagement instead of being made to help users directly achieve their goals.
When you are the one paying for the service, companies succeed when they serve you better, and the money they can get from you directly is order of magnitudes more than what they'd get by trying to monetize your attention indirectly.
When you're the paying customer, it's possible (but not guaranteed) that they could see privacy as product differentiation.
In other words, if company A and B both offer you a product for $N, but A protects your privacy better than B, then A might get more customers. This competitive advantage can be an incentive for privacy.
However, there definitely limitations. If the value of this competitive advantage is less than the revenue they make by selling your data, then it's not a strong enough incentive. It also only works if consumers care about privacy and take the time to factor it into their purchasing decision.
With a free service it's given because they have to monetize end of the day. For paid services different businesses will have different strategies. Some have a solid business model and are content with it, some want to differentiate themselves using privacy, some simply don't want to take the reputation risk that comes with moves like this. Will there be some sleazy bastards who take your money and your data (cough cough gith*)? Sure, but they will get found out eventually and astute people will be able to steer away.
If it's impossible for you to be profitable without abusing your users in some way, then of course you're going to do so.
If it is possible for you to respect your users, then at least better behavior remains on the table.
That’s where being open-source is the hedge. I’m paying for your service and you still fuck me over, I have the option to self host. You start open-source and then start making the product worse? I’m forking and maintaining the old version.
So never bother with anything, am I right? Anything could be bad. Why eat the burger instead of the cyanide pill when there could be cyanide in the burger?
and almost every paid service too. Paid or unpaid is not a useful characteristic for determining if something will sell my data.
Clearly nobody thinks “paid = never selling data” and I have a hard time believing you actually think their argument is that simple and singular.
If something is paid + open source then you have a good starting point incentive wise for the provider but also if they mess with things under the hood someone will inevitably call it out and you can act accordingly. You also now have more options - you can fork it yourself, someone else may fork it and you can jump ship, etc.
The subthread was arguing about "paid," and you chose to make an argument about "paid + open source" because it was easier (you have no opponent), and then you chose to be condescending about it.
You’re right I accidentally added that element. But the core of my comment doesn’t change even if I remove that. Nobody thinks that “paid” = “not selling data” by default. And for them to act like that was asserted was a bit absurd.
Also I was not being condescending, I was expressing frustration. There has been a serious trend lately of people doing the worst possible interpretations of people’s comments and pulling “well actually…” style responses that borderline seem canned.
However, not paying does not mean that you necessarily become "the product".
Offering loss-leading products is a common business strategy and I'm perfectly okay taking advantage of this for hosting needs that fit a vendor's free tier.
Static hosting is very cheap to offer and gathering free tier users will gain developer mind-share, which helps the vendor can sell their truly money-making products. To pick a clear-cut example: AWS Lambda does not collect any additional data on free tier usage compared to paid usage.
It used to be the case in the past, perhaps, but not now.
Now you just get fscked twice.
Not really, not for 1¢/day. Most massive platforms that I use for free (Google Workspace, Cloudflare Pages, even Oracle Cloud always free tier) have outlived many low cost solutions I tried.
Same, but with GitLab pages.
I do the same for my blog [1]
[1] https://gigatexal.blog
Nearlyfreespeech is a great service though not a 100% independent as your still relying on them. I think the closest you can get to 100% independent without running your own internet infrastructure is either port forwarding from your home (if allowed) or hosting a website through TOR which isn't too hard. You just have to download the browser and edit a config file (torrc) with the port you want on the network. Not ideal of course though because anyone who wants to visit your website will need the tor browser and explaining to people that your website is on the "dark web" is a little hard to do.
I am a little surprised that doing so isn't more popular on in the indie web scene though as you do it on hardware you own, from your home, and the tor network protects people from knowing your servers ip address if that's something you care about. You could even go to your domain provider and have one of your domains redirect to your .onion address so people don't need to memorize it.
There also used to be the beaker browser which let you create and host your own website directly from the browser but that project got shut down. Hopefully something similar will show up at some point. Maybe a website creating plugin for tor would be enough to make it more popular.
+1. Why even pay the penny? Spinning a onion service is trivial...and...more secure than the clearwebz.
I've made a few easy to spin up services. Heck, you can even run it off your phone.
Nanogram https://gitlab.com/here_forawhile/nanogram
Spreadsheet Server https://gitlab.com/here_forawhile/spreadsheet
Library Server https://gitlab.com/here_forawhile/libraryserver
Torum (HN Clone) https://gitlab.com/here_forawhile/torum
I wonder if the fact that you linked to clear web source code links rather than onion links demonstrates why people might pay the penny…
Making something as easy as possible to try demonstrates why you need to pay a penny? I don't follow.
Yes, exactly. Because if you’d paid that penny for a server on the regular internet you would just link to the real site
Perhaps. Perhaps not…
A source repo link often gets more traction here than a link to what might turn out to be a closed, probably subscription based, service. The repo's main readme likely links direct to the product/ service/other main location [if the forge isn't being used as that] or demo location [if a public demo instance exists] should that be where I want to go immediately.
Though maybe posting both the repo link and a "live" link would be better still.
I just happen to not self-host my own code base. But your acting like I paid a penny for that, and self hosting git isn't possible, and we aren't on a forum which exists on the commercial internet.
What a silly deflection. The point is obvious: if it is as trivial as you are saying, why aren't you self-hosting?
I am? Just not my codebase lol. I don't see why the two ideas need conflated.
It's a classic "Show, don't tell" example.
If you want to make the point that self-hosting is trivial, then show a site that you are hosting with your setup instead of just pointing to gitlab.
Ok, well here is an example of how easy it would be to set up your own torum for instance. 3 or 4 commands and it's up.
https://nonogra.ph/running-a-website-inside-a-website-07-15-...
