Neocities was actually launched and bootstrapped on HN about 3 years ago, and donations from HN users bankrolled the first year of operating it. Things have been going really well, the site is growing and still sustains it's own existence through donations and supporter accounts.
I still work on the site heavily. We're launching some big features soon (more space, Github webhook deploys, etc.). We just finished migrating to SSL (for everything, including hosted sites).
I've had to do some pretty crazy stuff to make the site work, some of which is not documented well and I think the HN crowd would find pretty interesting. For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks.
My new years resolution was to get better at writing about some of the crazy tech I've had to do for the site. If you're interested, there's an RSS feed you can subscribe to for our blog where it will be posted in the future: https://blog.neocities.org/feed.xml
Again, thanks go to HN. Site literally wouldn't exist without it, you were basically our seed investor. Feel free to ask me questions, I'll try to answer. That's something you're supposed to do with your investors, right?
I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went something like this:
Me: "I've created a PR to allow .cur and .mid files, like the good ol' days."
You: "Wtf is a .cur?"
Person 2: "It's windows cursor format."
You: "(many paragraphs, tl;dr: Sorry, but we're not recreating Geocities.)"
~ one year later ~
You: "I caved. I've merged, sorry for being a dick."
After so long, I'd completely forgotten about the PR and found it hilarious that you eventually merged my PR. I'm happy to see things continue forward :D
True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.
On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests?
Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1].
Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-)
Like .cur files! According to a quick google search, there was/is a buffer overflow vulnerability in XP. Makes me wonder how many SP1 XP installs hit Neocities.
Agreed. Kyle, are you also validating that the content of the uploaded file correlates with the extension? Geocities began having real issues with bot generated accounts, each of which would get one shard of a binary warez uploaded as .jpg, etc. Of course, we didn't have captcha, so your exposure might be limited. Awesome to see this -- wish you worlds of luck.
I'm sure you've heard this a million times by now, but I first got into web development because of Geocities in the mid-90s as a very young kid. Looking back, it was almost certainly the gateway drug that led me down the path to where I am today. So it's nice to know that something like this still exists and might inspire the next generation of programmers.
Same here. HTML was my first language. I missed the creativity of the old web. Going from wide open blank slates to 140 characters is not my definition of progress.
I do work very intentionally on not living in the past, though. The epiphany that led me to Neocities was that creating your own weird static HTML site was not an anachronistic activity, but rather something that was simply too early for it's time. I think it has become relevant and modern because of the massive improvements to HTML/CSS/JS.
> Going from wide open blank slates to 140 characters is not my definition of progress.
Why do you have to only use 140 chars? Frankly the "old web" is still there. You're just as free to create whatever you like using HTML and CSS and host it anywhere that works for you. In fact it's gotten easier: browsers are more consistent, CSS is getting more powerful, and there are a myriad static hosting options these days.
So go build something creative! ..and then share the hyperlink in some 140 char social network.
Frankly, a lot of it isn't. Culturally at least, even if some things like Tripod and Angelfire seem to still be around. Around the mid-90s, Geocities, Angelfire, Tripod, and similar hosts were the web to a lot of people, the way that Facebook and Twitter are the web to a lot of people now.
Geocities was my first job out of school, at that time it took a small army of apache module c coders. Its awesome you're bringing back the concept, when Yahoo bought us out and then killed it they took out a huge part of the history of the early web.
I still have a clone of my geocities site in my archives. It was the first website I made, and highlighted my love of video games, anime, and adnd. It was so 'massive' it had to span two geocities accounts to hold it (different links went to different sites).
I made a lot custom graphics for the site too, which helped me practice using Photoshop, which has helped me ever since, letting me mock things up and still look decent before real artists get their hands on them. In fact several games I've made I just used my own graphics and they still found success.
Wow, that's got to be an amazing piece of history on your resume. Yahoo killed a lot of things to take their devs (Astrid tasks is another great example).
I think Archive.org has a lot of the old Geocities sites.
>>For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks.
Will subscribe to your RSS feed, but wanted to specifically say that I for one would love reading about your cheap anycast network setup & operations framework. Thanks again for the original Geocities rescue and great work on the direction that Neocities is heading!
You should write up that piece on "cheap" global anycast.
Let me make a wrong guess to give you motivation: you had to physcially visit IXP's across the globe to set IP's on network interfaces of computers you rented there?
