undefined | Better HN

0 pointsBoppreH1y ago0 comments

I have a 3-letter domain that I use as my personal playground (think "xyz.com"). It features:

- One-click anonymous upload of text, clipboard, and files. So from any computer, I can visit xyz.com + ctrl+v to upload the clipboard, write notes to myself, drag and drop a file, etc. It's a risky feature, but there's nothing to attract attention and you don't even get a URL back.

- Authenticated sessions see a list of uploaded files, with buttons to copy link, download, delete, or generate QR code. There's also real-time notifications for each upload.

- Simplified RSS feed reader[1]. It scans my feeds every 10 minutes, and displays the URLs of new items. It has one button, that opens all URLs in new tabs and marks them as read.

- A Server-sent-events channel[2], and a UI that displays visitors in real time. The channel allows me to send redirects/file downloads to any visitor, so I'm constantly asking people to visit xyz.com when I need to hand them something digitally. Visitors are color coded with randomized backgrounds for identification.

- Youtube video downloader (powered by yt-dlp), along with audio extractor and pitch+speed correction for songs.

- Authentication is by approval from an already authenticated session (usually my phone). In the worst case I can edit the text file via SSH.

I add or remove widgets according to my needs. At one point I had chat integration with Facebook+WhatsApp+Telegram (got me banned from WhatsApp), radio player (replaced with Spotify), and even balances by scraping my bank accounts, credit cards, and Steam (removed after a bank started asking questions).

The whole thing runs in custom pair of Go and Python servers, developed slowly over the last ten years, and I use it multiple times a day. Feels like a digital tree house, messy but fun and useful.

[1]: https://github.com/boppreh/feeder

[2]: https://github.com/boppreh/server-sent-events

Edit: people have found it and started spamming uploads of "HELLO FROM HN". One IP looks Swedish. Well, Hi! But I'm taking it down for a few days to avoid tempting more people.

And shoutout to the Go team, that server has been rock solid and 100% backwards compatible over the past ten years.

0 comments

Manozco1y ago

This is like 90% of what I need to setup on a server for my personal usage. Issue is I don't do front dev at all so I never really start working on it. Any chance you've open sourced it ? (Or if not opensourced but you're willing to privately share the code, you can reach me at hn [at] manoz [dot] co)

BoppreHOP1y ago

I sent you an email with the code and instructions. I won't share it openly because I don't want to tempt people into finding security flaws for fun.

It's definitely not code that I'm proud of, but it's been serving me well for many years, and might help you get started.

ycuser21y ago

> ..., along with audio extractor and pitch+speed correction for songs

What do you mean with pitch+speed correction? Have songs on youtube false pitch or speed?

BoppreHOP1y ago

I often have to download songs for children to sing, but they have trouble with fast or low-pitched songs. It destroys the audio quality, but they don't seem to mind.

liamYC1y ago

Cool projects, I’d definitely like my server to be able to do all these things. What have you used to deploy it?

BoppreHOP1y ago

- Oracle Cloud Free Tier[1] for a Ubuntu VPS (4 ARM cores, 24 GB RAM). Surprisingly pleasant and reliable, given who's offering and for how much ($0). It used to be on DigitalOcean, until they kept screwing up their FreeBSD support and bricked my machine twice.

- Caddy[2] web server with Let's Encrypt certificates, working as reverse proxy.

The rest is a very lazy 2010's solution:

- A Go server for HTTP (static files, uploads, maintaining server-sent-event channels). It also reads and writes events in a custom format to a local socket, for the interactive parts.

- A Python server for the widgets, communicating with the Go server.

- Source code edited manually in-place (SSH or SSHFS[3], with Git) and restarted as needed. I know, I know, awful practice. But as I'm the only user, uptime during development is not a concern.

- Startup is handled by a @reboot cronjob and a bash one liner.

- Text files for "structured storage" (RSS feed items, authenticated sessions, mapping of uploaded file names).

As horrible as it might all sound, it has survived ten years and two cloud vendors. Nowadays I might containerize it, or rewrite as one Rust server, but I think I made the right choices at the time.

8/10 given the unusual requirements.

[1] https://www.oracle.com/cloud/free/

[2] https://caddyserver.com/

[3] https://github.com/winfsp/sshfs-win

liamYC1y ago

Thanks a lot for this, I’ll check it out

duckmysick1y ago

> removed after a bank started asking questions

What? That seems crazy. A bank was giving you an earful for accessing your own balance?

