Slashdot Mirror

Simon Anderson Says:
January 21st, 2012 at 11:55 am

some more detail – our systems have stored and used encrypted passwords for a number of years, however the hacker found a legacy pool of unencrypted FTP/shell passwords in a database table that we had not previously deleted. We’ve now confirmed that there are no more legacy unencrypted passwords in our systems. And we’re investigating further measures to ensure security of passwords including when a customer requests their password by email (this was not the issue here, though). Re your shell accounts, I’d suggest that you select a new password just to be sure.

Search for "January 21st, 2012 at 11:55 am" at this link

Also, due to the number of customers changing their passwords, the password sync time is very slow right now. More info here.

Apparently the passwords were hashed [...]

I'm not sure that's quite true across the board. According to a blog comment here by Simon Anderson (dreamhost CEO):

Zachary:- some more detail - our systems have stored and used encrypted passwords for a number of years, however the hacker found a legacy pool of unencrypted FTP/shell passwords in a database table that we had not previously deleted. We've now confirmed that there are no more legacy unencrypted passwords in our systems. And we're investigating further measures to ensure security of passwords including when a customer requests their password by email (this was not the issue here, though). Re your shell accounts, I'd suggest that you select a new password just to be sure.

I'd be hard pressed to believe you've dealt with anyone other than DreamHost. When I failed to renew my service with them it was because their hosting was glacial. It could barely keep up with a lightly used PHP image gallery. That was years ago. When I migrated clients away from DH last year it was because of chronic downtime. "Oops we fucked up" is great, and it's honest. It's also not something you want to keep seeing. "Oops we fucked up, but your worthless blogs about your kittens' trousers are safe" is /not/ something you want to see, ever. We're suffering a DDoS... no... wait... we don't know how to fix our Cisco equipment... is not something you want to see ever. Certainly it's not something you want to keep seeing

Not doing any manner of scheduling for intrusive maintenance is not simply a tactic to scare away high maintenance customers, it's a tactic to scare away paying customers. You wanna know what's even less professional? Not having any phone support in the first place, and then not having any e-mail support or publicly available system status because everything's on the same network. A single point of failure isn't a tactic to "scare off the clueless, high-maintenance market" it's a hallmark of someone who doesn't know what they're doing.

It's a bit less trust-inspiring than you represent it.

Brian H. from Dreamhost initially posted on the Dreamhoststatus page that FTP/SSH passwords are only stored hashed. Later he deleted that statement. Why?

Web panel passwords are definitely stored in a retrievable way, because when you forget your web panel password they mail it to you. Not a nonce key that allows you to set a new password, they mail you the actual password. According to Dreamhost CEO Simon Anderson, they're now evaluating if they could change this practice.

Anderson also said that FTP/SSH passwords are stored "encrypted". He didn't say "one-way hashed" or "salted and hashed", he said "encrypted". So it could be a reversible encryption with the master password retrievable from somewhere else. Anderson doesn't reply to requests to specify what "encrypted" means.

“however the hacker found a legacy pool of unencrypted FTP/shell passwords in a database table that we had not previously deleted.”

So they had stored passwords in plaintext in the past and forgotten about it.

Allegedly, email passwords were not compromised, but they recommend changing them just to be sure. Actually an intruder with a FTP password could just FTP into the user's home directories and with a pretty good chance retrieve SQL and email passwords from config files and logs of any webapp that uses a database/email. Most webapps store those in plaintext. Dreamhost doesn't say if they checked which user files where accessed in the vulnerable time span. SQL connections are restricted to Dreamhost servers, but an SQL password gives you web access to databases over phpmyadmin.

There are several requests in the web panel's Suggestions section to stop sending passwords to customers or displaying them in the web panel. Dreamhost has been ignoring those requests for years.

I've been super-happy with Dreamhost. They are are pretty inexpensive and have great, fast, US based tech support. I'm using them for both domain name and hosting.

