11–20 of 503 posts
I thought this would be about the horrors of hosting/developing/debugging on “Serverless” but it’s about pricing over-runs. I scrolled aimlessly through the site ignoring most posts (bandwidth usage bills aren’t super interesting) but I did see this one: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-c... About how you make unauth’d API calls to an s3 bucket you don’t own to run up the costs. That was a n…
> I had cloudflare in front of my stuff. Hacker found an uncached object and hit it 100M+ times. I stopped that and then they found my origin bucket and hit that directly. Pardon my ignorance, but isn’t that something that can happen to anyone? Uncached objects are not something as serious as leaving port 22 open with a weak password (or is it?). Also, aren’t S3 resources (like images) public so that anyone can hit t…
After a quick check on Vercel stories, it seems all payments were discarded or mistakes in the first place. Does it really happen to really have to pay such a bill? Do you need to tweet about it to be reimbursed?
> I had cloudflare in front of my stuff. Hacker found an uncached object and hit it 100M+ times. I stopped that and then they found my origin bucket and hit that directly. Pardon my ignorance, but isn’t that something that can happen to anyone? Uncached objects are not something as serious as leaving port 22 open with a weak password (or is it?). Also, aren’t S3 resources (like images) public so that anyone can hit t…
I thought this would be about the horrors of hosting/developing/debugging on “Serverless” but it’s about pricing over-runs. I scrolled aimlessly through the site ignoring most posts (bandwidth usage bills aren’t super interesting) but I did see this one: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-c... About how you make unauth’d API calls to an s3 bucket you don’t own to run up the costs. That was a n…
Agreed about that. I was hired onto a team that inherited a large AWS Lambda backend and the opacity of the underlying platform (which is the value proposition of serverless!) has made it very painful when the going gets tough and you find bugs in your system down close to that layer (in our case, intermittent socket hangups trying to connect to the secrets extension). And since your local testing rig looks almost nothing like the deployed environment...
I have some toy stuff at home running on Google Cloud Functions and it works fine (and scale-to-zero is pretty handy for hiding in the free tier). But I struggle to imagine a scenario in a professional setting where I wouldn't prefer to just put an HTTP server/queue consumer in a container on ECS.
After a quick check on Vercel stories, it seems all payments were discarded or mistakes in the first place. Does it really happen to really have to pay such a bill? Do you need to tweet about it to be reimbursed?
No, at least in enterprise consulting for these kind of hosting, usually there is a contact person on the support team that one can reach directly. However these projects are measured in ways that make Oracle licenses rounding errors. Which naturally creates market segmentation on who gets tier 1 treatment and everyone else.
After a quick check on Vercel stories, it seems all payments were discarded or mistakes in the first place. Does it really happen to really have to pay such a bill? Do you need to tweet about it to be reimbursed?
> I had cloudflare in front of my stuff. Hacker found an uncached object and hit it 100M+ times. I stopped that and then they found my origin bucket and hit that directly. Pardon my ignorance, but isn’t that something that can happen to anyone? Uncached objects are not something as serious as leaving port 22 open with a weak password (or is it?). Also, aren’t S3 resources (like images) public so that anyone can hit t…
It's not that hard to configure access controls, they're probably cutting corners on other areas as well. I wouldn't trust anything this person is responsible for.