I'd be interested in that, too. Collecting everything I can on cheap implementations of ISP's, WAN's, etc from those that pull it off. Might help others later.
The sites are still all being archived through IPFS! The link of the latest archive was temporarily removed from the site profile, but it's coming back soon when we launch the new IPFS infrastructure (weeks not months). The first IPFS implementation was experimental, the next version is going to be pretty amazing. Stay tuned.
Using Neocities with IPFS has been really great for stress testing, as we have a lot of content and it links to itself in really weird ways. It's discovered some performance bottlenecks that the IPFS devs have been able to solve. The result is that the newest IPFS implementations are much, much better for massive datasets.
I'm a very strong believer in the distributed web. I think it's the future of static web content. People much smarter than me think it's the future of the dynamic web too, but I'm pretty single-focused on the static side of things right now.
You are doing a pretty huge service to the IPFS project just by trying to use it at this scale. I would love a blog post giving your experiences using it. One of my main complaints about IPFS is that it is very hard to have visibility into the project if you are not willing to follow all the github issues.
As far as DMCA issues, I'm sure it helps that free accounts can only upload a limited set of filetypes. MP3s, MP4s, EPUBs, PDFs, ZIPs, etc. are all only allowed with paid ($5/mo) "supporter" accounts, which is a much easier game of whack-a-mole than trying to keep free users from signing up for a new account after you ban them.
We get a small amount of SEO pagerank garbage and phishing attacks (most of which don't actually work because we don't support HTTP POST). We have user reporting and detection code that catches basically all of it, the scammers get sick of getting banned within a few hours (on average) and leave to find a host that's... not as good at this.
Our policy is to remove phishing and spam and report it to stop spam services. The major reason for this is that I want to keep our nose clean for pagerank purposes. I don't want Google to decide we're just a garbage dump and dock all our sites in search results. I surmise (rather, I hope) that our pages have a much higher rank than many other free hosting providers (and even some major social networks) because we work so hard to be proactive on this problem.
I wish Google provided better resources for this than they currently do. I'd love an API to report SEO pagerank spam, for example. Right now I have to do it manually with a form.
Abuse was not a reason, it was the reason we ended up rolling our own anycast CDN with our own ASN (https://whois.arin.net/rest/asn/AS395409). Abuse reporting goes to whomever owns the IP address, so our hosting providers would get these complaints. There was a real concern we would lose our hosting providers. The important thing to understand is that most hosting providers think you're just running a Wordpress blog, so if there's an abuse complaint they just think your blog got hacked and treat you accordingly. If you want to be an ISP, learn BGP, the cloud will not save you.
We don't get many DMCA takedowns, it's usually something really dumb and arbitrary. One of the reasons for this is probably that we blacklist certain types of file formats (such as videos and mp3s). The idea with Neocities is to use it to make web sites, so for free sites, we only allow file types useful for making web sites. Supporter accounts are not subject to these restrictions.
We used to get more classic spam (porn, "dick pillz", etc.) but not as much these days because it isn't as effective. That spam tended to hover around whatever social ill Americans were experiencing. For example, before the Affordable Healthcare Act kicked in, we got a lot of online pharmacy drugstore spam preying on people that couldn't afford their medicine. It might come back if they start dismantling the ACA.
As for comment spam (for the main site), we have strict requirements to allow commenting. You have to wait a week, make a site, update it at least a few times, and do some other specific things before you can comment.
That's not only helped with spam, it's also helped to deal with jerks. It's hard to stay mad enough at something to wait a week while engaging in psychological sublimation, just to leave a turd on someone's site profile at the end of it.
And no advertising on sites, ever. This is our golden rule.
My goal is to never make any changes to other people's sites. The only exception I'm giving myself is for an extreme emergency, such as a major security problem. It's never come up, I doubt it ever will. During the SSL transition there were a few sites I helped convert to SSL, but that was with permission from the site owner.
You could have an opt-in so people could participate in "neighbourhood celebrations" and all show a ribbon for a particular event, say, TimBL's birthday or something, like Google Doodles.
Either way, this is bloody awesome, good luck with it all.
Just servers, about $550/mo once we launch the new infrastructure. That doesn't include the $10k I had to sink in to buy the equipment and IP addresses.
