Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

321–330 of 503 posts

Re: Serverless Horrors

#321
post #258

Earlier quoted context omitted.

Surely that's the fault of the purchaser setting the cap too low. Maybe rather than completely stopping the service, it'd be better to rate limit the service when approaching/reaching the cap.

Using that logic, isn’t it the fault of the user to set up an app without rate limiting?

It's misleading to promote a free tier that can then incur huge charges without being able to specify a charge cap.

Re: Serverless Horrors

#322
post #308

When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No problem that makes sense - it's an easy way to prove authentication as a bot can't spam a credit card (or else it would be financial fraud and most likely a felony). Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. I had the…

> required a credit card to prove your identity Given the relative accessibility of stolen credit card info, isn't the CC-as-ID requirement easy for a criminal to bypass?

It's easy yes, but better than nothing. The verification requirements are a balance between desired conversion rate, probability of loss (how many bad guys want to exploit your system without paying) and the actual costs of said loss (in this case it's all bullshit "bandwidth" charges, so no actual loss to AWS).

Re: Serverless Horrors

#323

Earlier quoted context omitted.

These "refund after overcharge" things are not without benefit to the corporations. They get a nice tax write-off. It's couch-cushion change for them, but it adds up. They have whole armies of beancounters, dreaming this stuff up. It's also the game behind those "coupons" you get, for outrageously-priced meds that aren't covered by insurance. If they charge $1,000 for the medication, but give you a "special discount"…

Smells like fraud.

A lot of things are "fraud" when an individual or small business does it but perfectly normal and considered merely good business acumen when done by a big corporation. Even more so now that the US government is openly for sale (it was always for sale, but before at least they had the decency to pretend it wasn't).

Re: Serverless Horrors

#324

Earlier quoted context omitted.

As the saying goes, when you owe the bank $100 you've got a problem, when you owe the bank $100k the bank has a problem... On serverless, I can enter numbers in a calculator and guess that running my little toy demo app on AWS will cost between $1 and $100. Getting hit with a huge $1000 bill and a refusal to refund the charges (and revocation of my Prime account and a lifetime ban from AWS and cancellation of any oth…

You haven’t been able to use your Amazon retail account to open an AWS account for years. You don’t “beg”. You just send them an email and they say “yes”.

They are economic realists about this. They say "yes" if they can't realistically get $100k from you for your error.

Re: Serverless Horrors

#325
post #225
post #198

Earlier quoted context omitted.

Maybe, but its a huge reason to use real servers instead of serverless.

I mean real servers get hit with things like bandwidth fees so it's not a 100% solution.

Depends where you order your server. If you order from the same scammers that sell you "serverless" then sure. If you order from a more legitimate operator (such as literally any hosting company out there) you get unmetered bandwidth with at worst a nasty email and a request to lower your usage after hitting hundreds of TBs transferred.

Re: Serverless Horrors

#326

I read a lot of the posts at the little blog here and, uh, every single one sounds like a complete amateur making a cloud configuration mistake. I haven't found one that is the provider's fault or the fault of "serverless" I would be embarrassed to put my name on these posts admitting I can't handle my configs while blaming everyone but myself. Serverless isn't a horror, serverlesshorrors poster. You are the horror.…

Consider this analogy: Instead of using a root command shell, it is wise to use an account with appropriately restricted capabilities, to limit the downsides of mistakes. Cloud services support the notion of access control, but not the notion of network resource usage limits. It's an architectural flaw.

Or do you always log in as root, like a real man, relying purely on your experience and competence to avoid fat-finger mistakes?

Re: Serverless Horrors

#327

Earlier quoted context omitted.

Is that what people do is test/develop primarily with local mocks of the services? I assumed it was more like you deploy mini copies of the app to individual instances namespaced to developer or feature branch, so everyone is working on something that actually fairly closely approximates prod just without the loading characteristics and btw you have to be online so no working on an airplane.

Mocks usually don’t line up with how things run in prod. Most teams just make small branch or dev environments, or test in staging. Once you hit odd bugs, serverless stops feeling simple and just turns into a headache.

Yeah, I’ve never worked at one of those shops but it’s always sounded like a nightmare. I get very anxious when I don’t have a local representative environment where I can get detailed logs, attach a debugger, run strace, whatever.

Re: Serverless Horrors

#328
post #297

When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No problem that makes sense - it's an easy way to prove authentication as a bot can't spam a credit card (or else it would be financial fraud and most likely a felony). Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. I had the…

> Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. That would make you one of the most successful websites on the internet, or the target of a DDoS -- which was it? I assume you're not saying that "bots" would randomly hit a single, brand-new "hello world" site enough to generate that kind of bill.

Many of the people who have this problem on toy websites end up offering what amounts to free storage or something similar. They are then surprised when "bots" come to "DDoS" them. These bills are as much a product economics problem as a technical one.

Re: Serverless Horrors

#329

Earlier quoted context omitted.

Yes. They said it was free then they surprise charge you $100k. That’s an insane amount of both money and stress. You’re at Amazon’s mercy if they will or will not refund it. And while this is in process you’re wondering if your entire financial future is ruined.

I have never in 8 years of being in the AWS ecosystem and reading forums and Reddits on the internet had anyone report that AWS wouldn’t refund their money. If you go over your budget with AWS, what should AWS do automatically? Delete your objects from S3? Terminate your databases and EC2 instances? Besides, billing data collection doesn’t happen anywhere near realtime, consider it a fire hose of streaming data that…

> If you go over your budget with AWS, what should AWS do automatically? Delete your objects from S3? Terminate your databases and EC2 instances?

Why not simply take the service offline once it reaches the free tier limit??

The reason why is that AWS is greedy, and would rather force you to become a paid customer…

Re: Serverless Horrors

#330

When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No problem that makes sense - it's an easy way to prove authentication as a bot can't spam a credit card (or else it would be financial fraud and most likely a felony). Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. I had the…

Since this seems to be getting some comments. Yes, it is in fact easy to shut down an instance if it goes over a spending limit. As in you monitor traffic tied directly to the billing system and you set up an if statement and if it goes over the limit you shut down the server and dump the service to a static drive. It's the easiest thing in the world - they just don't want to because they figured that they could use…

Not defending the practice of the cloud providers but you’re oversimplifying the difficulty involved.
Post reply on HN