I recently signed up for an OpenAI API key, and by default they enforce a quota after which they disable the key, and when you’re ready to serve more requests you increase the quota manually. I’m surprised to learn more companies don’t do this by default to save everyone from these kind of surprise bills. Although now that I think about it, I suspect there are lots of cases where the users just end up paying these.
Serverless Horrors
121–130 of 174 posts
Re: Serverless Horrors
#122Earlier quoted context omitted.
I can't speak for you, but it's really not too difficult to host some static content on a VPS. At the very worst, the VPS is compromised somehow, and you refresh it from the admin panel.
I'm not talking about static content. I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance. It's easy, sure. It's easy to create an insecure server, that can be pwned. I know of which I speak. I have done just that. "A man who holds a cat by the tail, learns a lesson he can learn…
sure it still needs work but much much less everyday
Re: Serverless Horrors
#123Earlier quoted context omitted.
a basic bitch static website takes three commands in the terminal and a very basic nginx config file to setup on a completely fresh ubuntu VPS. you could read a guide from 2012 and it would work perfectly fine. is this harder than dealing with cloud 'platforms' and their ever-changing UIs, APIs, SDKs?
Yes, this is harder. I don’t want to mess with maintaining or configuring nginx.
Re: Serverless Horrors
#124The underlying problem I found working with teams is that they all too frequently wanted to use these cloud-native technologies (serverless, etc.) which means thinking in microservices by definition, but usually architected for monoliths. This was accomplished in a few ways: 1) the serverless job did everything for you so in effect it was a monolith 2) they didn't want to use any intermediary storage/cache layer and relied heavily on both sides being up and available (synchronous brittle systems) 3) they went TOO hard in the microservices direction and made things way too complicated 4) their testing suites were half-baked (more the industry/tools fault than the users tbh) and weren't sufficiently air-gapped or mostly incomplete.
If you've been around for more than a decade - we have seen this before: AWS specifically sold the concept of "lift-and-shift" to C-suites a dozen years ago and now that MO is so baked in it's going to take a new generation of services with the right selling points to undo it. Lift-and-shift doesn't work because, as stated above, monoliths aren't for the cloud for a sufficiently sophisticated system. It's the reason DHH and others are advocating for "cloud repatriation". And then there are the small cases, comparatively speaking, like the ones listed on this site. These examples are what happens when you give very powerful tooling to people who do not understand it or the implications of it. But too, this is also partly (maybe even mostly) the vendors' fault: "From localhost to https, in seconds. Deploy from Git or your CLI." is the perfect selling point for a DIY-er or someone running a small business. But what comes along with that low barrier to entry is a downside that could be very expensive when the s**t hits the fan.
Re: Serverless Horrors
#125Earlier quoted context omitted.
I can't speak for you, but it's really not too difficult to host some static content on a VPS. At the very worst, the VPS is compromised somehow, and you refresh it from the admin panel.
I'm not talking about static content. I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance. It's easy, sure. It's easy to create an insecure server, that can be pwned. I know of which I speak. I have done just that. "A man who holds a cat by the tail, learns a lesson he can learn…
What a silly quote. “No other way” except all the other ones. Everyone watching the man and the cat will learn the same lesson. Everyone who hears the story will learn the same lesson.
I never held a cat by the tail, nor have i ever seen anyone foolish enough to attempt it, yet I am certain I know what happens next.
Re: Serverless Horrors
#126Earlier quoted context omitted.
It's easy to create a secure server. Use private keys. Use a firewall (ufw is really simple) and only expose your reverse proxy (e.g nginx or haproxy). Use docker to run your crap. Any software engineer should be well capable of setting up a secure server. It really is simple.
None of that stuff is “simple”. Git pushing and having Render.com auto deploy is, however.
Re: Serverless Horrors
#127Earlier quoted context omitted.
It's easy to create a secure server. Use private keys. Use a firewall (ufw is really simple) and only expose your reverse proxy (e.g nginx or haproxy). Use docker to run your crap. Any software engineer should be well capable of setting up a secure server. It really is simple.
> Any software engineer should be ... It really is simple. I get that, a lot. It's the "No True Scotsman" of tech. This is also used as a way of validating college-style leetcode. Let me introduce you to my GH Activity Graph[0]. See all that green? That's pretty much all coding in Swift; mostly in shipping apps and whatnot. There's a bit of PHP, for server-side stuff, but I like to spend a lot of time, coding fronten…
You don't have to be a linux admin to be able to setup a properly secure server, nowadays it's quite trivial. I bet you, that if you tried, you would be able to do so in less than an hour (at a relaxed pace).
We get lied to about the complexity of hosting by the cloud. I was able to host forums and game servers on VPSes when i was a young teenager, and I'm not technically gifted, it just wasn't complicated at all.
Re: Serverless Horrors
#128Earlier quoted context omitted.
Using private keys is not simple? sudo apt-get install ufw and ufw allow https is not simple? The whole process takes maybe 30-60 minutes to setup for someone completely new and following guides. Render's is simple, true, you just pay $300 for 1TB of bandwidth. It's crazy how much Merchants of Complexity fooled devs into thinking that running your own server is complicated and you need to pay 1000x to save few minute…
Merchants of Complexity didn't fool me, trying to run my own severs convinced me.
Re: Serverless Horrors
#129How is no spending limit a serverless problem? It's a cloud problem. Edit: Well, if you have small cloud servers they might go down under an attack. And if you pay only outgoing like in AWS that's good for you.
> It's a cloud problem.
It's a serverless problem because it can be mitigated if using the cloud, but not mitigated if it is serverless.
I have a cloud instance. I don't have this problem and never will. If I had serverless instead, I will have this problem.
Re: Serverless Horrors
#130Also see the Netlify comment thread linked from one of the Reddit posts ( https://answers.netlify.com/t/limit-bandwidth-to-avoid-high-... ), where one of their representatives specifically says that if you suffer a DDOS they will do nothing to stop you from getting a bajillion-dollar bandwidth bill, even if you're on the "free" tier.
That's my favorite thing about all these services. None of them have an equivalent of a stop-loss. They'll notify you IF you setup an alert, but that's it. Often times the alerts are way after the damage is done, with some billable metrics often lagging in reporting/alerting by hours. The default should be safe with easy options to increase the limits.
I think the UX can make it more friendly to specify the types of traffic and cost you’re expecting but most erroneous spikes are the result of a customer misconfiguration or a legitimate spike in traffic.
It’s the former which are problematic for customers. They can request a credit and we (GCP) try and accommodate.
It’s not a feature designed for profit. But it also tends to fall below the cut line for prioritization to fix. But it’s in the backlog and doesn’t go unnoticed.
(Former PM on GCP Cloud Functions)