1&1 is terrible. I had a site go down for about a week due to crap on their end. Initially, their tech support would say that there was nothing wrong. Then I would get 'bumped up' and the only response they would give me is "our technicians are aware of the situation and are working to resolve it." Can you give me an estimate on how soon it will be fixed? "I do not have that information." What is the problem? "I do not have that information, sir." That was all after about a 2 1/2 hour wait on hold.

I switched to Dreamhost after that and haven't had any problem since. Once when I did submit a trouble ticket, the tech responded to me BEFORE the automated responder saying "your trouble ticket has been received and someone will be with you shortly."

Plus... there's the added benefit that their US based tech support is an hour south of me in Orange County just in case if I ever did have any real problems, I could take a drive and do some, uh, encouraging. ;-)

I'd like to point out that Dreamhost appears to have been against SOPA from the very beginning. Here's a post on their official blog from November

For anyone looking for GoDaddy alternatives, there's plenty of options, but as a happy customer I'd personally like to direct your attention to Dreamhost. I don't host anything busy, so my personal sites are happy on their shared hosting platform for which I pay a whopping $1.95/month [$48 total to pre-pay 2 years]. Again, without any crazy high traffic, their shared hosting is plenty fast for me. In addition, I get to host unlimited domains, unlimited space/bandwidth [until it affects the shared server of course] including mysql database. And the account comes with one free domain registration. Additional domains are price pretty typically, $9.95 for com/net/org domains. On top of all that, you get a debian shell account [non-root of course] which has worked out great for me. Obviously if you've got busy sites you might want some dedicated or VPS servers or something but they have those too.

Today I transferred my 3 domains over there and everything went smoothly. Even on GoDaddy's end, amazingly. The transfers were all fully complete within about 1.5 hours.

I don't work for them or anything. I'm just a happy customer.

Use "NODADDY" a Name.com for 10% off transfer ins (COM, NET, ORG, TV, INFO, IN, US, CO, ME & TEL) and also receive 40% off any hosting plans.
HostGator is doing 50% off Shared / Reseller / VPS first month. Coupon code: NOSOPA
Name Cheap has a "special discount deal": BYEBYEGD
DreamHost use NOTOSOPA you get your first registration free.

I can't claim credit for this, all came from Reddit

Name.com has a page where they talk about how they don't support SOPA, but "calls on Congress to search for a new way to protect intellectual property rights." So they sound like they'd support alternate legislation that is slightly changed (like OPEN), but honestly almost as bad.

Be aware that many registrars may just be trying to steal business from Go Daddy, and are just pretending to be against SOPA in order to do so. It would be wise to research the policies of these companies before just going for the coupons.

You forgot to mention their awesome API http://wiki.dreamhost.com/Application_programming_interface

Use "NODADDY" a Name.com for 10% off transfer ins (COM, NET, ORG, TV, INFO, IN, US, CO, ME & TEL) and also receive 40% off any hosting plans.
HostGator is doing 50% off Shared / Reseller / VPS first month. Coupon code: NOSOPA
Name Cheap has a "special discount deal": BYEBYEGD
DreamHost use NOTOSOPA you get your first registration free.

I can't claim credit for this, all came from Reddit

I use dream host... "unlimited space and traffic" they really mean don't go crazy and try to host a google.com mirror off of it. Its pretty cheap, I pay $8 a month. You can run cron jobs, mysql databases, etc. I've been happy with it. I know it is karma/referral whoring but you can use my referral code and get a free domain registration: FOLLOWTHEHORIZON (if you already have a domain just use DREAMBUCKS for $50 off your first year). http://www.dreamhost.com/r.cgi?303747

https://files.dreamhost.com/

a 1 time fee for indefinite term storage

Just a customer (though I haven't used this service specifically), not a rep of the company.

And which budget shared web host supports file uploads using such protocols?

Dreamhost. Being able to SSH in and pull down something with their pipes using wget has come in handy a number of times as well.

The client thing, meh. If people are mucking around in command line FTP programs they're savvy enough to download one; if they're using a GUI an awful lot of them have SFTP support these days, including FileZilla (free/Free). I guess I could see an argument if they're just entering an FTP URL into their Explorer window.