I don't feel the need or want to share my services with the world to demonstrate that.
Why did you still not post an onion link? It's as if you feel people don't like onion links. Which is true, and it's why people don't post onion links.
Does it not demonstrate the trivialness of it which was the case I'm making?
I simply do not want to announce my address here, it's ancillary to the discussion...you shed a layer of security by deciding to make your address public, non of which would benefit the whole point of any of the services I linked.
Circling back to the main discussion of indie web, tor is a great alternative if your circle of visitors is of reasonable size and you want a place outside of the commercialized internet. It's available to anyone.
Paying the penny will certainly give you robustness and reliability...but honestly that's part of the fun of indie web.
It demonstrates that you don't actually believe onion links are viable.
GP said:
>you shed a layer of security by deciding to make your address public, non of which would benefit the whole point
It's possible to host something with no intention of making it internet-public. I also have services like that, that I only use myself or with friends. GP argument is that they don't want to share the onion link to their website, because (bluntly) we are not invited. Onion domains are actually relatively private (i mean unguessable - unlike clearnet domains), so it's possible to host private websites without any additional authorization.
Having said that, onion links carry a implicit baggage, so while I think they're great for sharing things with (technical) friends or a private VPN, they're probably not the best way to host services intended for public.
> It's possible to host something with no intention of making it internet-public.
But this is completely opposite of what most people hosting pages online are doing. Ask a thousand people why they are using Github pages, or Vercel, or netlify... how many of them are not looking for a cheap/free way to have something in the public internet?
Yes, it is, but why or what for?
> You could even go to your domain provider and have one of your domains redirect to your .onion address so people don't need to memorize it.
Apparently [1] there are also ways that Tor Browser supports, for directing visitors to the onion address via the “normal” internet:
- Onion-Location
> The Onion-Location method was introduced on Tor Browser 9.5 as a way for service operators announce their Onion Services in their regular HTTPS sites. It's specified under tor-browser-spec's Proposal 100 - "Onion redirects using Onion-Location HTTP header".
- Alt-Svc
> Similar to Onion-Location, the Alt-Svc method also uses an HTTP Header (the Alt-Svc Header, specified by RFC 7838), which means that the user first need to access the regular site before their browser discovers the alternate Onion Service address.
> But contrary to Onion-Location, the Alt-Svc method:
> - Does not support an HTML tag, as it relies entirely in the Alt-Svc Header.
> - Is fully transparent: all the discovery and upgrade happens automatically, without user intervention.
- Additionally, they also speak of future possibilities for DNS or DNSSEC-based Onion Association.
[1]: https://onionservices.torproject.org/research/proposals/usab...
You can see it in action by visiting e.g. https://www.qubes-os.org/ in tor browser
Perfect is enemy of the good. Like you said, the only way to be truly independent if people ran their own infrastructure, and if all the hardware was as 100% FOSS.
Of all the compromises we have to do (relying on Telco providers, equipment manufacurers, etc), using Nearlyfreespeech is the less risky one. They have no history of abusing the trust users have placed on them, and service costs virtually nothing.
The internet isn't even capable of handling 8 billion people each with their own infrastructure. Even if everyone got IPv6 and their own PI address block, most DFZ routers can't handle that many routing table entries. Pooling resources is mandatory for the internet to work. However, there needs to be (and are) plenty of choices of who to pool with, so that you can find a trustworthy one.
Note: you don’t need to “download the browser” to use Tor. Tor is a service, not a browser. The “Tor Browser” bundles a privacy-friendly browser with the Tor service, for your convenience. You can run a Tor site on your headless server without installing any browser at all.
Few people host their websites as hidden services because it's just asking too much from anyone who uses your site.
Imagine you are in a conversation with a stranger. You want to show him your personal website. Consider the following two sentences. Which has the highest probability of actually helping him getting on your website?
"Go to myfirstnamelastname.com. Yeah, it's spelled with a K."
"Go to $FIFTYSIXRANDOMCHRACTERS.onion. Oh you need to use the onion browser. Let me help you install it on your phone. Can't find the service? Oh my bad it's actually $FIFTYSIXRANDOMCHARACTERS.onion. There you go."
With port forwarding, somebody else still owns the identifier that points to your website, whether that's a domain name or an IP address.
Nah, then you're still dependent on Tor. The most independent way is to publish your blog on your own p2p network ;)
Tor is not a single point of failure: It is a p2p network.
That's what I meant. How can you claim to be independent if you aren't even running your own network?
How many directory authorities does Tor have and how many are needed for a consensus?
i host myself with 2 fixed IPs from telekom germany business, its not as expensive as one might expect, under 90€ for a fiber and vdsl line, so next to hosting your own auth ns servers and mail you get failover at home which is nice.
Deutsche Telekom is well known as one of the worst ISPs due to their peering policy. Basically all traffic in or out of DT to/from another ISP is either paid by that ISP at extortionate rates, or takes circuitous routes to avoid paying extortionate rates. For this reason I believe they should be boycotted.
This is a common pattern for ex-national carriers in many countries btw - they believe they should be paid by both sides for all traffic that traverses their network, not just by one side, because they feel like they are God of the Internet in that country.
> port forwarding from your home
Not 100% independent then. You still depend on your isp.
Indeed. I also depend on my power company, the entire global supply chain to provide me with computers to purchase, copper mines for the networking cables I use, oil fields all over the globe for the plastic, etc etc etc.
Something, something, if you want to make an apple pie from scratch you first have to invent the universe.
Incorrect, you need to invent the inventor of the universe.
This is a pretty weird article/movement. The greatest hurdle is almost definitely a domain name, which if you want to own the content you have to get. Which even the cheapest would cost you around 6$ a year. (I'm ignoring the "tk" tld, which is kind of a honeypot)
And you can host for a static site for free in a million places. CDNs free tiers are enough for individuals.
