I like companies like this, that give you such a straight-forward reason never to do business with them.
Netlify just sent me a $104k bill for a simple static site
321–330 of 836 posts
Re: Netlify just sent me a $104k bill for a simple static site
#322[deleted]
Re: Netlify just sent me a $104k bill for a simple static site
#323This is my worst nightmare as a bootstrapped founder. And that there's no way to put a limit on spend is ridiculous. Someone that doesn't want me to do well can simply ddos me into bankruptcy out of nowhere. Just went through Vercel's docs: --- "Vercel helps to mitigate against L3 and L4 DDoS attacks at the platform level. Usage will be incurred for requests that are successfully served prior to us automatically miti…
This might be a good time to point out Cloudflare Pages: https://pages.cloudflare.com/ Under the free tier: > Unlimited bandwidth
I didn't even know Cloudflare offered a JAMstack platform. I'm going to switch as I already use Cloudflare for domains.
Re: Netlify just sent me a $104k bill for a simple static site
#324good time to point out tiiny.host -> https://tiiny.host/
whoah, thats expensive. reminds me free services from early 2000's (lycos, 50web etc) with these file limits and banners
Re: Netlify just sent me a $104k bill for a simple static site
#325I have a bunch of pet projects on netlify free tier and I could never afford to pay this amount of money. What are some good alternatives that don't have this issue? I've already noticed cloudflare pages mentioned in these comments.
My pipeline and hosting solutions are:
Static: Github Actions to build and deploy to BunnyCDN
Non-static: selfhosted Dokku on Hetzner
Neither is free, if you're looking for free, Github Pages or Cloudflare for static sites. Free non-static, I'm not sure there are solutions that don't have the same problem Netlify has.
Re: Netlify just sent me a $104k bill for a simple static site
#326I don't see why people are surprised by this or why people are calling it a scam. Netlify and others are extremely transparent about the fact that there are no limits. I completely understand not liking it and can see why the lack of limits would make it a bad option for plenty of people, but I don't see how it can possibly be called a scam.
Because it's unbounded liability. Not to mention the strong conflict of interest for netlify, who stands to gain from their customers being attacked. Netlify is getting paid for something criminal in nature having occurred. It's like who is responsible for credit card fraud? If customers are responsible for credit card fraud, and it's their responsibility not to get scammed, then who implements fraud prevention measu…
> Not to mention the strong conflict of interest for netlify, who stands to gain from their customers being attacked. Netlify is getting paid for something criminal in nature having occurred.
I think you could argue that Netlify is guilty of racketeering in OP's case.
1. They admit illegal activity happened (a DDoS attack).
2. They demand money to be reimbursed for the illegal activity. However, the reimbursement they ask is several hundred times higher than the actual damages incurred.
Re: Netlify just sent me a $104k bill for a simple static site
#327Does this issue only occur if you have billing info on file? I'm using the free tier and have no billing info set. According to this https://github.com/netlify/ask-netlify/issues/6#issuecomment... > if you have an event that puts you over the free-tier limits, Netlify will ask you to update your billing information and add a CC Although worryingly > We just had this happen and our site didn't stop working. Is there a…
No, and this is by design. If you go over the limits (can also happen if a build machine times out, ask me how I know), you will be billed without any recourse. If you have no billing information and refuse to set it, at the very least they'll permanently ban you from their platform.
Which, if it remains the only consequence, seems like a blessing now.
Re: Netlify just sent me a $104k bill for a simple static site
#328Earlier quoted context omitted.
Use a token bucket on your web server to catch abusive IPs and then blackhole them using `iptables -t raw -I PREROUTING -s ip -j DROP`. I know. I run https://ipv4.games/ which invites hackers to unleash their botnets, and the service runs on a small VM with only a few cores. It's been attacked by botnets with 49,131,669 IP addresses. There's no Cloudflare frontend or anything like that, because back when I used Cloud…
This strategy may work for a (D)DoS that is targeted to an application layer, but won't work if the attack is designed to exhaust your bandwidth. Once you're receiving more traffic than you network cards can handle, it does not matter if you'll drop the packets with iptables or not. I was the target of attacks that caused Hetzner to terminate my contract. I was leasing physical servers there, so I assume the attacks…
These days it seems that DDoS attacks are often not targeted at bandwidth either, but rather packets per second. It is (apparently) much easier to exhaust routing capacity with an inordinate number of tiny packets than with a still large number of large packets. Cloudflare has some fun ways to deal with this [0].
[0] https://blog.cloudflare.com/mitigating-a-754-million-pps-ddo...
Re: Netlify just sent me a $104k bill for a simple static site
#329Earlier quoted context omitted.
So you'd be either slow or pay them "for protection". Something that reminds me of;)
Capitalism? Mob-style "protection" would be if Cloudflare were the ones who DDoSed you if you didn't pay.
Yeah. Instead Cloudflare hosts the websites of DDoS sellers and refuses to take them down or tell you who they are. A lot of these DDoS-for-hire services use Cloudflare to hide their real IP.
Re: Netlify just sent me a $104k bill for a simple static site
#330Earlier quoted context omitted.
CloudFlare pricing is indeed positively ridiculous. At OpenTofu[0] we’re using CloudFlare R2 to host the providers and modules registry[1]. Bandwidth is free, you only pay for requests. This already would be great, but there’s more - you only pay for requests that actually hit R2. So with an almost 100% cache hit ratio, we barely register any billable requests. Recently someone decided to load test us and generated ~…
Is this in line with the TOS? I thought there were restrictions on serving non-website content in the free tier, or does that not apply to the CDN if you're using R2 as an origin?
They updated TOS to enable proxing R2 via CDN with cache enabled: https://blog.cloudflare.com/updated-tos