Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

Post reply on HN
Print view View original

141–150 of 174 posts

Re: Serverless Horrors

#141

Post by seized »

Netcob wrote: post #92
voidwtf wrote: post #4

Earlier quoted context omitted.

That's my favorite thing about all these services. None of them have an equivalent of a stop-loss. They'll notify you IF you setup an alert, but that's it. Often times the alerts are way after the damage is done, with some billable metrics often lagging in reporting/alerting by hours. The default should be safe with easy options to increase the limits.

I remember trying AWS Glacier as a broke university student, thinking it was a cheap way to back up my data. I was wrong. A decade later I played around with AWS, set up a free 1-core VPS. It was fine for a year or so (I ended up not using it at all), and suddenly I got a bill. It wasn't much, but it reminded me how these services make it very hard to be aware of your bills until you get them. I was trying out Azure…

Glacier IS a cheap way to backup data, in fact the cheapest of you ignore the scam "$200 for life" type things. It's about $1 per TB per month.

It's not cheap to restore though, at about $90 minimum per TB.

So it's best as part of a 3-2-1 system, not for frequent restores.

Re: Serverless Horrors

#142

Post by jmathai »

sroussey wrote: post #138
jmathai wrote: post #130

Earlier quoted context omitted.

Lambda and GCP Cloud Functions do have cost controls. You can specify the maximum number of instances that can be spun up at any given point. I think the UX can make it more friendly to specify the types of traffic and cost you’re expecting but most erroneous spikes are the result of a customer misconfiguration or a legitimate spike in traffic. It’s the former which are problematic for customers. They can request a c…

Do users setup cost controls before activating the service? Or is this something they need to know how to do and do on their own?

Separate from billing, the product-native cost controls which prevent over-consumption is configured at the resource level.

gcloud run deploy ..... --max-instances=N

Re: Serverless Horrors

#143

Post by merelysounds »

webprofusion wrote: post #23
merelysounds wrote: post #19

A kill switch seems a practical and trivial solution. E.g. something toggled when a monthly bill exceeds a configurable amount. I’m guessing many hobby users would set that to $100, end of story. I don’t understand why it’s so unpopular to offer that. I’d imagine the providers would benefit too in the long run.

You can set a hard budget on most cloud providers, including Azure etc. I actually did this thinking I was just setting a budget alert and that was a new and interesting way to interrupt production.

> You can set a hard budget on most cloud providers

Note that the submission references serverless providers, specifically netlify and vercel. I don’t think these support an easy to configure kill switch - in any case it wasn’t easy to configure in the scenarios listed on the page.

Re: Serverless Horrors

#144

Post by kikimora »

gregoriol wrote: post #80
kikimora wrote: post #59

Earlier quoted context omitted.

AWS guarantees protection from all DDoS attacks done at level 3-4 (Google aws shield). If someone calls your api million times then there is throttling.

So instead of DDoSing someone, you could make some not-so-large amount of requests to their APIs and instead of taking down their servers, you'll just take them down by bankrupting them with a huge invoice?

With default settings an attacker can run up-to 10000 req/sec on your api gw which would result in a sizable bill if left unnoticed. So with AWS you have to configure throttling and AWS protects you from low level ddos. How do you save yourself from a huge traffic bill in a VPS?

AWS also has WAF to protect from DDoS , it is expensive but may save a day if you urgently need a protection.

Re: Serverless Horrors

#145

Post by kikimora »

tlb wrote: post #72
kikimora wrote: post #57

Earlier quoted context omitted.

Please explain how you rotate ssh keys, store audit logs, backup (and test backup procedures), configure secure network between vpses such that your neighbor cannot eavesdrop.

You don't need to do any of that for hosting a content website. The content & config are pushed by rsync/ssh from a git repo, so there's no need for backups. I can recreate a server in half an hour. I guess I lose the webserver logs, but I rarely look at them so I don't care. A single server has plenty of bandwidth for a personal site, so there's only one EC2 instance and no secure network is needed. If I need more b…

If it is just a content website then maybe yes. Cloud complexity probably won’t worth it.

Still I can think of a corporate blog, and you have employees come and go then it became a problem even for a small website. Otherwise an angry admin can deface your website and damage your reputation.

All other things like secure net won’t apply for a small website, of course.

Re: Serverless Horrors

#146

Post by s9df898r32h »

Filligree wrote: post #90
s9df898r32h wrote: post #84

Earlier quoted context omitted.

[dead]

I explicitly block everything in Russia (and China and Hong Kong) from accessing my servers, because otherwise the rate of SSH attacks is so high it actually prevents SSH from working reliably -- the connection pool fills up. Just an FYI; I don't think it's that unusual. Blocking those geoips dramatically reduced my logging volume.

I doubt that clients block outgoing connections to Russian IPs though... so that shouldn't affect me too much.

Re: Serverless Horrors

#147

Post by voidpointer »

ghaff wrote: post #108
moduspol wrote: post #105

Earlier quoted context omitted.

It's probably quite difficult to boil it down to something as simple as an "off" switch that'll limit costs for them, meaningfully work for all services, not be abused, not be confusing, and not result in the customers that actually make you money accidentally getting important things shut off unexpectedly under predictable circumstances. It's probably easier to make it so they can set up alerts and have a human on t…

From what I can tell Azure has more robust stop-loss options. But business considerations for the provider aside, there are absolutely tradeoffs between reliably limiting your spend and avoiding taking a business down because of a legitimate spike.

Absolutely but that tradeoff should be for the customer to make.

Re: Serverless Horrors

#148

Post by BizarroLand »

Minor criticism, I get that this is a page that collects links to other pages talking about the horrors of serverless. Sure. Makes perfect sense.

I would like to see some small amount of commentary on each page that covers what I am about to read. Not much, but half a paragraph of introduction would be nice.

Re: Serverless Horrors

#149

Post by s9df898r32h »

throwaway11460 wrote: post #68
ponector wrote: post #54

Earlier quoted context omitted.

Can you use free tier under a fake name? To drop ridiculous bills. How do they validate the customer?

There is no free plan, there is just free limit - you must add a card.

just use a virtual card and then change the spending limit to $0? or freeze it
Post reply on HN