Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 348 posts

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#281

Post by hnlmorg »

HWR_14 wrote: post #51
hnlmorg wrote: post #28

Earlier quoted context omitted.

In my 25 years of running production services, I honestly cannot think of one company I've worked for that would have accepted their function being stopped in the middle of the night. AWS already has a recourse for incidents like these: refund the spend. That is far more reliable than trusting an organisation can tolerate an outage.

The difference is none of the little sideprojects I work on are worth $4k in a month, let alone in a day. Obviously most companies want to spend the cash, but they should want as many programmers using AWS for sideprojects as possible.

It was more the "big" part of the "big companies" statement I was disagreeing with, rather than the "companies" part.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#282

Post by Havoc »

lostmsu wrote: post #151
Havoc wrote: post #131

Really wish the major clouds had a “I’m experimenting. Kill it if it goes over 1k usd” mode. Not some crappy alerts - actual halt (and delete if necessary) I bet that would increase profits too by encouraging people try experiment more

According to other threads here Azure has this mode.

Not to my knowledge. Certain types of accounts that come with credits have that as a hardcap, but its not something that can be enabled as such

https://docs.microsoft.com/en-us/azure/cost-management-billi...

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#283

Post by ryandvm »

capableweb wrote: post #239
ryandvm wrote: post #61

Earlier quoted context omitted.

It depends on how efficient the dev is. For comparison, I've been running a paid Slack app (a few $K per year) that manages to run entirely within the free tier on Google Cloud Platform.

Paid Slack app just receives webhooks from a Slack organization right? So the amount of traffic it handles amount at max to the amount of messages that gets sent around in Slack, which tends to be very low (in comparison to other applications where user interactions can trigger many requests for example)

True, but in my app's case each webhook ends up making a few dozen Slack API calls.

In any case the free tier will definitely allow you to handle enough traffic to figure out if you've got a viable business model, which I guess is the point.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#284

Post by moreira »

fartcannon wrote: post #257
turtlebits wrote: post #201

Earlier quoted context omitted.

If you had no knowledge on standing up a DB server (installing, configuring, monitoring, logging, access control, and backups, restricting network access), how much time would that take you to learn? That and your VPS requires setup for access control, patches, updates, monitoring, logging.

Starting a db on a web-server and running apt update/upgrade are fundamental parts of working on the web. If you or any of your developers don't know how to do that, you/they should seriously seriously spend the 40 minutes it takes to learn.

I feel like that’s where you separate the pre-cloud and post-cloud devs.

It’s not hard to imagine a dev being brought up 5 years ago into a React world, with JS in the backend and something like Vercel or Netlify to deploy their app.

Someone like that might be entirely uncomfortable when dumped into a plain old Linux server, and would definitely take longer than 40 minutes to even get their head wrapped around what’s going on.

That’s not a knock on them - they get their job done, and to the business that’s all that matters. But yeah, just trying to, I don’t even know, empathise? Try to understand? Who knows. It’s just a different world now.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#285

Post by tete »

jpalomaki wrote: post #116
sirwitti wrote: post #74

I'm very much on the boring technology side of things with respect to hosting. 40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily. If you also use containers you even get quite a bit of flexibility and agility. To be honest I don't really understand the sentiment that developers can get away with not knowing…

Servers can also be liability. You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures, figure how to implement data encryption at rest, implement high-availability and so on. Good platform-as-service can solve many things for you and let you focus on the core thing you are pro…

> Servers can also be liability. You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures, figure how to implement data encryption at rest, implement high-availability and so on.

That is true.

> Good platform-as-service can solve many things for you and let you focus on the core thing you are providing.

I don't see how with platform-as-a-service solutions you can skip documentation, maintenance, log monitoring, disaster recovery, backups, test procedures, or encryption at rest.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#286

Post by Fnoord »

cft wrote: post #196
Fnoord wrote: post #188

Earlier quoted context omitted.

Do you save logs? If yes, there's your PII.

Thankfully, the servers were not in Europe! I said "hardly". It's genuinely amusing how people downvote facts, simply because they don't fit the zeitgeist.

Nobody mentioned Europe, except you. If you are referring to GDPR this still applies if you host outside of Europe.

We disagree webserver logs contain 'hardly any PII'. You may find it insignificant PII, but it does not constitute 'hardly'. IMO its a circumstantial goldmine.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#287

Post by tick_tock_tick »

itsmemattchung wrote: post #142
sirwitti wrote: post #74

I'm very much on the boring technology side of things with respect to hosting. 40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily. If you also use containers you even get quite a bit of flexibility and agility. To be honest I don't really understand the sentiment that developers can get away with not knowing…

Amen. I've consulted for companies that went all in on AWS Lambda + AWS SQS, only to transition them to an EC2 instance that performs the same computations at a fraction of the cost. No — you do not need K8 on day one.

But managed K8s is so easy to setup and makes life and the development cycle so much easier you're basically robbing yourself if you don't.

I assume you just dropped a shit ton of features on your move to that EC2 instance unless of course you wasted more time then it would take to get everything working better on Lambda/SQS.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#288

Post by fleddr »

I very strongly believe AWS needs dead simple dummy-proof budget controls. 15 years and it still does not have it.

And with simple I mean this: "when this service hits my daily/weekly/monthly budget cap of x$, STOP IT AUTOMATICALLY"

Individuals/freelancers, hobbyists, small startups need this. When I started in this industry and write an endless loop, I'd hang the server. Now you hang your future.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#289

Post by Komodai »

rob_c wrote: post #78

Self-host and stop using the cloud, especially when you clearly don't know what you're doing. > Now I am waiting on a response from AWS Support on these charges; maybe they can help me waive part of that. Honestly why should they? They're very clear about their billing policy and pricing, the only reason they might is good PR/karma from yc posting...

> the only reason they might is good PR/karma from yc posting

not really, they've been known to do it before, I personally got a much smaller charge (~$12) waived by just asking nicely.

Re: Tell HN: I DDoSed myself using CloudFront and Lambda Edge and got a $4.5k bill

#290

Post by zamalek »

TameAntelope wrote: post #206
Lorin wrote: post #59

Earlier quoted context omitted.

Interestingly, AWS won't refund service credits provided by an accelerator if you've accidentally blown through those instead.

How the fuck do you blow through $150k at an early stage startup???

I've had "it needs the RAM" while staring at a 15% memory usage plot on a very expensive CI VM. Choosing a 20x cheaper machine had no effect on build time and stability, but this was the PR comment. This overprovisioned machine was possibly $20k.

The truth is that developers sometimes require expensive things to get their job done efficiently. The other truth is that we often vastly overestimate the SKU. And we also leave things running.

Post reply on HN