I don't get the preoccupation with hosting your own server, what matters is that you own your own identifier (in this case a domain name) whatever it points is vastly less important.
> I don't get the preoccupation with hosting your own server
The field of software engineering is dominated by the smart people that do something not because they have to but out of curiosity.
I've hired a bunch of people and I was always looking for curiosity and drive most of all. A degree doesn't help you if you don't care.
There's negative curiosity involved in trying to reinvent the mid-90s web, but worse.
It's tragic that "your own domain and your own hand-written HTML" has somehow become a glorious ideal, and not a catastrophic failure of the modern imagination.
No one who is truly content-first and not tech-first is remotely (ha...) interested in any of this.
What content-first people want is a drop-in one-click package that sets up a server, secures it and keeps it secure, and installs something like Wordpress, but federated.
And is generally simpler, easier to set up, easier to use, and better.
And prettier.
(Email would be nice too, but we can't have nice things since the oligopolists locked that down with "spam filtering" of itty bitty private domains.)
Pick from a few themes, post, read, interact, leave the customisation and under-the-hood features until later, if you get around to it all.
That's it. That's a what will create a true content-first indienet.
Anything else is just FOSS tinkering for the sake of tinkering, not a credible attempt to create an open platform.
> The field of software engineering is dominated by the smart people that do something not because they have to but out of curiosity.
Emphasis mine.
We wish. I think the state of tech pretty conclusively demonstrates those people aren’t the ones who dominate. Money and power hungry tech bros do, which is why everything is shit and exploitative.
The tech bros are the ones that control the companies, not the field of software engineering.
They’re both. There are finance tech bros “idea guys” whose aim is to be at the top of the company, and other tech bros who got into programming for the high salary and clout of being able to say they work at or are ex-employees of Facebook, or Google, or whatever.
The shit and exploitation don’t build themselves.
6USD per year adds about 0.016USD per day. Definitely more, still pretty cheap.
What part of this pretty weird article proposed hosting your own server?
Kind of funny that this is like some strange new concept... Having a web server and putting your stuff on it.
Considering many people doesn't know what a file is, keeping the spirit alive is important, I think.
This will get worse with new generations. They grow up on tables and phones where file system is a completely foreign concept. You need an app for everything.
It's not like the preceding generations were any different, until they had to do work on a PC.
I encountered juniors straight out of school who don’t know what tar is, or rsync, or what a symlink is.
It’s all learnable and everyone starts somewhere. But you’d think natural curiosity would kick in and they’d have picked up some of this on their own by the time they have a job.
I didn't even know about tar or rsync until I started to use Linux, and I don't really see how else one get to the point where you need to know about them. And even symlinks are still in my mind as 'shortcuts but [...]' (even though the other way around is probably more accurate). Even as a dev, it's very possible to go through life without touching Linux.
If you've built any open source software ever, it's pretty hard not to know of tar, even if you don't know exactly what it is. I think it's reasonable to expect anyone interested in computers would be familiar with common compression tools, let alone a CS major.
> I think it's reasonable to expect anyone interested in computers would be familiar with common compression tools
So 7zip and Winrar?
I joke, but only halfway. If you're only normal Windows user, you'd never hear of anything else (unless you want to go back to Winzip, which does still exist, but I've never heard of anyone using it any more).
If they were Windows game developers, they wouldn’t have to touch any of that. I guess it depends on where their interests lie and what platform they developed on.
Ok, sure, windows.
But here’s one I heard literally two days ago: we counted three engineers (out of many) who knew that physical memory was not actually a giant flat space of contiguous addresses, and that there were multiple layers of address-mapping and region-joining glue logic between a program and the hardware, including in os libraries, and even inside the hardware.
Maybe knowing such information is archaic or useless for most engineers. But the good ones (or at least a certain flavor of the good ones) ask questions that lead them there.
But physical memory is a giant flat space of contiguous addresses. Do you mean virtual memory?
I almost questioned the same thing but I think we both know that's what he meant.
How could it be? For example, each memory stick doesn't know beforehand what other memory sticks it will be used with, so the "physical" addressing of the memory on each stick has to be independent of the others, i.e. a local address, that gets mapped to a virtual one.
But that's not relevant? What would be relevant if, depending on where your bits are stored, acces time is significantly slower. If, regardless of where my data goes, my access time is constant then I do not care as a dev?
That's the abstraction I'm working with when coding. Which is necessary because in most cases this should be an implementation detail.
Really not caring about something also means not making a positive and false claim about it. What I said was relevant to that claim. That claim in turn was, according to your heuristics, not relevant (for daily coding).
This guy is right. Physical memory isn't flat. Every system with more than a few cores is NUMA. There are caches and cache lines. Memory channel interleaving. Ranks and banks and rows. Each DRAM chip keeps the last selected row and can access addresses within that row more quickly even if other accesses to other chips occur in the middle, unless a refresh cycle occurs.
It's all a layer below even OS programming. It's configured at the BIOS level and then performed in hardware. But that's the point, isn't it? Virtual memory is below the application programmer, too, but here we're chastising him for not understanding it. If we do that, shouldn't we equally chastise people for not understanding physical memory? Or speculative execution? Or head seeking and servo tracks? Or Ethernet line coding?
Even NUMA is a "flat space of contiguous addresses". There's no bank switching or whatever. Yes, the access times are non-uniform, but that's orthogonal. The point of my comment to the OP is that if you're going to be super-pedantic about this stuff, you need to get your terminology right.
Are we assuming x64? Many ARM systems have gaps in their physical address space. x64 can too but not always. For example the Gameboy Advance used the top 8 bits of the address to identify the peripheral that is accessed.
I wrote x86 assembly back when we were switching from real mode to protected mode, and I still have a feeling that I would not have been able to answer whatever question you asked there in a way that would satisfy you.
