Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself with Google Spreadsheets (2012)

behind-the-enemy-lines.com

Post reply on HN
Print view View original

21–30 of 32 posts

Re: How I attacked myself with Google Spreadsheets (2012)

#21

Post by Laforet »

voltagex_ wrote: post #20
subway wrote: post #16

Earlier quoted context omitted.

Welcome to the wonderful world of network peering. I suspect Google is very transmit heavy on bandwidth usage. Peering agreements tend to sweeten as your rx/tx ratio approaches 1, so increasing rx on the network makes it easier to establish a peering arrangement, avoiding the need to purchase transit.

Is that why download traffic (incoming data) is free on EC2?

Not really. The pricing was probably set to encourage customers to migrate their infrastructure to EC2 knowing there is no added cost uploading everything you have been storing since 1994.

Re: How I attacked myself with Google Spreadsheets (2012)

#22

Post by leni536 »

Is it a good idea to use AWS through a prepaid virtual card to avoid such cases? I'm planning to set a up a personal site and I could afford the site going down instead of paying $1000. The guy got refund though, but I would rather not going through this hassle.

Re: How I attacked myself with Google Spreadsheets (2012)

#23

Post by abricot »

leni536 wrote: post #22

Is it a good idea to use AWS through a prepaid virtual card to avoid such cases? I'm planning to set a up a personal site and I could afford the site going down instead of paying $1000. The guy got refund though, but I would rather not going through this hassle.

Well... even tough they wouldn't be able to charge the money to your card, you would still owe them.

Re: How I attacked myself with Google Spreadsheets (2012)

#24

Post by kbuck »

voltagex_ wrote: post #20
subway wrote: post #16

Earlier quoted context omitted.

Welcome to the wonderful world of network peering. I suspect Google is very transmit heavy on bandwidth usage. Peering agreements tend to sweeten as your rx/tx ratio approaches 1, so increasing rx on the network makes it easier to establish a peering arrangement, avoiding the need to purchase transit.

Is that why download traffic (incoming data) is free on EC2?

Almost certainly. Many datacenters offer free incoming bandwidth either to improve their ratio or just because it doesn't actually cost them anything (e.g. they're paying for a 10gbit internet exchange port but their traffic is highly asymmetrical on the outgoing side).

Re: How I attacked myself with Google Spreadsheets (2012)

#25

Post by vortico »

Why do people chose to use hosting services with no cap, and then complain that their bills are arbitrarily high? You agreed to that in the Terms and Conditions.

Just use a service with a fixed monthly rate for a fixed capacity, and up/downgrade as needed. Of course you don't want your service to be shut down after reaching a limit, but you should be watching the resources as you would with AWS, only the consequences are much less bizarre than a surprise $1,700 bill.

Re: How I attacked myself with Google Spreadsheets (2012)

#26

Post by sisl »

abricot wrote: post #23
leni536 wrote: post #22

Is it a good idea to use AWS through a prepaid virtual card to avoid such cases? I'm planning to set a up a personal site and I could afford the site going down instead of paying $1000. The guy got refund though, but I would rather not going through this hassle.

Well... even tough they wouldn't be able to charge the money to your card, you would still owe them.

Yep.

Even if Amazon would claim the money you owe in realtime, they probably wouldn't shut you down if your prepaid hits zero.

I use a prepaid for my Kindle purchases and Amazon processes the order even if the payment gets rejected, following up with increasingly insistent reminder emails.

Re: How I attacked myself with Google Spreadsheets (2012)

#27

Post by jon-wood »

danso wrote: post #14
bearzoo wrote: post #11

I REALLY REALLY want someone to do this with a huge amount of google image thumbnails so that the google crawlers just start hitting google servers. Would it be considered malicious to do such a thing?

> Would it be considered malicious to do such a thing? Maliciousness is usually described in the context of intent. So your first sentence should provide the answer to your own question. Is there a way to do what you describe such that the result is gratifying and yet doesn't cause significant duress on Google's servers and employees?

Just doing it the way started wouldn't cause significant duress on Google's servers. You'd be requesting that Google transfer data from a service designed to handle massive volume of traffic, across their own network, to another service designed to handle massive volume. Honestly, I'd be surprised if it even tripped any monitoring alarms.

Re: How I attacked myself with Google Spreadsheets (2012)

#28

Post by leni536 »

abricot wrote: post #23
leni536 wrote: post #22

Is it a good idea to use AWS through a prepaid virtual card to avoid such cases? I'm planning to set a up a personal site and I could afford the site going down instead of paying $1000. The guy got refund though, but I would rather not going through this hassle.

Well... even tough they wouldn't be able to charge the money to your card, you would still owe them.

Yeah, that's what I thought. I wonder why Amazon doesn't support some form of prepaid service. I feel that it's really a deal-braker for me for buying s3, these kind of horror stories scare me away.

Re: How I attacked myself with Google Spreadsheets (2012)

#29

Post by onli »

coreyja wrote: post #19
scintill76 wrote: post #9

> What I find fascinating in this setting is that Google becomes such a powerful weapon due to a series of perfectly legitimate design decisions. It does have a certain "perfect storm of good intentions" quality, but no, "prefetching" hundreds of gigabytes worth of images that the user is not looking at right now* and that will not be cached for the next time the user views it, that the user did not indicate will be…

I'm gonna test it out on a much smaller scale, and slightly different setup. I just grabbed 3 images from a rarely used server hosted with DigitalOcean, with a custom domain, and put them in a new Google Sheet using the same =image(url) technique the author mentioned. The access logs show Feedfetcher-Google; (+ http://www.google.com/feedfetcher.html)" grabbed each of the images once immediately which makes sense. I'l…

I'm pretty sure they fixed it. I don't remember whether that was already in the original discussion of this story or a little bit later, but I remember the comment that one can't use it anymore as an attack tool since the feedfetcher behaviour changed.

Re: How I attacked myself with Google Spreadsheets (2012)

#30

Post by akshatpradhan »

vortico wrote: post #25

Why do people chose to use hosting services with no cap, and then complain that their bills are arbitrarily high? You agreed to that in the Terms and Conditions. Just use a service with a fixed monthly rate for a fixed capacity, and up/downgrade as needed. Of course you don't want your service to be shut down after reaching a limit, but you should be watching the resources as you would with AWS, only the consequences…

People aren't as self-compliant with watching their resources as you think.
Post reply on HN