BoppreHOP1y ago

I was scraping their website every few minutes, from a cloud provider, using a cookie I created by logging in manually while VPN'ing through the cloud (so the IP looked the same).

Eventually the cookie started "expiring" quicker and quicker, and they eventually thought I was being hacked. I knew how sketchy the whole thing was, so I didn't want to admit that I was doing the "hacking" myself.

It was probably against the terms of service, triggering alarms on their side, and risking being classified as actual hacking. Not worth it.

Eventually I got a bank account and app with instant transaction notifications, so now there's no point in scraping anymore.

j / k navigate · click thread line to collapse

0 pointsBoppreH1y ago0 comments

I have a 3-letter domain that I use as my personal playground (think "xyz.com"). It features:

- Authenticated sessions see a list of uploaded files, with buttons to copy link, download, delete, or generate QR code. There's also real-time notifications for each upload.

- Simplified RSS feed reader[1]. It scans my feeds every 10 minutes, and displays the URLs of new items. It has one button, that opens all URLs in new tabs and marks them as read.

- Youtube video downloader (powered by yt-dlp), along with audio extractor and pitch+speed correction for songs.

- Authentication is by approval from an already authenticated session (usually my phone). In the worst case I can edit the text file via SSH.

The whole thing runs in custom pair of Go and Python servers, developed slowly over the last ten years, and I use it multiple times a day. Feels like a digital tree house, messy but fun and useful.

[1]: https://github.com/boppreh/feeder

[2]: https://github.com/boppreh/server-sent-events

Edit: people have found it and started spamming uploads of "HELLO FROM HN". One IP looks Swedish. Well, Hi! But I'm taking it down for a few days to avoid tempting more people.

And shoutout to the Go team, that server has been rock solid and 100% backwards compatible over the past ten years.

0 comments

Manozco1y ago

BoppreHOP1y ago

I sent you an email with the code and instructions. I won't share it openly because I don't want to tempt people into finding security flaws for fun.

It's definitely not code that I'm proud of, but it's been serving me well for many years, and might help you get started.

ycuser21y ago

> ..., along with audio extractor and pitch+speed correction for songs

What do you mean with pitch+speed correction? Have songs on youtube false pitch or speed?

BoppreHOP1y ago

I often have to download songs for children to sing, but they have trouble with fast or low-pitched songs. It destroys the audio quality, but they don't seem to mind.

liamYC1y ago

Cool projects, I’d definitely like my server to be able to do all these things. What have you used to deploy it?

BoppreHOP1y ago

- Caddy[2] web server with Let's Encrypt certificates, working as reverse proxy.

The rest is a very lazy 2010's solution:

- A Go server for HTTP (static files, uploads, maintaining server-sent-event channels). It also reads and writes events in a custom format to a local socket, for the interactive parts.

- A Python server for the widgets, communicating with the Go server.

- Source code edited manually in-place (SSH or SSHFS[3], with Git) and restarted as needed. I know, I know, awful practice. But as I'm the only user, uptime during development is not a concern.

- Startup is handled by a @reboot cronjob and a bash one liner.

- Text files for "structured storage" (RSS feed items, authenticated sessions, mapping of uploaded file names).

As horrible as it might all sound, it has survived ten years and two cloud vendors. Nowadays I might containerize it, or rewrite as one Rust server, but I think I made the right choices at the time.

8/10 given the unusual requirements.

[1] https://www.oracle.com/cloud/free/

[2] https://caddyserver.com/

[3] https://github.com/winfsp/sshfs-win

liamYC1y ago

Thanks a lot for this, I’ll check it out

duckmysick1y ago

> removed after a bank started asking questions

What? That seems crazy. A bank was giving you an earful for accessing your own balance?

BoppreHOP1y ago

I was scraping their website every few minutes, from a cloud provider, using a cookie I created by logging in manually while VPN'ing through the cloud (so the IP looked the same).

It was probably against the terms of service, triggering alarms on their side, and risking being classified as actual hacking. Not worth it.

Eventually I got a bank account and app with instant transaction notifications, so now there's no point in scraping anymore.

j / k navigate · click thread line to collapse