I also could no longer tell you how to balance a binary tree or implement Quicksort.
You seem to be under the impression that any part of the average contemporary identity-and-behavioral-development stack encourages asking questions. Babysitting/teach-to-the-test schools don't, authoritarian parents and community authorities and corporate overseers don't, consensus-manufacturing politicians and media don't. (Heck, even our national soccer team doesn't.)(That was a joke.)
Worse, people who find it within themselves to ask questions anyway frequently face silence or a smackdown. The Internet's Own Boy remains no longer with us.
For what it’s worth, I recently retired from a 30 year career as a developer and while I’m aware of all three of those things, I’ve never used any of them in or out of work.
And I’ve hosted my own web server these last 20 years.
Windows web server?
If all you do is write code for Windows, why would you need to know what any of that is?
Because Steam... /s
The lack of basic computer knowledge I’ve seen from developers is terrifying.
It's almost inspiring how far someone can get without understanding really basic stuff about how an operating system operates.
> inspiring
You spelled "frightening" wrong.
It's a complex feeling, really.
I've got a friend, I'll call him Bob, mostly because Bob is nowhere near his real name and I'm about to say some not very flattering things about him. He is my friend and not my job colleague or anything, so there's certain objectivity to this, in fact I appreciate Bob and I wish nothing but the best for him.
Bob has been programming for a bit more than a decade. He is, barring the people I know from other countries, the best paid programmer I know, and I know well over a dozen.
Bob has no interest whatsoever in any programming language that is not what he has been using his whole career, nor does he have any interest or curiosity in dipping his toes in other related fields, web development, tinkering with arduinos, home servers... Nothing. Bob has not built a computer, ever, doesn't know how to do it, nor what each part in that object does, beyond the hard drive because he did plug an extra one once or twice.
More anecdotally I played some Factorio and Satisfactory with Bob, now I know these are not excellent representations, but I expected a degree of order, planning and foresight, I was very much surprised when facing the reality of none of that being present, and I very much did not expect to see the same thing the few times I've looked at his code, but I did see that same thing.
I promise you Bob doesn't make up for all of this in social skills.
Now, is Bob a good engineer? I really, really don't think so. Is he a curious person? A bit, not much, I get the feel he just ended in CS with no particular interest for it, but I'll say it again: He is the best paid programmer I know.
Is that frightening? Well yeah, in a way. It's also endearing in a "Well damn if this guy can do it then surely I can too" sort of way. Money is not everything of course, but it's as good of a proxy as any.
> Considering many people doesn't know what a file is, keeping the spirit alive is important, I think.
Files aren’t sacred. It’s actually troubling that many technical people never consider alternatives. Most of the worlds data today is probably not stored in filesystems, rather in databases and object stores that use custom storage backends.
I didn't make such claim, and there's no need to comeback with such force. A file is a good abstraction of what a "casual" user works with. E-mails, documents, images, videos. These are great applications for files. Also, while some people hate UNIX's "everything is a file" approach with a passion, it's a great way to allow people to explore what's behind the wallpaper they see every day.
You know what, these big databases and object stores are living on bog standard but scalable filesystems most of the time. Ceph, ZFS, Lustre, etc., and sharded/stored as files. There are some very high performance and bespoke systems out there [0], yet they also provide POSIX compliant filesystem views outside, not because they are sacred, but because it works.
Filesystems provide great utilities for making abstractions other than files, by using files as universal containers you can play with. Again, while they are not sacred, they are an important building block, and they're here to stay. Creating a custom storage backend, throwing away all filesystem stuff is a fool's errand, since filesystems handle much more than providing a tree and some attributes on that file/folder hierarchy. Since they are the first level on top of physical storage devices, they also take care of the device underneath them (e.g. TRIM, FFFS (Flash Friendly File System), etc.).
It's a great irony that E-Mails are already stored as human readable databases on disks.
[0]: https://docs.weka.io/4.3/weka-system-overview/filesystems
After the nth time of my Android Chrome app silently corrupting and auto-deleting my browsing history (all of it; it's not a bug, it's the intended behavior!), would love to hear about a file alternative that's modular enough to resist that kind of catastrophic failure and interoperable enough to inspect/repair if anything ever happens.
how would any alternative design prevent intended behavior?
But the most obvious alternative to a filesystem would be formatting a whole hard drive as an sqlite database. Obviously it would be a radical rethink in OS design.
There are also "single-level stores" from the last millennium - designs where there is no separation between volatile and nonvolatile storage. All memory in these systems is treated as nonvolatile. A Word document, for example, would be something like a suspended Word process. A directory is a process that only manages pointers to other files and directories. Obviously processes must be extremely lightweight in such a system. KeyKOS is an example of this and you can read papers about it and its Unix emulation layer. This is one of the many things humanity explored before settling on the hierarchical filesystem as the base layer of storage.
> But the most obvious alternative to a filesystem would be formatting a whole hard drive as an sqlite database.
At the end of the day, you'll be chasing pointers inside that SQLite database, where you store tables, indexes and such. Interestingly, this is how a filesystem works. Tables, indexes, redirections and fields. Very much like a database. EXT4 is a table of redirections, nothing fancy [0].
[0]: https://blogs.oracle.com/linux/understanding-ext4-disk-layou...
Yes, believe it or not, all memory gets populated with data structures to be useful. That doesn't mean all data structures are equivalent.
I agree that files aren't sacred, they are just another abstraction at the end of the day, but what the other user (I think) is referring to is the trend in which, as smartphone use becomes ubiquitous, users lose sight of the technical side of things.
It's not that the average user is ignorant of the many ways in which data can be stored and retrieved. It's that they are becoming ignorant of such abstractions existing altogether. It's hard to start thinking about how images are stored if all the user knows is "they are in the gallery".
The article was a lot of words just to say that.
