Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serverless Horrors

serverlesshorrors.com

Post reply on HN
Print view View original

11–20 of 174 posts

Re: Serverless Horrors

#11

Post by hamoodhabibi »

voidwtf wrote: post #4
crooked-v wrote: post #2

Also see the Netlify comment thread linked from one of the Reddit posts ( https://answers.netlify.com/t/limit-bandwidth-to-avoid-high-... ), where one of their representatives specifically says that if you suffer a DDOS they will do nothing to stop you from getting a bajillion-dollar bandwidth bill, even if you're on the "free" tier.

That's my favorite thing about all these services. None of them have an equivalent of a stop-loss. They'll notify you IF you setup an alert, but that's it. Often times the alerts are way after the damage is done, with some billable metrics often lagging in reporting/alerting by hours. The default should be safe with easy options to increase the limits.

oooh i really like that stop loss example. having a netlify serverless website is basically selling a put option without receiving any premium.

Re: Serverless Horrors

#12

Post by andrasbacsai »

000ooo000 wrote: post #9

Something feels a bit off about the creator of this site also pushing a competitor. On one hand, they're upfront about it, and on the other.. they're upfront about it. At least it might prompt the companies in question to be a bit less scummy.

Which competitor do I push exactly? :)

(I created serverlesshorrors)

Re: Serverless Horrors

#13

Post by wandernauta »

000ooo000 wrote: post #9

Something feels a bit off about the creator of this site also pushing a competitor. On one hand, they're upfront about it, and on the other.. they're upfront about it. At least it might prompt the companies in question to be a bit less scummy.

I agree, especially because I'm not even sure the pushed competitor solves the problem that's being highlighted here.

All the horror stories so far seem to be about people using a lot of metered resources, like bandwidth, and then getting billed for those resources.

With the pushed competitor you can self-host your Vercel or Netlify alternative on your own EC2 instance - but then if someone downloads 60 terabytes worth of data from you, you still get to pay for that bandwidth. You still get an unexpected large bill.

Re: Serverless Horrors

#14

Post by andrasbacsai »

hamoodhabibi wrote: post #10
crooked-v wrote: post #2

Also see the Netlify comment thread linked from one of the Reddit posts ( https://answers.netlify.com/t/limit-bandwidth-to-avoid-high-... ), where one of their representatives specifically says that if you suffer a DDOS they will do nothing to stop you from getting a bajillion-dollar bandwidth bill, even if you're on the "free" tier.

It used to be we will take your server down. Now its we'll DDOS your serverless website and leave you a 100k bill. I'm not sure how sustainable such business model is. When you owned the server, you could unplug it. Now you have no way of knowing if somebody is going to hit your /api a million times per minute

I also prefer to get a (decaf) coffee, listen to some music while someone DDoS'd my VPS. I prefer to pay few $ / month for my VPS instead of paying thousands and "survive" the DDoS.

Re: Serverless Horrors

#15

Post by tutfbhuf »

I don't think the Netlify case has happend due to serverless architecture. Yes, there are many technical issues with serverless architectures, but getting a huge bill for incoming traffic is independent from a serverless architecture. You could also put your own hardware in a colo and pay for traffic. If your data center provider does not protect you from DDoS and simply bills by the TB, then the same situation would occur. Of course, one could argue that the prices per TB are much cheaper in a colo situation compared to Netlify and therefore a 100k bill is very unlikely to occur, but then I would make this the main point: absurdly high traffic costs and no DDoS mitigation, and wouldn't put it behind a "serverless horrors" title.

Re: Serverless Horrors

#16

Post by andrasbacsai »

wandernauta wrote: post #13
000ooo000 wrote: post #9

Something feels a bit off about the creator of this site also pushing a competitor. On one hand, they're upfront about it, and on the other.. they're upfront about it. At least it might prompt the companies in question to be a bit less scummy.

I agree, especially because I'm not even sure the pushed competitor solves the problem that's being highlighted here. All the horror stories so far seem to be about people using a lot of metered resources, like bandwidth, and then getting billed for those resources. With the pushed competitor you can self-host your Vercel or Netlify alternative on your own EC2 instance - but then if someone downloads 60 terabytes wor…

Sure, but take a look at this: https://getdeploying.com/reference/data-egress

60 TB

On Hetzner (VPS provider): $1. On Netlify: $33,000

Re: Serverless Horrors

#17

Post by liampulles »

I don't think infinite scaling is desirable. You probably want to say "if the value or rate of increase in xyz" metric reaches a certain level, don't scale further, or start scaling down. As a requirement for a serverless deployment, not an option.

Re: Serverless Horrors

#18

Post by geek_at »

hamoodhabibi wrote: post #10
crooked-v wrote: post #2

Also see the Netlify comment thread linked from one of the Reddit posts ( https://answers.netlify.com/t/limit-bandwidth-to-avoid-high-... ), where one of their representatives specifically says that if you suffer a DDOS they will do nothing to stop you from getting a bajillion-dollar bandwidth bill, even if you're on the "free" tier.

It used to be we will take your server down. Now its we'll DDOS your serverless website and leave you a 100k bill. I'm not sure how sustainable such business model is. When you owned the server, you could unplug it. Now you have no way of knowing if somebody is going to hit your /api a million times per minute

true. At what point could you say they are accomplices to the attackers

Re: Serverless Horrors

#19

Post by merelysounds »

A kill switch seems a practical and trivial solution. E.g. something toggled when a monthly bill exceeds a configurable amount.

I’m guessing many hobby users would set that to $100, end of story.

I don’t understand why it’s so unpopular to offer that. I’d imagine the providers would benefit too in the long run.

Re: Serverless Horrors

#20

Post by adrianN »

tutfbhuf wrote: post #15

I don't think the Netlify case has happend due to serverless architecture. Yes, there are many technical issues with serverless architectures, but getting a huge bill for incoming traffic is independent from a serverless architecture. You could also put your own hardware in a colo and pay for traffic. If your data center provider does not protect you from DDoS and simply bills by the TB, then the same situation would…

If your stuff scales to infinity your money burn rate also scales to infinity. A single server in a colo can only do so much damage to your wallet before it’s saturated.
Post reply on HN