I'd love to use this service because I'm a huge Ubuntu fan, but the price just isn't competitive. $3 per month only gets you 20 GB.

For example, you can sign up for a Dreamhost shared hosting account, get unlimited TB of storage and bandwidth for $9 per month: Dreamhost hosting plans

You can throw a multitude of various front-ends on it with their "Easy Install" or whatever the name is, and have pretty much any files you want served to you where ever you want.

I have a lot more than 20 GB of data that I'd want to sync and back up.

From a pure price/features standpoint, rsync.net is roughly comparable in price but has a way better feature set (copied from their page):
- ssh, scp, sftp, ftp ... and tools like rsync, rdiff-backup, duplicity and Unison
- IPV6 connectivity and dedicated Gigabit connections available
- BackupAssist, Backup Exec, Imaging, System Restore, and Bare Metal
- Seamless integration with VMWare, Xen, Citrix and Hyper-V
- ssh key based automation and support for remote UNIX commands
- Multiple logins and custom access/permissions
- Encrypted filesystem support

If Ubuntu one were to change their pricing to be about $10-20 per TB, per month - I'd probably jump on board. I know, that's a pretty tough price point to meet, but others (like dreamhost) are able to do it.

How much do you need to PAY in web hosting for a service that is as convenient and reliable as picasaweb?

$8.95 a month for unlimited sites. Hardly something that is going to break your budget and can be reused for many other things.

I had a good experience with http://www.dreamhost.com/ a few years ago. Employee owned company with good prices, good service, and active forums that DreamHost's employee's participated in regularly.

fwiw, DreamHost says Ryan Cleary was behind DDoS attacks on DreamHost.

My guess...

http://www.linkedin.com/pub/dir/Jason/Carthew/
http://discussion.dreamhost.com/user-133775.html

-MP

Dream host (or many other providers) is less than $5 a month.

According to this page, basic hosting is $8.95 per month (incl. domain), and a unique IP address (required for SSL) is an extra $3.95 per month.

You only need cert if you handle sensitive data; nothing says you couldn't use openid for login.

One's session cookie itself is sensitive data, as any Firesheep user can snoop it and use it.

You seem to be conflating two related (but separate) issues; admittedly the fact that we seem to use 'bandwidth' interchangeably with 'monthly data transfer' doesn't help matters. Point is, paying by the megabyte would do nothing to ease congestion at peak time unless they also stopped overselling bandwidth - if everybody pays for 1GB of transfer and tries to use it simultaneously, your streaming video will still interfere with your neighbour's Skype call.

The overselling of bandwidth, however, is necessary to make remotely efficient use of the infrastructure. The vast majority of net use is burst-based, so it's a huge waste to pay for the full 10Mbps of capacity for every user - just look at the prices on a leased line if you want to see how much that'd actually cost. Even at peak time, nowhere near 100% of customers are using their lines at 100% capacity. Here's a fairly good post on the subject (admittedly biased, but accurate nonetheless) from Dreamhost.

The problem arises when that oversold bandwidth is coupled with so-called unlimited transfer. If there is no limit on your data transfer, you have the right to use your line at full bandwidth capacity 24/7 - if too many people start doing that (and if the bandwidth has been oversold too heavily) then problems start to arise.

Per-GB pricing on data transfer doesn't actually do anything to prevent congestion in itself - as I mentioned above, you'll still hit problems if you all try to use your 1GB allowance at the same time - but it helps to even out usage, and you can at least reach the point where everyone can theoretically use their entire transfer allowance (even with oversold bandwidth) over the course of the month.

Overselling is a necessity if we want sensible prices - I won't reiterate the whole argument here, but Dreamhost explained it pretty well.

What should be banned is the rampant false advertising that we see now. If my household is using the 50Mbps connection to download around 200GB/month then we want an oversold connection - no point in paying for the tens of terabytes more that we're not using. The ISPs, however, should be required to state clearly what the limitations of the connections are - if they're selling 'unlimited' then I sure as hell want unlimited, however impractical that may be on the prices they're charging.