It's sad that we need this new concept of "IndieWeb", as the whole Internet evolved into a monstrosity hosted and guardrailed by a handful of megacorporations. Hosting files became a privilege, when it should've been a (human) right all along.
edit: The tech to host yourself is obviously still there, but the _mindset_ changed to cloud only.
> edit: The tech to host yourself is obviously still there, but the _mindset_ changed to cloud only.
Sadly with CGNAT, port blocks, hosting any server being a terms of service violation...
Non-cloud shared hosting costs $2 per month
We are a long removed from when putting something in your public_html folder would instantly give you a personal web site. Not that I am saying people should still hand write html or anything but it was a very quick and natural way to participate back in the day. (A unix account usually gave you automatic p2p chat too using finger to see if your buddy was online and talk/ytalk to talk to them.) This was little less than magic at the time even when your friend was sitting on the terminal right next to you.
Oh, wait until the kids learn about hardware.
> run 100% independently
> For just $0.01/day, you can run a static website at NearlyFreeSpeech.net
I respect the spotlight on hosting your own websites, but it's not much different from the usual Vercel/Netlify/GitHub/Cloudflare static hosting.
What if I want a database, feedback form, social media previews, good SEO? Article says nothing about it. Perhaps that's what makes a website "indie"?
You have access to php and a database there.
If NFS isn't much difference from Vercel we should see 50% of people using Vercel and 50% using NFS, but we don't, they're all on Vercel - why?
NFS supports dynamic websites (giving you access to a full Linux system with many programming languages), though you’ll have to pay more.
I get your point, but I still remember that guy who got a $100k Netlify bill for his free plan.
Just a call out for sdf.org.
Perhaps useful for those training developers mentioned in some posts here who need the TIL experience with unix based systems. Free shell account on a netbsd unix, and I recollect that a small one-off donation provides access to Web space and other enhancements. Choose the login name wisely as that becomes the subdomain for the Web space.
Recently, I had to make a website for an event, so domain was needed, but what's cool with that is that the domain provider (Infomaniak, with which I am not affiliated btw), also provided 10 MB of storage which is large enough for a lot of things. So for something like 5€ per year (still more than 1c per day...), you can get the domain and the website, which is not too bad
Self-plug here.
I built a comment js plugin which hosts all data inside a git repo. https://github.com/est/req4cmt (as long as your git service accept http)
It runs a Cloudflare Worker for free. The data backup/migration is basically git clone & push
There's another twitter-replacement, also based on git. https://github.com/est/gitweets
Demo https://f.est.im/ it supports comments via git notes :D
$0.01/day ? They are all completely free thanks to Cloudflare Workers / Github Pages.
It is nice to see a site preaching this that isn't hosted by Cloudflare or GitHub Pages
Github Pages is free hosting with domains and ssl, no bills, and has good longevity and prospects. I don't want to worry or think about a static site, and big players like Github and Cloudflare seem to fit that best.
What’s your preference?
I also “preach” GitHub pages a lot but I’ve also written about hosting on a Raspberry Pi in my bedroom.
https://joeldare.com/private-analytics-and-my-raspberry-pi-4...
Literally anything that isn't big tech.
Small tech is fine. Self hosting is fine. VPSes are fine. Don't use "clouds" - they're big tech, and overpriced.
Make sure it's something you pay for, so that you are the customer, instead of the product.
I appreciate Cloudflare for keeping all the piracy sites running, though.
Or even Vercel/Netlify
Personal, but I’d rather learn and own a process.
1. Learn how you can get HTML generated from a human-readable and writer-friendly format, say, Markdown (plain-text). This can be Pandoc, a macOS/Win wrapper desktop UI over Pandoc, and many other tools that do this.
2. Learn the process (and the tools) to upload, or sync to a service that hosts the HTML (CSS+JS).
3. Learn the simple steps of owning of a domain, and updating the DNS to point to the right services, such as Github Pages, CloudFlare Pages, etc.
As you are not dependent on a particular tool/service/platform/company, you can walk out and host your files (the website content) elsewhere.
The post-processing of the raw (Markdown) articles/posts to HTML can be then automated with Static Site Generator if someone is willing to learn a little more on top of the above steps.
Of course, it is a fun and good thing to know HTML but that should be optional to the target of “Run your own website 100% independently.” With Github and Cloudfalre, you can hve it for $0 monthly. If they go kaput or stops free, someone will come up - walk out and walk in elsewhere.
From the article:
> When your posts are individual HTML files (not Markdown files or database entries), they can finally be seen as the individual web pages that they truly are. And that means that you can really lean into making all of your posts unique! They don’t all have to be cookie-cutter paper-doll clones of one another; that’s just a bi-product of modern web publishing tools and the cultural influence that they have on our concept of a “blog”. You can now go ahead and make every blog post as special and individual as you’d like. Each post can have its own personality, baked right into its HTML. Individual style, individual appearance, even individual layout. Literally everything is possible with this approach.
I have to push against this slightly.
HTML is human-readable and writer friendly. Humans - not even all of them CS students - were reading HTML,JS and CSS on websites and writing it all by hand in text editors for years before the "proper tooling" came along. It really isn't that difficult, especially if you're just dealing with simple websites, doubly so if you're on HN, you probably work with more complex languages on a regular basis.
If you really want to "learn and own a process" and be "100% independent" you should at least be able to understand and work with web languages natively.
Static site generators are nice (I use Nikola) and tools make things easier but but it's still dependency on third party tools if you don't understand or can't otherwise work with the output.
I'm building an Astro starter template that also makes it easy to start your own website / blog: https://github.com/BryanHogan/astro-starter-template
Astro is a framework that uses no JavaScript by default. I also use just HTML and CSS, so no bloated additional frameworks or styling libraries.