Then pad the bill a lot of misc other nonsense: social media liability insurance (yes this is a thing), ARIN fees, LLC registration, a literal fax machine (for DMCA compliance), monitoring, etc. Grand total will hover around $1000.
Architecture is a core + CDN model. The main servers run as a HA cluster in a datacenter, and then the anycast CDN caches content at the edge. It's not too far away from how S3+Cloudfront works or something like Cloudflare works. Nginx does all the heavy lifting, and the "front store" is just a giant blob of ruby: https://github.com/neocities/neocities
Not too bad for 110,000 web sites. Costs at this point are pretty stable for the next million sites (but surprises happen). I can double our bandwidth capacity for about $200/mo in less than a few hours if I needed to in a pinch.
The sites average about 25 million unique views (IP address per hour) and 50 million hits per month. This increases about 20% per month, sometimes slowing down a bit, then shooting right back up again.
Every once in a while a big site somewhere hotlinks an asset on Neocities and this skyrockets, but we just ask them to host the asset(s) directly and things go back to normal. Technically it's never caused any capacity issues, but obviously we don't want huge sites hosted elsewhere to use Neocities as a CDN.
It's interesting to realize someone can do this for about $0.01/site/month. It makes one ask the question "just why do we need ads for social networks"?
Advertising is lucrative as hell right now, and is propped up by it's true market value being hazy (FWIW, I think advertising is probably overvalued right now). Neocities would make a lot of money if we put advertising on the sites, but of course, that would also destroy the site, just like it did with GeoCities.
The big cost at most social network startups is labor. Infrastructure expenses are somewhere down there with the free bacon budget and the open bar tab at OSCON (I'm joking, but you get the idea).
Are you confident about the current donation model? (I understand/appreciate that it's not a business)
I just want to make sure sites can stay up before I start recommending this to friends' kids.
I'm very confident in the donation/supporter model. Once we stop needing to upgrade our infrastructure, it should grow faster than expenses.
I can be high and mighty about this, but legally Neocities is a public benefit LLC, so it is infact a private business operating on a freemium model.
I've pondered arranging Neocities as a nonprofit, but unfortunately that would add a ton of paperwork, costs, and bureaucracy. All I would really get in return is the option to roll the dice a couple times on some temp grants. Not sure it's worth it.
As for VC, I have good friends in VC, but I'm not really interested and nobody's ever offered. IMHO there's insufficient demand to justify 10x growth companies here. There's some people doing business/developer focused static hosting VC startups, but again, lots of competition and insufficient demand. Most of them have ended up as talent acquisitions, and the sites they hosted shut down. We've outlived most of them with the supporter/donation model.
Any webhost (paid or not) can disappear overnight, so it's generally a good practice to keep two or three copies of the source code of any website (one at a home computer, one on GitHub or something).
Besides, aren't kids into the whole ephemeral thing now (Snapchat and the like)?
> That doesn't include the $10k I had to sink in to buy the equipment and IP addresses
where did you buy the IP addresses? I them for sale on sites that purport to auction IP space but I've never known which of those sites are trustworthy etc.
I wonder if you have any plans for u2f two factor authentication (or even TOTP)? For people that are in the process of learning HTML, u2f seems like the only secure option because the mental overhead needed to grok ssh usually is too big.
For instance, if there were scandal allegations involving your favorite politician, and a Neocities user was writing about them, would you take the pages down at their request?
Personally, I don't have any reason to use Neocities but I am enormously happy that it exists. Geocities and Angelfire and all of those weird web sandboxes are where I first wrote code, and what led me to pursue software engineering as a career.
Back in the stone ages, Tripod offered Perl hosting with its free accounts, and that, along with javascript, was my introduction to programming.
I wrote what may have been the worst ever attempt at a messageboard, and I think only one other person ever even used it. Every post was a single line in a URL-encoded textfile. Good times.
I built a service specifically to be a CORS sql database and user management api backend for neocities last year. The example app was forum single page app. I pimped it here but it didn't get any traction. It was my "wouldn't it be cool if" from building geocities sites back in the day. I guess there are a lot of other avenues for learning to code nowadays.
Oh geez I forgot all about tripod doing that. That's one of the places I originally cut my teeth with perl. That and Matt's script archive (though I was quickly fixing or rewriting those as I learned)
Same! Homestead and Geocities were just enough to introduce me to Frontpage and Dreamweaver, and a year or two later I ended up becoming a web standards nerd. Fast forward fifteen years and I'm managing other engineers now.
