Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

Post reply on HN
Print view View original

411–420 of 503 posts

Re: Serverless Horrors

#411

Post by naasking »

raw_anon_1111 wrote: post #370
mgkimsal wrote: post #333

Earlier quoted context omitted.

A theme of many of the horror stories is something like "I set up something personal, costing a few dollars a month, and I was DDOSed or (in earlier terms) slashdotted out of the blue, and I now have a bill for $17k accumulated over 4 hours". As someone else pointed out, some(?) services prevent unlimited autoscaling, but even without unlimited, you may still hit a much larger limit. Being able to say 'if my bill goe…

You can do that today. Billing alerts can trigger workflows.

Sounds like this should be a standard workflow that's a very simple and visible option.

Re: Serverless Horrors

#412

Post by OJFord »

psychoslave wrote: post #235
tetromino_ wrote: post #194

Earlier quoted context omitted.

If you sign up for electrical service for your house, and your shithead neighbor taps your line to power his array of grow lamps and crypto mining rigs, the power company will happily charge you thousands of dollars, and you will need a police report and traverse many layers of customer service hell to get a refund. If you sign up for water service and a tree root cracks your pipe, the water company will happily char…

I don't know in US, but having limits on how much electricity a house is able to take from the gride is absolutely something in some countries out there.

Definitely in the US too, I'm not resident either, but your 100A or whatever supply is a hard limit on what it can cost you per time period.

Re: Serverless Horrors

#413

Post by OJFord »

mgkimsal wrote: post #177
bee_rider wrote: post #122

Earlier quoted context omitted.

I’ve accidentally hit myself with a bigger than expected AWS bill (just $500 but as a student I didn’t really want to spend that much). So I get being annoyed with the pricing model. But, I don’t think the idea of just stopping charging works. For example, I had some of their machine image thingies (AMI) on my account. They charged me less than a dollar a month, totally reasonable. The only reasonable interpretation…

> But, I don’t think the idea of just stopping charging works. You don't stop CHARGING. You stop providing the service that is accumulating charges in excess of what limit I set. And you give some short period of time to settle the bill, modify the service, etc. You can keep charging me, but provide a way to stop the unlimited accrual of charges beyond limits I want to set. > No, I think cloud billing is just inheren…

It's fairly straightforward for compute, as you allude to; it's not straightforward for storage, as GP describes.

Re: Serverless Horrors

#414

Post by danpalmer »

rwmj wrote: post #25
solatic wrote: post #14

Earlier quoted context omitted.

No. Your buckets should be private, with a security rule that they can only be accessed by your CDN provider, precisely to force the CDN to be used.

Why isn't that the default? I'm glad I use a Hetzner VPS. I pay about EUR 5 monthly, and never have to worry about unexpected bills.

> I'm glad I use a Hetzner VPS. I pay about EUR 5 monthly, and never have to worry about unexpected bills.

The trade-off being that your site falls over with some amount of traffic. That's not a criticism, that may be what you want to happen – I'd rather my personal site on a £5 VPS fell over than charged me £££.

But that's not what many businesses will want, it would be very bad to lose traffic right at your peak. This was a driver for a migration to cloud hosting at my last company, we had a few instances of doing a marketing push and then having the site slow down because we couldn't scale up new machines quickly enough (1-12 month commitment depending on spec, 2 working day lead time). We could quantify the lost revenue and it was worth paying twice the price for cloud to have that quick scaling.

Re: Serverless Horrors

#415

Post by spyspy »

damontal wrote: post #378
alkonaut wrote: post #185

Earlier quoted context omitted.

I would never use a cloud service that doesn't let me set a hard cap for any service. Not just an alert. A hard cap.

Which cloud service does this?

Cloud Run lets you cap the number of instances when you create a service. So you can just set max_instances to 1 and you never have to worry about a spambot or hug of death from blowing up your budget. I run all my personal sites like this and pay (generally) nothing.

Re: Serverless Horrors

#417

Post by x0x0 »

JustExAWS wrote: post #277
citizenpaul wrote: post #268

Earlier quoted context omitted.

You are a bit naive. They are making a ton of money with this dark pattern. As others have said Free-to-100K is not in the most generous realm of expectations. Its also why they have been doing the refunds as long as AWS has been a thing. They know it will not hold up in court. Not a month goes by without some HN story about something like this post. They do this and make it easy to get a refund because for every dem…

I have had a “larger account” when I was at startup and was able to ask for a refund for a business. As I asked before, if what is causing overages is not web requests but storage should they just delete everything?

You, but shorter: It can't be done perfectly in 100.0% of all possible circumstances, so better to do absolutely nothing at all. On an unrelated note, this strongly aligns with their economic interests.

For storage specifically, in that circumstance, if you weren't hellbent on claiming otherwise: it's easy to figure out what to do. For storage: block writes and reach out to the customer. Also, people are extremely unlikely to accidentally upload eg 250tb which is how you'd get to, say, $200/day. Whereas similar bills are extremely easy to accidentally create with other services.

It's totally reasonable to want spend limits firmer than AWS' discretion, which they can revoke at any point in time for any reason.

Re: Serverless Horrors

#418

Post by Andrex »

joshstrange wrote: post #4

I thought this would be about the horrors of hosting/developing/debugging on “Serverless” but it’s about pricing over-runs. I scrolled aimlessly through the site ignoring most posts (bandwidth usage bills aren’t super interesting) but I did see this one: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-c... About how you make unauth’d API calls to an s3 bucket you don’t own to run up the costs. That was a n…

> I reported my findings to the maintainers of the vulnerable open-source tool. They quickly fixed the default configuration, although they can’t fix the existing deployments.

Anyone wanna guess which open source tool this was? I'm curious to know why they never detected this themselves. I'd like to avoid this software if possible as the developers seem very incompetent.

Re: Serverless Horrors

#419

Post by scarface_74 »

pclmulqdq wrote: post #410
scarface_74 wrote: post #403

Earlier quoted context omitted.

Yes and I’ve also seen bad on prem build outs, bad hires, bad initiatives, proof of concepts that didn’t go anywhere, etc

Sure. The issues with AWS could all be solved with decent billing software, though. 15 years in there isn't a good excuse for this state of the world except that it's profitable.

You can set up billing alerts to trigger actions that stop things when they trigger. The easiest way is to take permissions away from the roles you create.

They give you the tools. It’s up to you to use them. If that’s too difficult, use the AWS LightSail services where you are charged a fixed price and you don’t have to worry about overages or the new free tier

https://aws.amazon.com/free/

Because despite what everyone here is saying, before July of this year, there was no such thing as a free tier of AWS, there was a free tier of some of their services

Re: Serverless Horrors

#420

Post by JustExAWS »

earnesti wrote: post #343
JustExAWS wrote: post #275

Earlier quoted context omitted.

Yes, you as a developer should know something about how the service works before you use it. I first opened the AWS console in 2016 and by then I had read about the possible gotchas.

Well, people get informed by reading these stories. So let's keep informing people to avoid AWS.

Yes I’m sure large corporations and even startups are going to leave AWS because a few junior devs didn’t do their research.
Post reply on HN