All blog content is written as Markdown or .mdx files, so it's easy to write and move to any other tool if you wish to do so.
You can host it for free using any major provider since it's just a static website (e.g., GitHub Pages, Cloudflare, etc.).
Making it similar to my own website which is on: https://bryanhogan.com/
(Repo: https://github.com/BryanHogan/bryanhogan )
I come at it from a slightly different angle.
I write technical blog posts with visualizations and live demos. That usually means embedding a bit of custom javascript in the page for the demo. Or shipping custom wasm to enable extreme semantic model compression.
I do this by pushing content from my machine to github pages which is wired up to my subdomain.
If github pages stops being a good, free option for this, I will find another. Not sure I would call this "hardcore" really.
this would work if we had free DNS. solving DNS to be trully decentralized and free is something for years I wish I had more time to work on and build
key properties:
1. everyone can be a registar. your localhost too
2. blockchain proof of ownership and discovery (certs, not proof-of-work, fast and cheap ledger)
3. everyone can be a CA (self-signed certs pinned in blockchain)
4. no fixation on static IPs (inspired by Cloudflare Tunnels, Tailscale). IPs are ephemeral.
5. blockchain/P2P discovery of domains
but it is all fantasy without real browsers support (Chrome, Safari). 99.999% of traffic is locked there, and both controlled by monopolies Google / Apple. and you cannot even build your own browser (Apple App Store will not allow it). Maybe alternative stores and some proxies / translation layer from normal web to this web would help.
Zooko's Triangle says you can't build a name resolution system that's secure, human readable, and decentralised.
DNS is secure (in Zooko's terms - means you can be certain a domain only has one correct resolution) and human readable.
.onion is secure and decentralised.
Petnames (as in I2P) or /etc/hosts are human readable and decentralised.
Also any centralised secure system will quickly have all the names squatted if they are free. It's bad enough at current prices. For instance every dictionary word under .com is already taken. If they cost nothing it would be every pronounceable sequence of up to 12 letters.
Nothing is actually stopping you running "weird DNS" on your home network if you implement the DNS protocol towards clients. I suggest you get familiar with the program Unbound. It's very common for networks to use alternative DNS if only to address the devices on the network.
Also IPs weren't originally meant to be ephemeral. You can get an address block registered to you (v6 only of course, there's no more v4) for a pretty reasonable nominal fee.
You can’t build your own engine outside of the EU, but you can still build on top of the existing Safari engine. What you’re describing is technically possible.
However, why would a company build something just for a handful of people?
I guess if you are Epic games, and you do not want to be blocked or controlled by App Stores, or pay 30% paycut. maybe you would build and support independent (from google/apple monopoly) interenet stack.
or if you are EU/China and do not want google DNS and networkign layer owning entire EU/China
in all cases they would still want centralized control by each state/company.
how to align incentives of someone who can actually pull this off and still keep it decentralized is a big question.
so the only way to make this happen is independent SWEs build their own browser. AND significant portion of users will start use it exclusively AND it survives and crashes competition from OS controlled browsers (Chrome/Safari) AND OS does not block/remove them from OS controlled app stores (which they can and regularly do, just look at "Hey" or "Brave").
you got to go full own hardware stack. now only China can reallistically pull this off.
China has own hardward stack. (actually entirety of all hardware stacks. it is all build there). China has own playstores or higly regulated versions of Apple/Google play stores.
China has mini-apps ecosystem which is more resilient to App Store whims.
and pretty much China is only place that can reallistically negotiate and push back to Google/Apple.
nobody else can stand a chance.
so free web is only possible in China pretty much. and future of free web is there.
if it was up to corporate monopolies (MSFT, Google, Apple) they would shut down whole web and remove other browsers from OS they control, and be gatekeepers of entire internet unless govenrment threaten them break them up or block them.. oh wait.
exactly.
I appreciate the sentiment but can't quite tell who the author is targeting. Is it people who don't even know what HTML is, or those who are technical enough to have considered tradeoffs between web hosting options?
For complete beginners, I made https://weejur.com , which is designed to make it easy for even a complete beginner to paste in HTML and get it hosted on GitHub Pages for free. (And is also hosted itself on GitHub for free!)
This article is a great example for anyone in their 50’s who is worried about not having relevant skills anymore.
Although calling it hardcore makes it sound like porn. Too bad they had to add that term for something painfully not hardcore.
Very cool! I run a set of ssh-based services over at https://pico.sh and love seeing all the indie web content on HN!
Sftp is still very useful even in 2026
I don't get it. I've been doing this for over 20 years exactly the same way. I even ran a business. The server I rent is $2/month. I read nothing new in anything in that article.
I don't get it.
I see a lot of young software engineers who don’t realize how much you can do on your own and how simple it is.
You are clearly not the target audience. Perhaps you can recognize that other more recent internet frequenters might appreciate the knowledge.
To me this "knowledge" seems to be a crutch. Real knowledge would show how to do it on their own as thousands of us have done for decades and still do today.
One step at a time, we don't force people to build their own CPU out of transistors.
That is a really bad, far too fine grained example.
The cost doesn't really matter as much as the payment methods, especially at that price point.
Payment methods are inherently discriminatory.
OK, if the reason to do this is to learn how HTML and web serving work, splurge and get a VPS. You’ll learn so much more.
oh yeah, how my opinion changing: - in schools I used HTML+CSS to make my own site during homework - after that I understand that no one truly create sites this way. You need JS, framework, database, etc, etc - now I returned back - I really need only my text editor and HTML+CSS
Holy, I love this simplicity
I’ve been using xmit.co for my static websites and it works fantastic (also free but I donate to the author yearly).
Azure has a free tier that is fairly generous.
Also the Always Free Oracle Cloud tier is pretty generous. You can spin up a VM or two with it.