I taught myself HTML from a children's book(!) and Geocities hosted my first amateur website; I miss it still. I liked that there was an option for hand-coding your HTML rather than use a website builder, an option most free hosts don't now have. I am very grateful for Neocities!
Same here... except it was (Free)webs. Back then, they let you code your own pages as long as you put a little banner that had their logo on it somewhere on each page. Don't know if they do anything like that anymore.
Same here. My first web page was on "expage" but I quickly ended up on Geocities and Angelfire for quite awhile. When I finally moved on to 'real' hosts I used Hypermart and Virtualave to host my Perl.
Kyle, thanks so much for all your hard work setting up Neocities! I think it's a wonderful thing you are doing.
Also, since we're talking about neocities, here, does anyone have any cool neocities sites they know of and want to share? Just post a reply to this comment, so folks who want to have other neocities discussions can easily collapse all the links at once.
Note: [SEIZURE WARNING] I suppose, for those for whom it may apply -- the linked page has a weird moire-like fast-blinking pattern, epileptics be careful.
I really love Neocities. I have used it to host https://www.makersatwork.com/ for some time and have donated to Neocities and participated in their Kickstarter campaign.
Ah, the name brings back some memories. A long time ago, about 15 years in total, when hosting a PHP site was too expensive for a 15-year-old and free hosting usually came with ads there was a community on neopages.net which offered no cost ad-free PHP hosting. The only thing you had to do to get it was submit an entry on neopages forums containing a link to your current site along with a description of why you deserve a subdomain on neopages. You'd then get judged by hosted members and either get an account or try again. Neopages was the community of teenage geeks that got me hooked on PHP after I outgrew GeoCities. Curious if any of you guys know what i'm talking about or had a site hosted there? :) Some of you are likely in your early to mid 30s now.
I used Geocities. I think it still exists in Japan.
Back then, HTML templates/generators were very mainstream.
Nowadays that use case was largely replaced by what we now call blogs. Many of those websites were in fact proto-blogs.
Later, as bandwidth increased, digital cameras became mainstream and processing power increased, photo sharing was added as common use case. Try downloading a 2 megapixel+ PNG with a dial-up connection... very slow. Now we take it was granted.
Now in addition to blogs, you also have Google Sites, wikia, and countless others... including Wikipedia.
I love easter eggs in open source code. I was able to easily find this in the code and learned a bit about neocities and geocities URL formats in the process.
I was expecting that neocities sites would have similar URLs to geocities (in the neocities.org/server/user/page format). This is a fun way of learning about stuff.
Unfortunately the way web security works these days, there is no concept of path origin security, so sites in the neocities.org domain would be able to execute XSS attacks and steal session cookies and whatnot. Subdomains (site.neocities.org) are considered a different origin, and that allows us to prevent attacks to the main site. It's not perfect, there have been attack vectors in the past (which have been mitigated by some security features, such as HttpOnly cookies).
Obvious: rhymes with Geocities, and is one letter different from Geocities
Less obvious: the prefix neo makes it a "new" Geocities
Subtle, and my favorite: seemingly everyone on the web today is jacked into a Matrix of "walled gardens" where they are tended and farmed, and Neo is the name of a guy who undoes that shit.
I've used Neocities for something like two years now to host my game development portfolio and other miscellaneous docs. I've been super happy with the ease of creating and uploading content, and I recommend it whenever somebody technical is looking for a cheap static hosting option.
I showed my 9yo this and now he has a site about minecraft. I showed my 14yo and now she is building a gallery for her manga. My other kid is away but he is the one who is really going to love it. I really like this site.
As I understand it, it's gone. They possess no archive, except for what was backed up by web archivers. I could be mistaken.
I spent years trying to acquire what remains of Geocities, which is the domain itself, geocities.com. I got closer than you would expect, but was told it was being "used internally" so they couldn't divest of it. I was also told I wasn't the first person that inquired.
As I understand it, geocities.com will go to Verizon (unless that falls apart), who will do god knows what with it. Right now it redirects to Aabaco Small Business, which I think is a spinoff that's not part of the deal. Aabaco curiously has an office in Beaverton, OR, a suburb of Portland, where I live. I've been meaning to drop by their office randomly with a jello mold or something and say hi.