Beyond that, sensible limits (two standard deviations from the mean, perhaps?), reasonable per GB charges or voluntary throttling or cutoff over the monthly limit, and a rolling three month average to calculate whether or not you've gone past your allocation would all be beneficial for both the customers and for the ISPs reputation.

Ah well. We can dream. Or try to get investment to set up our own ISP, with blackjack and hookers.

I have Chrome, Thunderbird, my MP3 player and DropBox on TrueCrypt partitions.

Computer is PowerCycled and it's "gone". Since speed isn't a huge factor I went paranoid and went with AES-Twofish-Serpent. Good luck recovering my stuff.

I use DreamHost for my mail/webserver. They're not 5-9s but they're cheap and still seem like they are a "small company". Plus they wrote Ceph, (distributed/scalable file system, which merged into 2.6.34.)

I'm sure you could write cron script or something to run on the shell to do what you're talking.

Although some people definitely do have unreasonable demands, I think you're giving too much credit to the companies. I know they have the right to do whatever they like, but if I think they're being price-gouging asshats then I'm still going to complain about their service.

If you're advertising unlimited, give me unlimited or stop fucking lying in your adverts. Note that I'm well aware that a true unlimited service would be prohibitively expensive, and that overselling is what makes pricing reasonable (Dreamhost's blog entry is pretty good on the subject), so I'm fine with caps.

A 250GB monthly cap for a home internet connection sounds perfectly reasonable. A 1GB cap for a low priced mobile service sounds fine. 10-15GB or so for a higher tier mobile package is sensible, I'd say. All of these should have low priced per-GB fees above the cap.

For now it seems that people won't/can't vote with their wallets on the issue, so I can't blame the companies for screwing us over in search of more profit (that's what companies are built to do). What I can do, however, is post rants like this in the hope of encouraging more people to switch to a better ISP if there's one available, even at a slightly higher cost.

FILE SYSTEMS SOFTWARE ENGINEER
Los Angeles, CA

New Dream Network has a vacancy for a Senior File Systems Software Engineer in Los Angeles, CA. Minimum requirements – Master’s degree in Computer Science or Computer Engineering, minimum of 2 years experience in storage programming, and background in Linux kernel programming, file systems development, network programming and Operating Systems design.

Qualified applicants should send a plain text resume to cephjobs@dreamhost.com

There are some open source CAM programs, but none of them are really good enough to replace something like MasterCAM at this point.

There's a list of programs on the linuxcnc.org wiki, here: http://wiki.linuxcnc.org/cgi-bin/emcinfo.pl?Cam

Incidentally, if you want to help finance the web hosting for this project, and you happen to need web hosting as well, use this link: http://www.dreamhost.com/r.cgi?80098

I don't think there's a single-host solution. For reliability: go with http://pair.net/. For control: get a virtual server. I use http://prgmr.com/ and am extremely satisfied - they're cheap, responsive, and the technical support is excellent. They're also nice, honest people. See http://lowendbox.com/ for more options. For storage, backups, and data transfer: go with someplace like http://dreamhost.com/. If you need more than one of the above, go with more than one host. For example, start with Prgmr.com (or Pair) and your site there, and when you need more disk space or bandwidth get a Dreamhost account. Then store your images and site backups at Dh while keeping your code and frontend at Prgmr.

I have had a good experience with DreamHost. Their support is snappy and helpful, and the people who work there seem generally kind. They have a fine set of dreamhost-specific howtos maintained on their wiki, and a powerful but easy to use panel for administration.

They run linux boxes with the full complement of command line tools (with compilers and everything!), and the only restriction is no persistent processes. If you want to do that, you can buy their pricier private server option which gives you your own private server instance.

They have some great terms of use (as far as storage and bandwidth are concerned), and their prices are reasonable. I got a great deal a while back on two years of hosting, and now I'm hooked on the service.