I self host my site [1] on an old Mac mini in a Swift backend and sqlite database. Only thing I rely upon someone for is Cloudflare tunnels for free. I could replace that with port forwarding but so far, this way is pretty good.
[1] https://limereader.com/
Yup, I have a similar setup where I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server, which proxies the traffic to the server under my own roof. No Cloudflare!
I have something similar. I use Cloudflare tunnels too but also their CDN which is free (for now).
That's the only thing I haven't really been able to figure out how to do on my own. Back in the day, hosting a static site from my crappy DSL connection was basically no problem and most people who were accessing my site were probably in my timezone. Now with how big the web is and how many bots there are, I worry about the quality of self hosting without a CDN.
Bots are over-fearmongered. Yes, you get a lot of bot traffic to any website. No, it isn't a ddos unless you make it a ddos by making your server do 10 seconds of computation on every page load. Just keep an eye on server load so you know when a solution is actually needed, and you'll be fine. Install Anubis if you want to, but there are even simpler checks, like requiring an image or CSS file to be loaded or setting a cookie or putting a simple redirect in JavaScript or meta-refresh.
Cloudflare tunnels are pretty cool. Do you segregate your server from your home domain too? Little weird having cloudflared on my home network. It make things a little more annoying but I haven’t bothered to fix it since I dev on the same production server.
My server is a different computer which only does this. It's not on my personal computer.
> Cloudflare tunnels for free. I could replace that with port forwarding
You could replace it with something better, like pangolin, either their cloud or even self host it too, and that way you can tunnel to other stuff like if you have a media server where you can watch your movies from anywhere in the world.
Yeah I find it a bit funny when people self host to get away from cloud and then use Cloudflare tunnels.
CF tunnels will ban your account if you used it to watch a movie due to DMCA/copyrights.
Is this really true? "A friend of mine" has been running a Jellyfin server behind Cloudflare tunnels for years and hasn't had any issue.
Not sure if it is still like this, but jellyfin used to leak massive amounts of metadata. For example by checking the thumbnail paths (which were unauthenticated) you could see what shows/movies someone had.
Might want to warn the "friend" if they don't have auth on the tunnel itself.
I would guess they only take action when they get a DMCA complaint and that wouldn't happen if you only share privately with friends.
They can also take action if they decide you're wasting their bandwidth or (especially) cache space. It's not allowed to host video files on any free cloudflare plan due to cache space.
same here, except a 5 yrs old raspberry pi hanging off a power adapter on the floor.
I opened this up thinking the same thing using NFS, and lo and behold that's what the author used.
I created Neat CSS for some Hardcore IndieWeb users (though I’ve never used that name before now).
https://neat.joeldare.com
You’ll also find a free email course where I walk you through how I create a site using it. Link on that page.
Weird to see the author spending 0.01 on their website and $99+tax on the text editor.
Well this is great, even going further and hosting the site itself and serve it instead of webhosts, but, now we have domains issue, a domain registrar hijacking your domain, which is your life work, email, etc., so there’s a need to have a free tld that’s uncontrollable by any entity, .onion isn’t practical obviously.
There's no such thing as a TLD that's uncontrollable by any entity. How would you imagine such a thing working? Whatever you imagine: how does it stand up to me editing the hosts file, or the browser's source code?
>There's no such thing as a TLD that's uncontrollable by any entity.
Think .crypto but without the ability to upgrade the smart contract to censor domains. The registry is spread out across a whole decentralized network of computers of which has another decentralized network of computers that proxy requests exists.
>how does it stand up to me editing the hosts file, or the browser's source code?
No one can force you to resolve domains YOU don't want to. You can of course blow up your computer and then you definitely can't resolve the domain. What people mean is that the user is free to still resolve it if they want.
> The registry is spread out across a whole decentralized network of computers of which has another decentralized network of computers that proxy requests exists.
Ultimately, someone has to be in control of who is or is not part of that decentralized network that is the registry. (Or, alternatively phrased, how are you preventing me from saying "I'm part of the .crypto registry, totes.")
Aside from that, the root nameservers is still an entity that is controlled (by ICANN, specifically).
>Ultimately, someone has to be in control of who is or is not part of that decentralized network
Ethereum is an unpermissioned network. Anyone is free to join or leave at anytime.
>how are you preventing me from saying "I'm part of the .crypto registry, totes.")
The registry would be a smart contract. There doesn't fundamentally need to be an owner.
>how are you preventing me from saying "I'm part of the .crypto registry, totes.")
Name resolving doesn't have to be done by ICANN's domain name system. You can have alternates that do not depend on centralized servers.
Blockchains have complicated permission systems which isn't the same as having no permission systems. Remember when Vitalik reversed a DAO smart contract transaction he disagreed with? It leaves a cloud of mistrust over Ethereum to this day. There's no reason to think it couldn't happen again.
What does "the user is free to still resolve it if they want" mean in a world where people do not control, or even understand, the software running on their computers? (Because I can tell you, I certainly don't.) This abstraction is a nice idea, but it's unrealistic as part of a serious threat model. Does Joe Q. Public know about the hosts file, or how the Windows network stack selectively overrides its entries, or how some of the Linux userspace uses systemd-resolved, or the things that I don't even know to write here? I'M not the one resolving domains: the software running on MY computer is.
And even if I'm a super genius who's written my own full-stack operating system on my souped-up speccy, I'm still bound by the laws of information theory. If you need information that you don't have, you're necessarily requesting it from a source (here, a computer) external to you (here, outside your control). A complicated network protocol doesn't make that fact go away, and doesn't allow you to ignore it. (It might mitigate various censorship or spoofing approaches, but you only know that if you check: the abstraction won't save you merely by virtue of being an abstraction.)
> The methodology
No. That's the method.
I'm just paying for the domain...
Old guy here, wild that people don't know this.
