• 4 Posts
  • 179 Comments
Joined 1 year ago
cake
Cake day: June 13th, 2023

help-circle




  • Domain name ~$15/year

    .com starts at $10.28/year

    Offshore server providers usually start around $30/server/month and quickly raise to thousands

    Proxy everything from cheap offshore servers to servers from legit hosting providers with fair pricing.

    Corporate application techs are usually $2k-200k/month depending on size

    Ops are a tech themselves, work with techs they split donations with or pay or nothing at all, or become a tech themselves as time goes on.

    Anything that requires a GPU would be a custom build, dell power edge is a powerful machine you can lookup retail for

    True, but a website like FitGirl Repacks needs no GPU.

    Storage Amazon s3 is $0.022 per GB/month

    Don’t use Amazon S3 if pricing is a concern.

    Keep in mind that providers […] often provide multiple releases codexes, resolutions and providing a lot more than people are requesting

    I’m not sure what to say about that? They sure can do that for images, but not for game repacks.

    You often have to pay for networking as well which scales exponentially

    Pirates don’t build on-prem data centers, they rent servers or services.

    Email accounts are usually $10/user/month any time would come from a senior developer ~120+k/year

    No, they can re-use whatever server they use for email. Why pay a senior developer ~120+k/year for email?

    But they are likely full stack developers so it might be closer to 200k in the US

    If a developer works with a pirate, they don’t get paid a wage. They’re part of the operation, and get paid depending on the donations or nothing at all.

    And servers to run development environments (double the costs above!!!)

    The development environment can be on the server or even on the dev’s laptop. They already paid for that, so $0.

    And infrastructure like Jenkins/monitoring which can scale high as well, but likely <$20k/year

    Put it on the server. Scalability isn’t practical for pirates to begin with. If they lay all eggs in one basket for maximum scalability and cost savings, then the cloud provider can end their entire operation.



  • Hard if not impossible to say. It depends on what they host. Hosting also gets real expensive if they make poor choices.

    If they choose to host their WordPress piracy website on WordPress.com, then that’s a shit idea. They’re overpriced as hell, even with an annual discount. 300 € annually is WordPress.com’s discounted price for a somewhat usable, but still restricted WordPress instance. Furthermore, pirates face the risk that hosting providers terminate their account and keep the money, so long billing periods are risky.

    They accept that risk to save some cash, and use WordPress.com. Okay, now what? WordPress.com terminates the account at the start of the new billing period and keeps the money. How sweet. Pay 300 € for the privilege of another restricted WordPress instance. Annual spending: 600 € for what could’ve been 21.12 € annually with a dumb simple Hetzner webspace.

    You may think that this is impossible, nobody is dumb enough to spend 600 € when a 21.12 € solution is good enough, right? Look no further than any company that lifts and shifts apps into the cloud that weren’t designed to run in the cloud. Expensive as hell for no fucking reason other than it’s in the cloud now. Or this poor fella who got a $ 30 gift card for saving their employer $ 500,000 with five clicks.





  • I didn’t describe what could happen, but what did happen in real life. Multiple times.

    MCBans is open-source btw, yet nobody checked and changed the source code, as should be expected really. Operators whitelisted alts and friends. Blacklisted server owners who didn’t appreciate that the operators of their global ban list griefed their servers with backdoors.

    Another typical example is 3rd-party Discord ban lists. They whitelist their own staff. They backdoor their bots to fuck around with servers. It’s just the reality of global ban lists.

    If Erlite doesn’t abuse that trust, then someone with admin access will, or Erlite’s successor. That’s a fact, not an opinion. Email spam filters prevent single trust lists with scores, multiple lists, etc.


  • There is no anti-cheat, instead a global ban tracking system was put in place and server admins are now able to share the identities of players who have been caught cheating, banning them on every server, regardless of who is running them, by the hosts simply opting into the global ban system.

    A global ban system without a more nuanced approach is a terrible idea. Operators of that global ban system will whitelist themselves, blacklist people they hate, and maybe even backdoor the mod that enables them to ban people in the first place. Server admins have no choice but to either opt into the entire system or have none at all, and both of these options suck. We’ve seen how this plays out already.

    Score players by your own criteria, weight everything with different blacklists, greylists and whitelists, etc. and ban players if they exceed a threshold automatically. It won’t be perfect, but email catches most spam emails that way just fine.




  • You conflate VPN providers have an incentive to store no logs with it’s impossible to verify whether VPN providers store logs. It’s like trusting your friend to keep a secret. They promise not to write down what you say, but you can’t be sure. You accept that risk in your threat model, and that’s fine. But newcomers should judge that risk themselves. I feel like “Don’t worry bro, they don’t keep logs.” is an inappropriate response to people that’re about to commit a crime that can land them in jail.




  • Because Defender already covers what DNS blacklists block and more with less false positives and a proper way to manage exceptions for non-technical people. Older malware is a solved problem for Defender since it’s literally pre-installed everywhere. VPN providers don’t have a way to manage DNS blacklist exceptions, so have fun disabling your VPN to do any research. You also don’t get to choose the blacklists your VPN provider uses. Saying 3. is not a point is like saying malware that’s always able to bypass your anti-malware solution is irrelevant.


  • I can’t call DNS blacklists part of defense in depth. DNS blacklists are a poor man’s version of existing and pre-installed anti-malware software.

    • DNS blacklists block only older known malware, similar to existing anti-malware, but less effective.
    • DNS blacklists block hijacked, but legit websites that host malware, contrary to existing anti-malware.
    • DNS blacklists? What is that? I use DoH, get fucked. Contrary to existing anti-malware.

    They’re completely bypassable, they boast a high false positive rate due to how threat actors host malware, and they don’t even block newer malware. Just use Windows Defender. It ain’t perfect, but it’s leagues better than any DNS blacklist.