I have Dreamhost. They provide a copy and paste line for a DNS entry. See http://wiki.dreamhost.com/SPF

It's one of those things that won't be useful until just about everybody has implemented it. The way it works is by defining which IPs can send email purporting to be from a domain; if you receive an email "from" a yahoo address but coming from some cable modem, you can block it. And as long as not everyone has SPF, you can't just block emails that fail a SPF check...

So yes - I do use it. But it's mostly altruistic, as it really has no effect on incoming email unless you just block no/invalid SPF.

I don't understand why everybody doesn't just enable it - it's a few minutes' worth of a TXT field.

https://files.dreamhost.com/94381/dl/DamBurst-1.2.exe

Dreamhost documented the practice of hosts overselling on their blog a few years ago.

http://blog.dreamhost.com/2006/05/18/the-truth-about-overselling/

FWIW, I've also been with them since '05, and while they've had their hiccups, I think the package is great; and they've become stronger in terms of infrastructure as a result. Speaking as a developer. I use their private servers now too, and am sooo pleased to have the root user capability added recently, alongside their groovy control panel which is fantastic.

Disclaimer: I get my basic ~$7 a month package hosted for free, pretty much forever, because I manage a site for a US, IRS documented charity, so Dreamhost gives me credit on my account for this month, every month for.

Dreamhost had an issue last year where they incorrectly billed customers to the tune of millions of dollars. They seemed to be quite up front about what happened, apologized, returned the money as quickly as possible and really tried to figure out how to not have it happen again.

Dreamhost had an issue last year where they incorrectly billed customers to the tune of millions of dollars. They seemed to be quite up front about what happened, apologized, returned the money as quickly as possible and really tried to figure out how to not have it happen again.

Well that blows.

I know someone that signed up for with DreamHost last year when they had the $9.99/yr promo one day.

He's been pushing about 3TB per month from his fileserver. :P

Lucky him, I guess?

Even going with a webhost a bit more professional, which won't oversell... like say VPSville or VPSlink, you can get about 1TB of bandwidth for about $60/mo, which comes out to about $0.06/GB.

Plus you get a bunch of beefy VPS's you can use for whatever you want, in addition to the downloading.

Seems like a fine solution to me. VPSville has their own control panel that lets you add more VPS's as needed, and apply an image to them. Setting up another download server when you need it can't be that difficult - although it probably wouldn't work for PSN/XBL stuff.

bluehost, dreamhost etc. plenty of HDD & Bandwidth for few $ a month. Don't even try to run any regular website on it, they'll cut you off (CPU & Ram usage)

Not having used the providers in question, I have to ask, why shouldn't I try to run a regular website on them? Isn't that exactly what they do - web hosting, of regular web sites? There's no reason why a regular web site should use excessive amounts of CPU or RAM.

but for filehosting, it's great bang for buck :)

I just skimmed the DreamHost TOS and saw that they explicitly ban "File upload / sharing / archive / backup / mirroring / distribution sites." Maybe not that great for file hosting after all...

I use my dreamhost shell at work to get around work's s filter. Especially since in the last week they really tightened down the firewall.

I suppose if you had the extra cash $10 a month for no filtering might be worth it. There are plenty of other ssh enabled hosts out there.

Let me also state why one shouldn't use your ISP's system. Your ISP doesn't win or lose customers by the quality of their email service. For them, email is nothing but an added expense which they run because they "have to" and because it creates a lock-in opportunity.

This is so true. Same goes for webhosts. Some even try to get rid of email. The company in question is trying to move all customers over to Gmail and has already cut off new customers from procmail access, even if they still list it in their service description.

Check out Dreamhost.

They have a promotion on right now where a pretty good plan is only $6/month. Normally it's about $10/month. They provide webmail, POP and IMAP email access. Over the 5+ years I have been a customer with them, they have been exceptionally reliable.

