Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My First AWS “Free Tier” Hosting Bill Was $990

blog.andrewray.me

Post reply on HN
Print view View original

51–60 of 63 posts

Re: My First AWS “Free Tier” Hosting Bill Was $990

#51

Post by raxxorrax »

moksly wrote: post #38
omarhaneef wrote: post #26

If we are trading war stories: I was playing around with some tutorial to learn something (probably something cool like programming your own robotic drone using functional erlang or whatever), pushed to github and went to sleep. Woke up a few short hours later and had lots of emails about the machines I was spinning up. Checked and saw that my account had wracked up thousands of dollars overnight (I think 6-8 hours),…

Credentials on github is actually a fairly common cause for GDPR breach, not as common as people using auto-complete in their e-mail system, but it’s up there. So you’re not as alone as you think, and these aren’t from people trying to learn something, it’s from big enterprise IT organisations.

Auto-completing e-mail adresses is a GDPR violation? Because you could iterate them and see all the contacts? Seriously?

Re: My First AWS “Free Tier” Hosting Bill Was $990

#52

Post by Yetanfou »

And the solution to this and all the other "free" SaaS conundrums is the same as it always has been: run it on the server-under-the-stairs or, if need be, on a flat-rate hosting platform. You might not be able to tick off all the buzzwords but you know up-front what you are getting in to and you're immune to all the problems listed in this thread. You might be trading them for some other problems but those are far less likely to break the bank.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#53

Post by richthegeek »

raxxorrax wrote: post #51
moksly wrote: post #38

Earlier quoted context omitted.

Credentials on github is actually a fairly common cause for GDPR breach, not as common as people using auto-complete in their e-mail system, but it’s up there. So you’re not as alone as you think, and these aren’t from people trying to learn something, it’s from big enterprise IT organisations.

Auto-completing e-mail adresses is a GDPR violation? Because you could iterate them and see all the contacts? Seriously?

Any exposure, intentional or accidental, of PII to a non-authorised person is a GDPR violation. An email address is PII as it's unique to that person.

Consider the Ashley Madison breach - there were websites that let you search for an email address and see if it was included. Even without the name or address of the person it was sufficient PII to cause damages (however 'deserved').

Re: My First AWS “Free Tier” Hosting Bill Was $990

#54

Post by asynch8 »

znpy wrote: post #50
bovermyer wrote: post #43

Earlier quoted context omitted.

The author of the post also calls out that the mistake was his, despite the occasional muttering about "dark UI patterns." I spend a lot of time in AWS, and I have trained myself to be extra careful about reading the fine print when using the UI exactly for the reason the author describes. The author calling out his own stupid mistakes elevates him in my eyes, not the reverse. Honesty and recognition of wrongdoing in…

> The author of the post also calls out that the mistake was his, despite the occasional muttering about "dark UI patterns." Yeah I saw that like, and lolled. The author does indeed admits his/her mistakes, but proceeds to kinda blame it on AWS anyway. It's like like saying "look I am no racist but ".

But, so, at what point, like how many people have to experience making this mistake, does it have to be for it to become AWSs problem?

Everyone makes mistakes, you can either help them not make these mistakes or do nothing and blame it on the users.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#55

Post by mannykannot »

srndh wrote: post #48
javagram wrote: post #14

If using AWS for personal use the first step should always be to set up a billing alarm. https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitori... It’s very helpful. You can still end up overspending but at least you get an email within a day letting you know what’s going on, which can solve a lot of the cost overruns by giving you a chance to act quickly and only get hit with 1/30 the monthly fee.

Why not have a system of pre-paid service? Cut-off once the fund dries up. This will be ideal for a testing.

For many businesses, the prospect of being cut off as a result of unexpected demand would be a serious liability, so therefore this would have to be an option -- but if it is an option, the customer has to select between it or an alternative, which is exactly the problem in this case.

Free tier is even more ideal for testing than this proposal, but the only way you can make options foolproof is to have no options.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#56

Post by raxxorrax »

richthegeek wrote: post #53
raxxorrax wrote: post #51

Earlier quoted context omitted.

Auto-completing e-mail adresses is a GDPR violation? Because you could iterate them and see all the contacts? Seriously?

