Live data from Hacker News

Netlify just sent me a $104k bill for a simple static site

old.reddit.com

261–270 of 836 posts

Re: Netlify just sent me a $104k bill for a simple static site

#261
post #74

This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…

Vercel seems to exist only to promote lock-in.

Re: Netlify just sent me a $104k bill for a simple static site

#263

Here's my workaround for Vercel: - Enable spend management ( https://vercel.com/team_name/~/settings/billing ). - Set webhook to pause the project: https://vercel.com/docs/rest-api/endpoints/projects#pause-a-... When the amount hits the targeted value, Vercel will call the webhook that pauses the project.

You could probably set up rate limiting with iptables/nftables as well if it’s a vps.

Re: Netlify just sent me a $104k bill for a simple static site

#264
Typically, it is not even a Distributed Denial of Service (DDOS) attack; instead, it is traffic from (SEO) bots that crawl through every possible combination of the page, such as query parameters for web shop filters. I hate those down to the guts, because you have to design a rate limiter that will limit them and let other traffic through.

Re: Netlify just sent me a $104k bill for a simple static site

#265
post #74

This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…

This might be a good time to point out Cloudflare Pages: https://pages.cloudflare.com/ Under the free tier: > Unlimited bandwidth

Yeah, I'm already using Cloudflare because of Google Domains got de facto killed by Google via transferring it to Squarespace. Why not Cloudflare Pages, CDN, and R2 (S3-compatible storage) too? I'm even considering paying for the paid tier in the future if I ever go above the limits of 20 000 files per static site and the 25 MiB single file size limit [^1] (more than enough right now or in the near future).

[^1]: https://developers.cloudflare.com/pages/platform/limits/

Re: Netlify just sent me a $104k bill for a simple static site

#266
post #249

Earlier quoted context omitted.

Imagine you lost your job. So you are here enjoying creating and hosting your hobby projects in theses services. Now, suddenly one fine morning you get slapped with $104K bill because someone decided to randomly ddos your one page dog lover website. Now, who in the would would be thinking of having ddos protection for their hobby project? This is just absurd thinking.

No. This is absolutely common. I remember well how shared hosters 10 years ago already put caps on cheap packages and took the websites offline in case of traffic. And today it's Amazon who bills small players into dept. There are many provider who don't tho.

I always loved nearlyfreespeech.com for this, (prepay, and if you run out of money the site goes down) but found it to be a pain for projects that really needed a VPS

Re: Netlify just sent me a $104k bill for a simple static site

#269
post #44

Since the author has gone viral I expect some netlify exec is going to take over and write this bill off to $0. In the words of Kramer “these big companies, they just write it off!” A moment of silence for the people who got DDoS-ed, didn’t go viral and still had to pay $5k.

Thanks.

When I received a message from the bank saying my account was in the red I discovered that AWS had been billing me 1100 / month for 5 months before I even noticed. It was for something I'd set up one night while bored and then forgot about it. They drained my account :( Even had the nerve to say I had to pay for premium support only to get a "lol, pay" response.

Re: Netlify just sent me a $104k bill for a simple static site

#270
post #83
post #33

Put Cloudflare proxy in front of Netlify/Vercel deploys

Every Netlify project is assigned a Netlify subdomain (i.e. `example.netlify.app`) that cannot be removed or proxied. If anyone figures out what your Netlify subdomain is, it's my understanding that they can DDoS you and there's nothing you can do about it.

That makes sense, but is the Netlify subdomain visible from your custom domain? How would they be able to figure it out, other than humans leaking it somehow?
Post reply on HN