I really want to relaunch geocities.com. I'd love it if someone gave me the domain so I could do that, but I'm not holding my breath.
I've always thought geocities could have been facebook. People just wanted a page to post pictures and share with their friends. Geocities could have automated something like that....
MySpace shows that it wasn't just about having a page to share images and stuff IMO.
Geocities & MySpace had little consistency across pages. But Facebook won by starting off with trend-setters (college kids) and using network effect as it's foundation.
In the UK FriendsReunited filled the "share pictures and info" hope too and briefly was pretty massive.
There are a lot of differences. A Wordpress sites html is generally rendered serverside, by php code with access to plugins and a database. Wordpress can do things like post forms, run surveys, you can pretty much implement any web app you care to with Wordpress and plugins. It's a very mature platform.
Neocities sites are static HTML, meaning once your files are uploaded,they don't change. Neocities doesn't do POST, there is no database backend or code running on the server.
Now in 2017, CORS allows client side apps to do just about anything traditional web apps have done, without page tranistions, given an appropriate backend. The difference is that html rendered by javascript on the client typically isn't indexed by search engines, while html served from a domain are. That's one significant difference, there are others.
Thanks. that helps a lot, though I don't quite get "CORS allows client side apps to do just about anything traditional web apps have done, without page tranistions, given an appropriate backend", thought CORS is just a secure measure.
Browsers implement what they call the "same-origin policy" as a cross-site scripting prevention measure. This prevents you from using XMLHttpRequest calls on other hostnames/ports, which effectively means if you're making a static website on a host with no API endpoints, your website can't interact with any backend services. As a result, you can't save or load data from a server-side database or do a lot of other operations that traditional web applications can do.
There's pre-CORS workarounds. You could build an HTML multipart/form-data POST form inside an iframe and submit it with JavaScript for example. And if the server API supports JSONP, you can inject a script tag into your page that loads the target content as a script which then executes the data in a callback to read it back into the client page.
If you don't care about REST, and you only need to do GET/POST requests with a limited set of mime types, you could make a client-side application that gets around the same-origin policy without using CORS. But it's ugly.
With CORS though, you can potentially make any type of request across origins, because the CORS preflight OPTION requests allow a server to specify what request methods and what headers a client from a certain origin can access at a given URI. And these days, you can find CORS-enabled third-party REST APIs that you can use with things like client-side OAuth to provide all the same functionality that you would have in a traditional web applications.
I've been thinking about using a completely split API/client-side app architecture in my own projects lately, because scaling a bare API is much easier and cheaper than scaling a web application.
So yes, CORS is just a security measure, but it gives you more functionality in a client-side application by allowing you to bypass an older security measure, the same-origin policy, in a very clean and explicit way.
It is a security measure. Suppose you have a marketing site for a client. You'd like users to be able to fill out and submit a contact form. A host like neocities can display the html with the form to users, but neocites won't let you POST the form and do anything with the data. So, CORS allows your page on neocities to POST data to another domain (ie www.othersite.com). The javascript on the page would do something "event.prefentDefault()" to keep the user on the page, doing the form submission via ajax. Then the server at www.othersite.com can do stuff with the data.
There are third party services that provide form processing of this nature, and even complete database backends and user management APIs (I built one).
Neocities was actually launched and bootstrapped on HN about 3 years ago, and donations from HN users bankrolled the first year of operating it. Things have been going really well, the site is growing and still sustains it's own existence through donations and supporter accounts.
I still work on the site heavily. We're launching some big features soon (more space, Github webhook deploys, etc.). We just finished migrating to SSL (for everything, including hosted sites).
I've had to do some pretty crazy stuff to make the site work, some of which is not documented well and I think the HN crowd would find pretty interesting. For example, we figured out how to run our own global anycast network for "cheap". I would love to share how to do that with people, there is approximately zero information online or in books on operating anycast networks.
My new years resolution was to get better at writing about some of the crazy tech I've had to do for the site. If you're interested, there's an RSS feed you can subscribe to for our blog where it will be posted in the future: https://blog.neocities.org/feed.xml
Again, thanks go to HN. Site literally wouldn't exist without it, you were basically our seed investor. Feel free to ask me questions, I'll try to answer. That's something you're supposed to do with your investors, right?