They also have tons of other features you might never use, but are good to have available just in case. This includes stuff like Subversion repositories, SQL databases, easy to install web apps (WordPress, Joomla, and a few other popular apps), video streaming, etc.

It took a while, but now I make about $20/month with Dreamhost rewards/referrals. It's free to get an ID, and once set up takes virtually no effort on my part. This explains how the rewards program works.

It took a while, but now I make about $20/month with Dreamhost rewards/referrals. It's free to get an ID, and once set up takes virtually no effort on my part. This explains how the rewards program works.

It took a while, but now I make about $20/month with Dreamhost rewards/referrals. It's free to get an ID, and once set up takes virtually no effort on my part. This explains how the rewards program works.

Just look at Dreamhost. In January someone typed in the wrong number, and accidentally billed everyone for all of 2008 at once. Ended up overcharging 7.5 million bucks from one bad keystroke. Oh, and then they joked about it in their blog. Gotta love waking up to a surprise 120 dollar charge, and the company just laughs it off.

I was using Amazon S3 before realizing I was paying double when I had a spare 20 gigabytes on my FTP/HTTP hosting service. I could pay an extra $10 a month to get SFTP/SSH service but I guess I'm being cheap.

You may find that using your Web hosting service as a file storage solution will backfire on you.

I use Dreamhost for my personal Web hosting. It's cheap, reasonably reliable (one major outage in the five years I've been with them, but then Rackspace has had a major outage too in that time too), and comes with a metric ton of disk capacity.

BUT... Dreamhost (like most commodity hosting providers) assumes that 99% of their customers will never actually use all that capacity. That assumption held true until last year, when they noticed more and more of their customers using all their previously unused disk capacity for stuff like automated backups of their home PC. Which, it turns out, they explicitly ban in their terms of service, which state that your Dreamhost disk space is for web hosting only.

So customers started getting emails telling them that they had three options: erase all those backup files, close their account, or start paying Dreamhost $.20/GB/month for non-Web file storage. That's a nickel more per GB/month than S3.

I don't bring this up to knock Dreamhost; from their perspective this kind of use of their service is really abuse, since they sell it as Web hosting storage space, not generic online disk space, and most hosting providers would probably just kick you off altogether rather than futz with setting up a for-pay storage option. I bring it up to encourage you to just use S3, since Amazon has already solved all the problems you're spending time solving, and the cost savings would be negligible and could even lead to you getting kicked off your Web host altogether (there's no guarantee that your host will offer you a "non-Web storage" option like DH does). All of which is more hassle than I would recommend undergoing to save a couple of bucks a month.

I was using Amazon S3 before realizing I was paying double when I had a spare 20 gigabytes on my FTP/HTTP hosting service. I could pay an extra $10 a month to get SFTP/SSH service but I guess I'm being cheap.

You may find that using your Web hosting service as a file storage solution will backfire on you.

I use Dreamhost for my personal Web hosting. It's cheap, reasonably reliable (one major outage in the five years I've been with them, but then Rackspace has had a major outage too in that time too), and comes with a metric ton of disk capacity.

BUT... Dreamhost (like most commodity hosting providers) assumes that 99% of their customers will never actually use all that capacity. That assumption held true until last year, when they noticed more and more of their customers using all their previously unused disk capacity for stuff like automated backups of their home PC. Which, it turns out, they explicitly ban in their terms of service, which state that your Dreamhost disk space is for web hosting only.

So customers started getting emails telling them that they had three options: erase all those backup files, close their account, or start paying Dreamhost $.20/GB/month for non-Web file storage. That's a nickel more per GB/month than S3.

I don't bring this up to knock Dreamhost; from their perspective this kind of use of their service is really abuse, since they sell it as Web hosting storage space, not generic online disk space, and most hosting providers would probably just kick you off altogether rather than futz with setting up a for-pay storage option. I bring it up to encourage you to just use S3, since Amazon has already solved all the problems you're spending time solving, and the cost savings would be negligible and could even lead to you getting kicked off your Web host altogether (there's no guarantee that your host will offer you a "non-Web storage" option like DH does). All of which is more hassle than I would recommend undergoing to save a couple of bucks a month.