Like, I have fiber and a static IP. Never much thought about hosting a website from my house because it didn't seem all that special. Maybe I should?
Note that most ISPs don't allow it on residential plans, but also won't stop you unless you actually create some kind of problem (no ISP actively polices it). If you're rich you can pay more for a business plan (at your home) which would explicitly allow it.
It's fine to host something for friends on a residential ISP. They don't care. If you want to make it a public website it's more uncertain. Still don't worry though, because they won't just ban you from the internet. Worst you'd get is a phone call telling you to stop it.
Kind of similar to "tiiny.host" minus the custom domain and with a few file restrictions for the free tier but very similar.
It's good advice, but one need not even include the "upload it to a web server" these days now that home connections are so fast. Install some static webserver on your desktop computer (nginx, caddy, whatever), forward the port 80 at your router to it's lanip:80, and just save .html and files to the web directory using your normal desktop interface. It doesn't matter if you shut off the computer sometimes. Uptime doesn't matter. Optionally file transfer (rsync, etc) this local copy to a VPS or something like the author suggests.
Indieweb receiving of webmention only requires the ability to log HTTP POSTs to some url endpoint. Or you can use one of third party services servers to receive that interact with your website via with 3rd party javascript applications you include on your webpage. Sending webmention can be done with cURL, even HTML forms, or again, 3rd party JS includes.
However, it'll also bring all the bots and "wild west" of the internet to your house when you run your web server from home, and for anyone who has a couple of spare dollars, it's a much wiser choice to run a small VPS elsewhere to weather the storm.
[Internet facing router with up to date firmware] --> HTTPS --> [separate VLAN DMZ] --> [my hardcore IndieWeb VM/k8s/bare-metal whatever] --> [x No outbound access / paranoid local firewall inside the VM x]
[My home computer] --> SSH --> [my hardcore IndieWeb local cloud]
That's about it. Safe enough.
shrug
In 25 years of hosting a dozen domain names on a server on my home connection, this problem has not surfaced for me.
In 20 years of managing server fleets, I always had the pleasure of watching bots taking a dig at my server(s) the moment I give their public IPs and enable their interfaces.
For someone who knows what they are doing, it's more like mosquito noise, a mere nuisance, but even then, using a rock solid system with all updates installed carries the risk of having a zero-day.
If your server is networked to the rest of the house, and if somebody manages to get in, then it's all fun(!).
One time has to be the first and when you get hacked they're instantly inside your network unless you were smart enough to set up a DMZ or something.
Especially if you host something like wordpress with plugins you really have to be on the ball with updates.
For 20 years this was not really an issue. From 2010 to 2020 there wasn't a single nginx cve that applied to my simple static setup. There were literally only a handful of remote CVE at all. With the advent of LLM AI exploit finding there have been 2 CVE this year that I had to look in to. Neither actually applied to me, but it is a different world out there.
That said, the practice of running a modern corporate web browser that auto-executes all programs sent to it from arbitrary unknown third parties is a way, way, way bigger and more common and likely attack surface than a simple static webserver serving files in directories.
Ok fair enough yes a static site is really low risk. Usually it's more involved than that though.
Yep, same here. fail2ban and some http 444 helps out.
You need a static IP address for this to work is the downside, and depending on where you live and who your provider it it can be difficult and/or expensive.
You can programmatically update DNS whenever your dynamic IP changes. One issue though is that some residential ISPs prohibit webhosting in their terms.
you can go ipv6 only, any good isp will give you a static /56 for free. practically none of your users have ipv4 only devices when every major os has been dual stack by default for like 15 years. if your isp cant give you one its time to switch as soon as you can.
Ehh my ISP at home is still ipv4 only. The amount of ipv6 capable connections only just passed 50% worldwide a few months ago.
I don't think ipv6 only is feasible yet unless your audience is exclusively in Asia where ipv6 uptake is much higher due to them running out of ipv4 years ago
My ISP is only ipv4. It doesn't matter if an OS technically support ipv6 or not.
You can get a Hurricane Electric free static v6 tunnel.
They have poor reputations and are blocked from streaming sites and so on. But when you're the server, that doesn't affect you.
Note that you need a static v4 and DMZ because the tunnel protocol is a very simple one - presumably because they run it on giant routers. It just puts a v4 header in front of the v6 header. No TCP or UDP.
I may be able to, but the millions of others won't. The solution needs to work out of the box for consumers.
I arrived at a pretty similar system starting from similar goals.
https://rustyswarf.com, which runs on a very simple framework called Travail.
In practice, I found cloudflare necessary to deter bots/crawlers. It is indeed fairly cheap, but you're still dependent upon three entities you don't really control: the DNS, the host, and Cloudflare.
You don't need to deter bots and crawlers. Cloudflare wants you to think you do.
now the real fun part is how to self-host it on a machine accessible on the net without services like cloudflare or tailscale tunnels.
Fixed IP would be a way to go. Some people pick dynamic dns server so they can periodically update if their IP changes. But IMO it's just too complicated. I don't think there's a good way to go around ISP restrictions, especially in USA.
I host my site on my own home server, but I do have a proxy ec2 server to tunnel public traffic via wireguard back to my home server. This keeps things a bit more protected and my router/home network not directly exposed. I'm also not locked into AWS, I just use them for convenience, but could get any other cheap proxy to run wireguard. No dependency on tailscale either, it's just nicer interface to wireguard. Wireguard config is like 5 lines btw.
+1 I use Oracle Cloud rather than AWS as their "always free" tier is plenty to run a reverse proxy. As you say, could be anywhere.
It used to be as simple as getting a fixed IP but these days that is indeed a lot harder to get.
You can do it over TOR.
you still need domain and static IP with this setup. and volumetric DDoS protection, ASN IP blocklists, and CDN — is not even mentioned here.
just use Cloudflare. get all this for free (except domain).