Acceptable use policy

Draft. Not reviewed by a lawyer. Phase 1 definition of done requires that review before this is published.

Shellac is a free shell account on a small number of machines. It stays available only as long as it does not become a problem for the people who provide our connectivity. Almost everything here follows from that.

Do not

• Send spam, or anything bulk and unsolicited. Outbound mail is blocked; do not look for a way around it.
• Scan, brute-force, or attack anything you do not own. Port scanning is detected and cuts your network access automatically, usually before you have finished.
• Mine cryptocurrency. It is not a moral position. It uses the entire machine and there is one machine.
• Host malware, phishing pages, or command-and-control.
• Store or distribute child sexual abuse material. Reports go straight to a person and then to the authorities. There is no appeal and no warning.
• Resell or share your account, or run a service for other people on it.
• Try to escape the virtual machine or reach another tenant. If you find a way, tell us; we would much rather hear it from you.

Do, gladly

Learn things. Build things. Run a small personal service. Use it as a jump host. Break your own account and put it back together. Security coursework is fine and expected — the tools are installed on purpose. What matters is whose machines you point them at.

What happens when something goes wrong

Four steps, and the first two are automatic and reversible:

1. Throttle — network cut to a trickle for 24 hours.
2. Freeze — the VM is stopped and your files are kept. A person decides this.
3. Suspend — a 30-day hold, then deletion. A person only.
4. Ban and delete — immediately, for the things in the list above that warrant it.

Every step is logged with the evidence behind it, and the evidence is telemetry — connection counts, CPU use, program names — never the contents of your files. Every step is appealable to a person.

Resource limits

Published in policy/limits.yaml in the repository, along with everything else. If a limit is a problem for something legitimate, ask.

No warranty

This is a free service run by a small number of people on hardware that is not in a datacentre. It can go down, lose data, or stop existing. Keep a copy of anything you care about somewhere else.