I was using Amazon S3 before realizing I was paying double when I had a spare 20 gigabytes on my FTP/HTTP hosting service. I could pay an extra $10 a month to get SFTP/SSH service but I guess I'm being cheap.

You may find that using your Web hosting service as a file storage solution will backfire on you.

I use Dreamhost for my personal Web hosting. It's cheap, reasonably reliable (one major outage in the five years I've been with them, but then Rackspace has had a major outage too in that time too), and comes with a metric ton of disk capacity.

BUT... Dreamhost (like most commodity hosting providers) assumes that 99% of their customers will never actually use all that capacity. That assumption held true until last year, when they noticed more and more of their customers using all their previously unused disk capacity for stuff like automated backups of their home PC. Which, it turns out, they explicitly ban in their terms of service, which state that your Dreamhost disk space is for web hosting only.

So customers started getting emails telling them that they had three options: erase all those backup files, close their account, or start paying Dreamhost $.20/GB/month for non-Web file storage. That's a nickel more per GB/month than S3.

I don't bring this up to knock Dreamhost; from their perspective this kind of use of their service is really abuse, since they sell it as Web hosting storage space, not generic online disk space, and most hosting providers would probably just kick you off altogether rather than futz with setting up a for-pay storage option. I bring it up to encourage you to just use S3, since Amazon has already solved all the problems you're spending time solving, and the cost savings would be negligible and could even lead to you getting kicked off your Web host altogether (there's no guarantee that your host will offer you a "non-Web storage" option like DH does). All of which is more hassle than I would recommend undergoing to save a couple of bucks a month.

i rsync'd some files to back them up on my Dreamhost account, figured I might as well put some of my huge disk allocation to good use. I got a mail from a sysadmin who'd gone through my files to list ones he thought would be embarrassing and told me I'm not allowed to actually use all that disk space they promise.

I no longer use Dreamhost. They admit they oversell, but don't let you actually use the space. It's flat-out false advertising.

Dreamhost is $9.95 per domain renewal per year. They also offer unlimited domain hosting with even their bottom tier accounts.

Following the link above or in my sig doesn't give me any commission if you sign up, and I'll tell you that they seem to be an honest company trying to provide amazing service. I'll admit they sometimes have service problems, but they are always quick to get things back online.

Seth

If you are willing to cut down your material, this might provide a solution. Perhaps the biggest problem is that these files are really "files forever". Even though you control their access, it makes me nervous to think they will always be "out there". Currently charging $2.50/gig or .01/4Mb.
link: http://wiki.dreamhost.com/Files_Forever#Files_Forever

If you're going with an upload plan and want the stuff to stick around long-term, a flat-rate service like Files Forever (run by major webhosting company, one-time charge by the GB, they'll preserve it until they go out of business) might be better.

I've got no problem with heavy users paying more, light users paying less. But $1/gigabyte is so far in excess of the "going rate" for bandwidth that it's not even funny.

For instance, my current web hosting provider offers me 5 TERAbytes of transfer for six bucks a month. Now, it's possible they'd try to change the terms of the deal if I actually approached that level of usage, but still, it shows the cable company in TFA is charging more by roughly a factor of 1000.

I'm guessing that Dreamhost probably serves up roughly as many bytes as a cable company does in a large town or small city. Now, I totally agree that providing internet access to a bunch of houses spread out over square miles is going to cost more than providing it to a couple rows of rackmounted servers. But that's a *fixed* cost to provide access, regardless of bandwidth usage.

I'm okay with charging more for using more, but this is so out of proportion it's simply highway robbery.

I use DreamHost for that, and it is about $100/year, for 500GB.

I do host a tiny site on it, but nothing special, and not very big at all. (The good news is that you can't slashdot my webcams on there because DH provides a lot of transfer speed and size)

The main weakness of DH is the amazingly slow database stuff (at least when I used it with Gallery2), but you don't care about that.