Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got pwned by my cloud costs

troyhunt.com

Post reply on HN
Print view View original

211–220 of 657 posts

Re: I got pwned by my cloud costs

#211

Post by pmlnr »

andi999 wrote: post #177
lpcvoid wrote: post #56

Can somebody explain to me why I wouldn't just rent a 40 EUR dedicated server from Hetzner with unlimited traffic and gigabit uplink? His 600GB/day is way less than what you get over a gigabit link within a day. Sure, sudden bursts would perhaps "throttle" at a gigabit, but according to his article that was only the cloudflare proxy anyhow, so no pain in having that take a few seconds longer. As far as I am concerned…

Maybe one wants to mantain the application and not the server? Long time ago i booked a vps, install some bsd on it and thought i am good. A month later a ntp security vulnerability was discovered, soon the server was put offline, some 'patch your things asap' not so nice emails came in. From that time my take is one should spend some time probably daily on an own server if one wants to mantain it.

Right, because a barebone docker hypervisor needs so much admining.

Re: I got pwned by my cloud costs

#212

Post by andi999 »

sdze wrote: post #190
andi999 wrote: post #177

Earlier quoted context omitted.

Maybe one wants to mantain the application and not the server? Long time ago i booked a vps, install some bsd on it and thought i am good. A month later a ntp security vulnerability was discovered, soon the server was put offline, some 'patch your things asap' not so nice emails came in. From that time my take is one should spend some time probably daily on an own server if one wants to mantain it.

Aren't Azure Compute Nodes also "bare metal"?

I dont know.

Re: I got pwned by my cloud costs

#213

Post by [deleted] »

suction wrote: post #36

I wonder if before cloud computing, has there ever been a successful product / service where it was accepted with just a shrug that the volatility of monthly costs means it could bankrupt you with next month's bill, because of complexities and opaqueness of the cost structure make it virtually impossible to predict and protect against extreme peaks in all parts of the setup. Even if you run a relatively opaque cost s…

[deleted]

Re: I got pwned by my cloud costs

#214

Post by dustinmoris »

viraptor wrote: post #205
dustinmoris wrote: post #201

Earlier quoted context omitted.

Quoted post unavailable.

That's really extreme. How about: Keep in mind that any review may be paid for? FWIW, he complained a lot about Ubiquiti issues on his podcast, so it's not like he can't say bad things about them. (as in half an episode about the controller dropping his configuration or something like that) > selling on stolen password data [...] that he will never talk about How do you know about it then? That's really a [citation n…

No post body was provided.

Re: I got pwned by my cloud costs

#215

Post by capableweb »

sdze wrote: post #190
andi999 wrote: post #177

Earlier quoted context omitted.

Maybe one wants to mantain the application and not the server? Long time ago i booked a vps, install some bsd on it and thought i am good. A month later a ntp security vulnerability was discovered, soon the server was put offline, some 'patch your things asap' not so nice emails came in. From that time my take is one should spend some time probably daily on an own server if one wants to mantain it.

Aren't Azure Compute Nodes also "bare metal"?

Based on a quick Google search for "Azure Compute Node":

> A node is an Azure virtual machine (VM) or cloud service VM

> The terms node and VM are used interchangeably occasionally

> Azure Batch creates and manages a pool of compute nodes (virtual machines)

> In an Azure Batch workflow, a compute node (or node) is a virtual machine that processes a portion of your application's workload

So no, seems Azure Compute Nodes are VMs, not bare metal.

Re: I got pwned by my cloud costs

#216

Post by philliphaydon »

suction wrote: post #175
avrionov wrote: post #130

Earlier quoted context omitted.

I worked on both cloud computing and on premise project. Before cloud computing the risks were different: - much harder to scale. It was much more common to over provision and have machines and bandwidth being unused for years. - when we were hit with very high traffic due to a bug or something else, most of the time it would lead to customer outages. Based on the contract some times it requires to pay back because S…

If you have a bug that renders your product unusable and refunds are in order, the flexibility of handling traffic peaks which a cloud provider offers won't solve that problem for you. It could even aggravate it. If a show-stopping bug is introduced, it would probably be preferable to fail quickly.

