Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

behind-the-enemy-lines.com

Post reply on HN
Print view View original

41–50 of 152 posts

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#41

Post by jonknee »

gojomo wrote: post #8

But, why re-downloading every hour? Does merely having the spreadsheet passively open in a browser trigger that, or was some other process re-loading the spreadsheet every hour? (If the former, I wouldn't be as forgiving of Google. I understand the desire not to cache possibly-private data, but proper URL design and conditional GETs should be able to prevent the entire download on an automatic hourly schedule. And ev…

About an hour is the standard time for external data in Google Spreadsheet to be refreshed. I've come across this with JSON data.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#42

Post by dasil003 »

SagelyGuru wrote: post #11

Scary indeed. Many thanks for the warning. I was contemplating starting to use Amazon Cloud and some Google tools but definitely will not touch any of it now. Who knows how many other traps like this are laying in wait for the unweary? All this automation is very well but this illustrates the dangers of running stuff on other's machines of unknown complexity and out of your own control, while having to pay for whatev…

I don't think the OA would want you to take this as FUD. These are incredibly powerful tools that give you more control than the alternatives (AWS anyway), and yes unintended consequences are possible, but this really is a freak occurrence.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#43

Post by jonknee »

tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

Or perhaps an email saying "We're past the limit you set, approve the overage in the next X hours by clicking this link". That way you don't cut off accidentally during a spike you want, but know about it.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#45

Post by rramsden »

tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

quite sad that Amazon still hasn't implemented bill capping yet. A lot of users want this... its been on their TODO list since 2006 https://forums.aws.amazon.com/thread.jspa?threadID=58127&#38...

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#46

Post by jmj42 »

EvilTerran wrote: post #37
sohn wrote: post #34

Earlier quoted context omitted.

They wouldn't be jerks if they asked for the charges; you still generated the traffic and they had to pay for it.

Just as "legal" does not mean "ethical", "contractually permitted" does not mean "not a jerk move".

just like asking you to pay for the services you used is not a jerk move.

Amazon did a nice thing, but the services were used. Asking to user to pay for those services (even if it was a mistake), would not have been a "jerk move"

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#47

Post by jonknee »

Yarnage wrote: post #5

I'm pretty surprised Google didn't have the client download the images instead. Wouldn't that be a better solution or am I missing something here? Pretty interesting though and if this becomes a big enough story you can bet Google will be changing something; the last thing they need is someone using Google Docs to DOS websites.

The function lets you specify height/width, passing it through makes some sense. It's also usually (though not in this case) to not hot link--a document can be viewed by thousands of people. There are some privacy issues too, viewing a Google Doc could have your browser making requests to unknown servers that could return whatever they want.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#48

Post by raverbashing »

tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

A cutoff is good, but a triggered alarm would go a long way.

For example in Linode you can configure trigger conditions for CPU (triggers in x% cpu for y time) and Network usage (there are other conditions as well)

Very useful for flagging suspicious activity (or just plain accidents)

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#49

Post by gojomo »

jonknee wrote: post #41
gojomo wrote: post #8

But, why re-downloading every hour? Does merely having the spreadsheet passively open in a browser trigger that, or was some other process re-loading the spreadsheet every hour? (If the former, I wouldn't be as forgiving of Google. I understand the desire not to cache possibly-private data, but proper URL design and conditional GETs should be able to prevent the entire download on an automatic hourly schedule. And ev…

About an hour is the standard time for external data in Google Spreadsheet to be refreshed. I've come across this with JSON data.

Even if noone has it open in a browser? Or they do have it open, but haven't interacted with it?

In either case, this seems odd, unless the URL is especially noted as 'volatile', and/or there are other parts of the spreadsheet that might trigger conditional calculations/notifications based on that URL's contents. (And don't S3 resources have last-modified-dates or etags for conditional GETs?)

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#50

Post by pavel_lishin »

tybris wrote: post #27
tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

End of the article: "PS: Amazon was nice enough to refund the bandwidth charges, as they considered this activity accidental and not intentional. Thanks TK!"

Would they have refunded him if someone did this to him maliciously, as he points out is possible at the end of his post?
Post reply on HN