Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netlify just sent me a $104k bill for a simple static site

old.reddit.com

Post reply on HN
Print view View original

171–180 of 836 posts

Re: Netlify just sent me a $104k bill for a simple static site

#171

Post by jart »

ji_zai wrote: post #74

This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…

Use a token bucket on your web server to catch abusive IPs and then blackhole them using `iptables -t raw -I PREROUTING -s ip -j DROP`. I know. I run https://ipv4.games/ which invites hackers to unleash their botnets, and the service runs on a small VM with only a few cores. It's been attacked by botnets with 49,131,669 IP addresses. There's no Cloudflare frontend or anything like that, because back when I used Cloudflare, the people who attacked the service would actually bring down the Cloudflare nodes before they brought down my web server. I doubt I've ever paid more than $100/month to operate the service. Please note that your service provider needs to have free ingress in order for this strategy to be effective.

Re: Netlify just sent me a $104k bill for a simple static site

#172

Post by AtNightWeCode »

toomuchtodo wrote: post #20
triyambakam wrote: post #2

So if I want to migrate off of netlify to something better, where?

Cloudflare. You will get a call if on a free or pro ($25/month) plan [1] if your bandwidth usage is so high it would warrant increasing your plan. Worst case, they turn you off. Preferred over denial of money attack based on your use case. Set and forget after pointing at your origin (time is money). You'll get a call on any of their plans if your bandwidth usage exceeds certain thresholds, I am assuming your median…

You typically can't replace Netlify with Cloudflare. You need something like Github actions with some storage, S3 or something and then one can put Cloudflare in front of it all for caching, DDOS protection and so on.

Re: Netlify just sent me a $104k bill for a simple static site

#173

Post by stanac »

I just checked pricing on hetzner (not affiliated with them). First 20 TB are included with VM price, after which it's 1.19 euros per TB. If this happened to someone hosting there it would cost them additional 50 euros. Can't believe the difference in traffic pricing. Netlify is over 1000x more expensive per TB.

Re: Netlify just sent me a $104k bill for a simple static site

#174

Post by jojobas »

geek_at wrote: post #79
ehsankia wrote: post #35

Earlier quoted context omitted.

in other words, "if you're thinking of using netlify, don't".

true. I have a 9€/mo vps at Contabo for my blog and once boasted on HN that my small VPS is able to handle reddit/hn hugs which one user seemed to take personally and they started a DDOS against my VPS. I only realized this after Contabo contacted me and said the traffic is so high that other clients service is also degraded and they will have to take my VPS down if its much longer (which was understandable). Gladly…

Even then Cloudflare forward proxy capable of real ddos handling wouldn't cost you $25 per month, some 0.5% of the 95% discounted bill.

But hey - just think about how much you saved on Netlify! Composable!

Re: Netlify just sent me a $104k bill for a simple static site

#175

Post by iforgotpassword »

JW_00000 wrote: post #144
iforgotpassword wrote: post #75

Earlier quoted context omitted.

Yeah Like wtf is wrong with that? Are people just to lazy to check what the conditions are when exceeding traffic? I'd never ever sign up for anything that just keeps charging...!?

But then where would you run a small hobby project that you'd like to run in the cloud? I have some small stuff I'm running on Google Cloud Platform, and honestly I'm scared of the same thing happening to me because there's no easy way to set a limit. But AWS and Azure have the same policy. (In my case, I'm looking for somewhere I can easily deploy a set of ~5 Docker containers, they don't need to scale up, and it's…

self-Host with a provider that has clear TOS and not twenty pages of fine print. Something like the good old "if you exceed X TB in a month, you will be limited to 10mbit/s for the rest of that month". As long as you're running a hobby project or even some side project that starts making money but is still beta, this should be good enough. Once business gets serious, you will inevitably have to spend more money, and you might have to look at cloudflare et al if you're actually in a business where ddos happen.