If there was an outage in early 2000, we just went outside to play, or watch tv.

Now if Facebook is down for 15 seconds everyone has heart failure like their life is over.

Re: I got pwned by my cloud costs

#217

Post by capableweb »

cyberCleve wrote: post #3

Ouch. If Troy Hunt of all people can make this mistake, it can happen to anybody. HIBP is an awesome service funded totally by donations, so it's too bad this happened. Of course Microsoft is happy to hide behind their confusing pricing model and let customers overpay for Azure without alerting them.

Correct me if I'm wrong, but Troy Hunt is a person focusing on security, not infrastructure, deployments or development even. If anyone is near making that mistake, it's people like Troy Hunt. Operators would of course see the problem easily (paying for bandwidth like that would be the first warning sign), while they are sometimes blind to other issues, like security.

Re: I got pwned by my cloud costs

#218

Post by stickfigure »

tolien wrote: post #168
suction wrote: post #36

I wonder if before cloud computing, has there ever been a successful product / service where it was accepted with just a shrug that the volatility of monthly costs means it could bankrupt you with next month's bill, because of complexities and opaqueness of the cost structure make it virtually impossible to predict and protect against extreme peaks in all parts of the setup. Even if you run a relatively opaque cost s…

> Even if you run a relatively opaque cost structure business like a restaurant, you can still calculate the maximum cost of ingredients for one month, the salaries, energy, etc. If the restaurant suddenly ordered ten thousand times more ingredients than usual, their supplier would probably call back and say "is that really what you want?" rather than just shrugging and shipping them tonnes of tomatoes with a bill fo…

I'll bet Sysco would deliver $10k worth of canned tomatoes to your restaurant without checking.

Re: I got pwned by my cloud costs

#219

Post by capableweb »

tolien wrote: post #187
suction wrote: post #171

Earlier quoted context omitted.

Very true. And in terms of cloud computing, it would mean that alerts and notifications and limits are worth absolutely nothing if it's on the customer to set them up in the correct way for every scenario imaginable. Which is nearly impossible. The tomato supplier's human alerting system is a catch-all-system which would be easily implementable as well.

Yeah - if you look at Troy's graphs they're already calculating an average bandwidth and the alert he's configured has a threshold ~1/50th his current level. Trying to set a hard number limit ahead of time is hard (estimating how much you'll use, don't want to set a number too low and get cut off plus cloud cost structures can be really hard to get your head around) but that basic level of anomaly detection should be…

> estimating how much you'll use, don't want to set a number too low and get cut off plus cloud cost structures can be really hard to get your head around

Easy way of avoiding this: Don't use shitty hosts that make you pay per GB served and shut you down once you hit your cost limit. Instead get limited by the available bandwidth you have, and clients will just access your server slower rather than being fully denied access.

Re: I got pwned by my cloud costs

#220

Post by raxxorrax »

lpcvoid wrote: post #56

Can somebody explain to me why I wouldn't just rent a 40 EUR dedicated server from Hetzner with unlimited traffic and gigabit uplink? His 600GB/day is way less than what you get over a gigabit link within a day. Sure, sudden bursts would perhaps "throttle" at a gigabit, but according to his article that was only the cloudflare proxy anyhow, so no pain in having that take a few seconds longer. As far as I am concerned…

> As far as I am concerned, I just don't understand why people use cloud services.

I use the credit card of my employer. For my own projects I use my own server for everything. Granted, it doesn't get much traffic.

Some offers from cloud providers are pretty good. If you want to scale to more (virtual) machines, it can be more easily done with the usual providers. I also expect Amazon to know more about firewall and reverse proxy configuration, it renews my certificates automatically and has rudimentary services for monitoring of server state. There is a certain convenience to it.

Would I recommend cloud based hosting? Absolutely not. You become dependent on the provider and prices are often steep. Even if you do not know much about server security, your unsecured s3 bucket will be far more exposed than your standard db installation on your own server. Better build expertise for systems you have full control over than to invest the time on the details of AWS which are more subjected to change.

Post reply on HN