Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I attacked myself using Google and I ramped up a $1000 bandwidth bill

behind-the-enemy-lines.com

Post reply on HN
Print view View original

81–90 of 152 posts

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#81

Post by icebraining »

lubujackson wrote: post #76
icebraining wrote: post #64

Earlier quoted context omitted.

I disagree. Feedfetcher is no different than a browser: it fetches the URL the user inserted, nothing more (unlike a spider, which discovers URLs by itself).

Not true. It fetches the URL every single hour, not just when the user requests it. So Google is claiming they can ignore robots.txt because it was an action performed by a user (true) but they're unleashing a huge problem with this background refreshing. Google is wasting gobs of their own money, too. What if I made a bot that generated 1000s of Google accounts with 1000s of spreadsheets hotlinking 1000s of big file…

Background refreshing is a common feature in client applications, like RSS readers. I think their reasoning makes sense.

I do think they should change their process (making it lazy-load instead), but that's a different issue to robots.txt.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#82

Post by icebraining »

Karunamon wrote: post #80
icebraining wrote: post #71

Earlier quoted context omitted.

Are you taking in account the time spent by the tech person(s) to read his email and process the rebates? People time is expensive, particularly if some manager needs to approve it. Maybe it wouldn't be $1000, but it'd still be significantly more than $0.

We're not counting rebates yet - we're saying "This guy ran X amount of bandwidth through our system which we normally charge Y for" - how much did Amazon pay their upstream for that bandwidth and the billing (which is all completely automated)

That's my point: if you want them to charge less, the billing for this case is not automated (and is thus much more expensive).

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#83

Post by robryan »

vladd wrote: post #79

I cannot help notice that Hetzner offers 5000 GB/month AND a full dedicated server, for 39 EUR (51 USD) [1], so his traffic would have cost him at that rate a total of 100 USD if he were to use a dedicated server instead of Amazon. (before mentioning Amazon's scalability, consider that Hacker News is ran on a single dedicated server, and the moral of the story seems to be how not to scale especially when you don't wa…

Of course if you want to do away with any kind of built in redundancy and take over the sysadmin duties involved you can get the raw space and transfer cheaper.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#84

Post by Karunamon »

icebraining wrote: post #82
Karunamon wrote: post #80

Earlier quoted context omitted.

We're not counting rebates yet - we're saying "This guy ran X amount of bandwidth through our system which we normally charge Y for" - how much did Amazon pay their upstream for that bandwidth and the billing (which is all completely automated)

That's my point: if you want them to charge less, the billing for this case is not automated (and is thus much more expensive).

I'd be flabbergasted to find out their billing system isn't at least as simple as their AWS console. 5 minutes of CSR work tops.

Would probably even be easier to completely drop a bill as opposed to modifying it to charge a lesser amount.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#85

Post by devs1010 »

"What I find fascinating in this setting is that Google becomes such a powerful weapon due to a series of perfectly legitimate design decisions."

I call in to question that these are "perfectly legitimate design decisions", basically, if google thinks that the data is private or too sensitive to cache, then it shouldn't be this easy to have it automatically keep hitting a site like this. Google should have realized the potential for abuse here. I'm guessing it truly is an oversight on their part as I can't imagine they would want to waste all this bandwidth either, however its something they should figure out a solution for.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#86

Post by dredmorbius »

nknight wrote: post #63
dredmorbius wrote: post #55

Earlier quoted context omitted.

It's not that simple. First, the problem isn't inherent to virtual hosting services, you could just as easily get hit by this on a bare-metal site, though the interplay of S3 and Google Docs is an added dimension. Cutting off all services opens the door for a class of DoS attacks. Simply direct enough traffic at a single account's assets, and you'll knock them offline for a given billing cycle. If the attack is cheap…

> you'll knock them offline for a given billing cycle Er... Because caps can never be raised mid-cycle?

Sure, they could be, but it's still a pretty blunt alerting system.

Depending on the organization, though, you'd have to get purchase approval on the overage, etc. That will depend on specifics. Makes for sticky questions to answer there as well, which is another argument for putting better management tools at the cloud level.

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#87

Post by [deleted] »

vladd wrote: post #79

I cannot help notice that Hetzner offers 5000 GB/month AND a full dedicated server, for 39 EUR (51 USD) [1], so his traffic would have cost him at that rate a total of 100 USD if he were to use a dedicated server instead of Amazon. (before mentioning Amazon's scalability, consider that Hacker News is ran on a single dedicated server, and the moral of the story seems to be how not to scale especially when you don't wa…

[deleted]

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#88

Post by rapind »

OzzyB wrote: post #52

+1 For Amazon for kindly reimbursing the overage charge. -1 For Google for creating what is the biggest threat to content providers by enabling easy-to-use DDOS attacks across the entire interwebs. Seriously, is this what we have to look forward to when Google Spreadsheets, and God knows what else, become ever-more popular? Think about all the additional onerus costs that would be incurred by content providers as mor…

Come on, really? This is clearly an edge case they simply didn't see and will probably solve once the right people know about it. The sky may be falling, but it's not because of Google Spreadsheets...

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#89

Post by jeffbarr »

tocomment wrote: post #17

This really underscores Amazon's glaring omission of a billing cutoff on Amazon web services. How hard would it be for them to let me say, cut off my services at $100/month? This is the main reason I'd never use AWS to host anything public.

We are already testing a billing charges monitor that works through CloudWatch. Here's some more info:

http://blog.bitnami.org/2011/12/monitor-your-estimated-aws-c...

Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill

#90

Post by krelian »

robryan wrote: post #83
vladd wrote: post #79

I cannot help notice that Hetzner offers 5000 GB/month AND a full dedicated server, for 39 EUR (51 USD) [1], so his traffic would have cost him at that rate a total of 100 USD if he were to use a dedicated server instead of Amazon. (before mentioning Amazon's scalability, consider that Hacker News is ran on a single dedicated server, and the moral of the story seems to be how not to scale especially when you don't wa…

Of course if you want to do away with any kind of built in redundancy and take over the sysadmin duties involved you can get the raw space and transfer cheaper.

I have a VPS on buyvm which includes 2TB/month for $6. Each extra TB is another $2.50. This is not a special case, you can other providers with very good pricing for data transfer. I don't understand how the difference in bandwidth pricing can be so large. I'm also certain that Amazon doesn't pay as much for bandwidth as the guy from buyvm.
Post reply on HN