Seriously, if you just want to run docker, maintaining a debian VPS for that is basically enabling unattended-upgrades and doing a dist-upgrade every two years. If you can't be arsed to do that then maybe you deserve the 100k bill...

Re: Netlify just sent me a $104k bill for a simple static site

#176

Post by b112 »

WyvernDrexx wrote: post #140
ji_zai wrote: post #74

This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…

Imagine you lost your job. So you are here enjoying creating and hosting your hobby projects in theses services. Now, suddenly one fine morning you get slapped with $104K bill because someone decided to randomly ddos your one page dog lover website. Now, who in the would would be thinking of having ddos protection for their hobby project? This is just absurd thinking.

This may seem weird, but I believe ToS ae the real problem here. I call it the "car rental" problem.

When I rent a car in person, I am often given a contract. And this contract is filled with tiny print, and pages of it.

There are often people behind you, waiting, and bored/annoyed people behind the counter, waiting. This is beyond unreasonable.

A point of sale contract should be short, in readable text, and understandable. For example, renting a car? Under a page, easily parseable, and if the person behind the counter cannot explain it, it is null and void.

From a legal side, you can do this. And you can explain legal terms. Of course this means you are describing intent, which limits one in court, oh boo hoo Mr Lawyer. Cry me a river.

Well the same should be true of any retail contract. Sign up for a service? One page with costs listed.

At least then, there is hope of an end-user sort of understanding. And as one could claim that a DoS was actually targetting the provider, and not the website, that should be described too.

So back to the topic at hand. I would write a demand letter, insistong Netify explain the charges, and ask them if they and their IP ranges were DoS, and if so that the charges be reversed.

Because you shpuld not be paying, if someone attacks Netify.

This letter should also be sent by mail, sig required, to the corporate address too.

Re: Netlify just sent me a $104k bill for a simple static site

#177

Post by eviks »

LiamPowell wrote: post #12

I don't see why people are surprised by this or why people are calling it a scam. Netlify and others are extremely transparent about the fact that there are no limits. I completely understand not liking it and can see why the lack of limits would make it a bad option for plenty of people, but I don't see how it can possibly be called a scam.

> extremely transparent

> they probably should have a giant warning page for new users who don't know that this is how this kind of service works

Pick one

Re: Netlify just sent me a $104k bill for a simple static site

#178

Post by codewithcheese »

ji_zai wrote: post #74

This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…

Vervel charges $400/TB for excess bandwidth, it's not even DDoS you should worry about, just moderate success.

Re: Netlify just sent me a $104k bill for a simple static site

#179

Post by thinkingemote »

KingOfCoders wrote: post #16
triyambakam wrote: post #2

So if I want to migrate off of netlify to something better, where?

I use BunnyCDN to host several sites, they have a minimum cost of $1 per month and I usually pay $1 per month. I run my sites [0] on Hugo and copy the generated sites (Makefile) to BunnyCDN with their command line tool. It's a plain CDN, but does include DNS hosting for easy SSL certificates and has scriptable DNS [1] where you can run Javascript for dynamic DNS. I went with them b/c they are in the EU, but I've stay…

Looks nice but then so does Netlify at face level! Seems like it is pay as you go, and there is a settable max spend per month.

Does their ddos protection work differently than Netlify and could Bunny ever pull the same stunt with billing?

Re: Netlify just sent me a $104k bill for a simple static site

#180

Post by prmoustache »

nindalf wrote: post #44

Since the author has gone viral I expect some netlify exec is going to take over and write this bill off to $0. In the words of Kramer “these big companies, they just write it off!” A moment of silence for the people who got DDoS-ed, didn’t go viral and still had to pay $5k.

The very fact that you expect that making front page of hn will make them cancel that bill means that it will soon be over.

These kind of stories (alongside cancelled accounts) repeat over and over again and will soon become so not newsworthy that they will either not end up in front page, nor people will check on the eventual outcome which means these companies will get away with not moving a finger.

Post reply on HN