Any exposure, intentional or accidental, of PII to a non-authorised person is a GDPR violation. An email address is PII as it's unique to that person. Consider the Ashley Madison breach - there were websites that let you search for an email address and see if it was included. Even without the name or address of the person it was sufficient PII to cause damages (however 'deserved').

On public websites I would agree, but all our mail clients have auto-completion. So would we need to turn that off? Would probably disable half the company.

I don't know who Ashley Madison is but that sounds far beyond sensible protection. Given, auto-completion is restricted to employees plus some locally saved contacts. It is just the standard outlook-exchange setup.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#57

Post by ghaff »

tasogare wrote: post #31
code4tee wrote: post #25

Earlier quoted context omitted.

Just setup billing alarms. Spend is reported continuously. These people surprised by end of month bills just aren’t paying attention to all the data AWS shows you on your spend. If they hard shut people down then people would be posting “AWS turned off my services and took my site down blah blah blah”

What about having choice? Hard limit and alert? I’m been bite by overspending accidentally on Azure (only ~30€ but still) so the hard cap is a real reassuring thing.

It's not quite that easy. It works for stateless services like transfers that can be just stop doing whatever they're doing. But presumably you don't want AWS to start deleting S3 buckets if a threshold is reached.

I actually tend to agree that, especially for hobbyist use, an automated hard cut off that cut out most further AWS service use would probably be desirable--even if some would (mis)use it in production environments and end up blowing up their site and complaining about it. I'm sympathetic to those who find the potentially open-ended nature of AWS billing to be bothersome. An alert is just an alert. There's no guarantee you'll be in a position to receive it and act on it in a timely manner.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#58

Post by unionpivo »

raxxorrax wrote: post #56
richthegeek wrote: post #53

Earlier quoted context omitted.

Any exposure, intentional or accidental, of PII to a non-authorised person is a GDPR violation. An email address is PII as it's unique to that person. Consider the Ashley Madison breach - there were websites that let you search for an email address and see if it was included. Even without the name or address of the person it was sufficient PII to cause damages (however 'deserved').

On public websites I would agree, but all our mail clients have auto-completion. So would we need to turn that off? Would probably disable half the company. I don't know who Ashley Madison is but that sounds far beyond sensible protection. Given, auto-completion is restricted to employees plus some locally saved contacts. It is just the standard outlook-exchange setup.

You can set up what (groups) autocomplete as a admin on both outlook and g suite (probably other providers).

Otherwise it's only people you have been in contact with.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#59

Post by bovermyer »

znpy wrote: post #50
bovermyer wrote: post #43

Earlier quoted context omitted.

The author of the post also calls out that the mistake was his, despite the occasional muttering about "dark UI patterns." I spend a lot of time in AWS, and I have trained myself to be extra careful about reading the fine print when using the UI exactly for the reason the author describes. The author calling out his own stupid mistakes elevates him in my eyes, not the reverse. Honesty and recognition of wrongdoing in…

> The author of the post also calls out that the mistake was his, despite the occasional muttering about "dark UI patterns." Yeah I saw that like, and lolled. The author does indeed admits his/her mistakes, but proceeds to kinda blame it on AWS anyway. It's like like saying "look I am no racist but ".

That's a terrible analogy.

AWS's UI is bad. The author's mistake was exacerbated by this, even if it wasn't directly caused by it.

Re: My First AWS “Free Tier” Hosting Bill Was $990

#60

Post by xtajv »

altmind wrote: post #22

I wish AWS had hard spending limits. Azure have one - you spend over the set limit(probably per billing account?) and your services are suspended. Already saved my from unexpected bill this month.

I like this option. It reminds me of a similar issue (which eventually got native AWS support): S3 permissions.

Today, there's a "Block Public Access" button which basically says "I solemnly swear that I don't want anyone outside of my account to see this S3 bucket. Please don't put this bucket on the public internet, even if I screw up my bucket policy and/or ACLs"

The option is off by default, but it's easy to find, simple to understand, and doesn't force powerusers to give up control.

[0] https://aws.amazon.com/blogs/aws/amazon-s3-block-public-acce...

Post reply on HN