Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

Post reply on HN
Print view View original

161–170 of 174 posts

Re: Serverless Horrors

#161

Post by bcaxis »

kikimora wrote: post #57
ies7 wrote: post #46

Earlier quoted context omitted.

I remember a comment from this site. Something like: we must study how Amazon and other big cloud's marketing work so great to make this generation developers think that vps or selfhosting are hard. IMO vps was easy before and even easier now to manage.

Please explain how you rotate ssh keys, store audit logs, backup (and test backup procedures), configure secure network between vpses such that your neighbor cannot eavesdrop.

  * You don't have to rotate what doesn't get out.  Limit ingress to relevant IPs reduces this surface area a lot.
  * SCP to a system built for storage.  Not really essential for many systems - system logs are fine.
  * Every VPS provider comes with a backup check box.
  * Tailscale is really simple.

Re: Serverless Horrors

#162

Post by zrn900 »

tutfbhuf wrote: post #25
adrianN wrote: post #20

Earlier quoted context omitted.

If your stuff scales to infinity your money burn rate also scales to infinity. A single server in a colo can only do so much damage to your wallet before it’s saturated.

Sure, but according to the article, he received the 100k bill because of peak traffic of 60TB of bandwidth per day over several days. If you have a dedicated server in a colo, then a 10GbE connection is very common these days. With a 10GbE connection, you can serve 100TB of traffic in a single day. Hence, if the colo had the same prices as Netlify for traffic, then a single server with a 10GbE connection would be suf…

Nah.You get a dedicated box at hetzner and get unmetered 1gbit and use as much as you want as long as you dont do mining or piracy etc.

Re: Serverless Horrors

#163

Post by fragmede »

voidwtf wrote: post #160
fragmede wrote: post #159

Earlier quoted context omitted.

What you really want is prepaid instead of post-paid billing. Charge up the account with $100, and stop working and delete my data if that gets hit, with an auto renew option to recharge some amount every month.

That seems a little reductive. I don’t think it’s unreasonable to say, my current spend is ~13k a month. I should be able to set a 20k cap, such that non fixed billable like bandwidth or map tiles get paused while someone determines whether we’d like to proceed at that rate. There is a not so fine line between scaling for a rush/event and a resume generating event.

Okay, fine, that's what I want. :)

Re: Serverless Horrors

#164

Post by fragmede »

remram wrote: post #155
fragmede wrote: post #87

Earlier quoted context omitted.

You can totally build a GCP function that will tear down your site if a billing alert hits the pubsub bus, but you can also set billing caps for a bunch of the APIs.

What you're saying is that I can build a cost control function , not that GCP has one.

Yes. GP's claim is there is no stop procedure. just because it's not a simple toggle switch doesn't mean it's not there.

Re: Serverless Horrors

#165

Post by rldjbpin »

in terms of web hosting, why does hosting using serverless / paas means not using a cdn?

it also baffles me that these services cannot tell between legitimate traffic and ddos.

Re: Serverless Horrors

#166

Post by s9df898r32h »

remram wrote: post #156
s9df898r32h wrote: post #151

Earlier quoted context omitted.

at least you wont get charged without your knowledge... which in the end, is the first step in getting this non-sense fixed, for a person... of course the government should fix it for everyone. This shit should probably be considered fraud anyways... companies get free passes all the time. My name (s9df898r32h) is my company, I should be able to steal whatever I want /s Why are such large companies so incompetent tho…

You will have to pay it AND a fee for fraud, and possibly their legal fees for tracking you down. You also will have a difficult time arguing that you were in good faith with this kind of shenanigans. Bouncing checks are not a life hack to get stuff for free, they're a crime.

I thought they were the ones committing fraud ... either way you have to be crazy to subscribe to those services

Re: Serverless Horrors

#167

Post by kikimora »

bcaxis wrote: post #161
kikimora wrote: post #57

Earlier quoted context omitted.

Please explain how you rotate ssh keys, store audit logs, backup (and test backup procedures), configure secure network between vpses such that your neighbor cannot eavesdrop.

* You don't have to rotate what doesn't get out. Limit ingress to relevant IPs reduces this surface area a lot. * SCP to a system built for storage. Not really essential for many systems - system logs are fine. * Every VPS provider comes with a backup check box. * Tailscale is really simple.

This is how you protect one small server, you don't need cloud for this. But if you do use it for a small server you'll overpay a lot in relative terms and small amount in absolute terms.

Re: Serverless Horrors

#168

Post by bArray »

ChrisMarshallNY wrote: post #85
bArray wrote: post #83

Earlier quoted context omitted.

I can't speak for you, but it's really not too difficult to host some static content on a VPS. At the very worst, the VPS is compromised somehow, and you refresh it from the admin panel.

I'm not talking about static content. I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance. It's easy, sure. It's easy to create an insecure server, that can be pwned. I know of which I speak. I have done just that. "A man who holds a cat by the tail, learns a lesson he can learn…

> I'm not talking about static content.

I think the person in the original article was, at least for the sound file.

> I need the whole enchilada: DB, Web Server, Dynamic Languages, etc. Also, for a shipping, production application, with hundreds of users; where privacy and security are of paramount importance.

It seems quite simple to me, you either learn security, or pay for the expertise of someone that has. You need to decide whether it's worth your time.

I would suggest one thing, though - even with the likes of , they will only provide security in limited cases, i.e. DDoS. Nobody at is going to make sure your application logic works correctly - they clearly won't even make sure you use their resources within sensible bounds.

Re: Serverless Horrors

#169

Post by bArray »

Vuizur wrote: post #152
bingo-bongo wrote: post #136

Earlier quoted context omitted.

Right up until someone runs a container with 8080:8080, which unfortunately bypasses ufw and the container is suddenly exposed to the entire internet .. :|

Reading the GitHub issue about this is somewhat entertaining: https://github.com/docker/for-linux/issues/690 People are getting hacked a lot because of this, and docker doesn't seem to care all that much.

Oh man, that really sucks, to the point I would consider against using Docker for anything deployed. 5 years and such a basic security issue goes unfixed.

Re: Serverless Horrors

#170

Post by throwaway11460 »

srigi wrote: post #153
roygbiv2 wrote: post #73

Earlier quoted context omitted.

Your debt will be sold to a collection company.

What a great achievement of our society. Inventing a financial instrument to buy and sell debts.

It really is. It decreases the risk and necessary KYC checks so a lot more people can get serviced that would be shown the door in a world where you can't sell a debt.
Post reply on HN