Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

Post reply on HN
Print view View original

131–140 of 174 posts

Re: Serverless Horrors

#131

Post by ChrisMarshallNY »

arandomusername wrote: post #127
ChrisMarshallNY wrote: post #114

Earlier quoted context omitted.

> Any software engineer should be ... It really is simple. I get that, a lot. It's the "No True Scotsman" of tech. This is also used as a way of validating college-style leetcode. Let me introduce you to my GH Activity Graph[0]. See all that green? That's pretty much all coding in Swift; mostly in shipping apps and whatnot. There's a bit of PHP, for server-side stuff, but I like to spend a lot of time, coding fronten…

Every minute you spend on here, is a minute you don't spend on executable code as well, yet you're on here. Perhaps because spending every productive minute on coding is practically impossible. You don't have to be a linux admin to be able to setup a properly secure server, nowadays it's quite trivial. I bet you, that if you tried, you would be able to do so in less than an hour (at a relaxed pace). We get lied to ab…

Well, we choose where to spend what free time we have. I like hanging here. There's really no pressure to perform. I'm too old to play insecurity-sop games.

I tend to like shipping stuff, which means taking Responsibility for its operation, maintenance and security.

That often means a lot of "not fun." My servers are working servers. They have data and capabilities that are important to a lot of "not-Chris" people. It's my job to make sure that they get what they are [not] paying for (I write free stuff). That can be a bit stressful, at times; especially when some bad actor is making life miserable for me. I'd much rather that be someone else's problem, where I can write an email that says "Make it so, Numbah One!", instead of spending two days, wrestling with config files, and CLIs.

Re: Serverless Horrors

#132

Post by [deleted] »

kikimora wrote: post #57
ies7 wrote: post #46

Earlier quoted context omitted.

I remember a comment from this site. Something like: we must study how Amazon and other big cloud's marketing work so great to make this generation developers think that vps or selfhosting are hard. IMO vps was easy before and even easier now to manage.

Please explain how you rotate ssh keys, store audit logs, backup (and test backup procedures), configure secure network between vpses such that your neighbor cannot eavesdrop.

[deleted]

Re: Serverless Horrors

#134

Post by fullspectrumdev »

roygbiv2 wrote: post #73
ponector wrote: post #70

Earlier quoted context omitted.

And what if you add a debit card without money? Or add a disposable card and then the next day you deactivate it? Nowadays everyone push you to add a card to open free* account. Such disposable cards is a solution to this issue.

Your debt will be sold to a collection company.

In many countries this is meaningless.

I just ignore any horseshit that goes to collections outright

Re: Serverless Horrors

#135

Post by currency »

krisoft wrote: post #125
ChrisMarshallNY wrote: post #85

Earlier quoted context omitted.

I'm not talking about static content. I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance. It's easy, sure. It's easy to create an insecure server, that can be pwned. I know of which I speak. I have done just that. "A man who holds a cat by the tail, learns a lesson he can learn…

> A man who holds a cat by the tail, learns a lesson he can learn in no other way. What a silly quote. “No other way” except all the other ones. Everyone watching the man and the cat will learn the same lesson. Everyone who hears the story will learn the same lesson. I never held a cat by the tail, nor have i ever seen anyone foolish enough to attempt it, yet I am certain I know what happens next.

I think part of the point of the quote is that a man who would try to hold a cat by the tail is an example of someone who can ignore the experiences of other people.

People FAFO when they should know better all the time.

Re: Serverless Horrors

#136

Post by bingo-bongo »

arandomusername wrote: post #89
ChrisMarshallNY wrote: post #85

Earlier quoted context omitted.

I'm not talking about static content. I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance. It's easy, sure. It's easy to create an insecure server, that can be pwned. I know of which I speak. I have done just that. "A man who holds a cat by the tail, learns a lesson he can learn…

It's easy to create a secure server. Use private keys. Use a firewall (ufw is really simple) and only expose your reverse proxy (e.g nginx or haproxy). Use docker to run your crap. Any software engineer should be well capable of setting up a secure server. It really is simple.

Right up until someone runs a container with 8080:8080, which unfortunately bypasses ufw and the container is suddenly exposed to the entire internet .. :|

Re: Serverless Horrors

#137

Post by bauruine »

Xophmeister wrote: post #56

Presumably the costs for a platform are passed on to the platform's customers from that platform's cloud provider (with profit). When a spike happens due to, say, a DDOS, does the platform first have to negotiate with the cloud provider to waive the cost? Presumably the costs for a cloud provider are passed on to the cloud provider's customers from that cloud provider's operating costs (with profit). When a spike hap…

It's all just lost profit. It doesn't cost AWS more than it does you copying 190TB to your NAS over LAN.

Re: Serverless Horrors

#138

Post by sroussey »

jmathai wrote: post #130
voidwtf wrote: post #4

Earlier quoted context omitted.

That's my favorite thing about all these services. None of them have an equivalent of a stop-loss. They'll notify you IF you setup an alert, but that's it. Often times the alerts are way after the damage is done, with some billable metrics often lagging in reporting/alerting by hours. The default should be safe with easy options to increase the limits.

Lambda and GCP Cloud Functions do have cost controls. You can specify the maximum number of instances that can be spun up at any given point. I think the UX can make it more friendly to specify the types of traffic and cost you’re expecting but most erroneous spikes are the result of a customer misconfiguration or a legitimate spike in traffic. It’s the former which are problematic for customers. They can request a c…

Do users setup cost controls before activating the service? Or is this something they need to know how to do and do on their own?

Re: Serverless Horrors

#139

Post by sroussey »

ponector wrote: post #115
roygbiv2 wrote: post #73

Earlier quoted context omitted.

Your debt will be sold to a collection company.

Can they find and owner of the inactive card? If I put a fake name to their system

Your debit card bank has your real name and you agreed to share it to get the card in the first place.

Re: Serverless Horrors

#140

Post by merelysounds »

catlifeonmars wrote: post #43
andrasbacsai wrote: post #22

Earlier quoted context omitted.

It would be practical for the user, but not for the company. Why does this not exist after years (more than a decade since EC2) of cloud computing? Because it is not good for the VC investors.

AWS Lambda has had this knob for quite a few years, it’s called “provisioned capacity”, and it defines an upper bound to function concurrency.

While helpful, this is not the same. E.g. a global kill switch could be harder to overlook and easier to manage.
Post reply on HN