How we spent $30k in Firebase in less than 72 hours

Re:How we spent $30k in Firebase in less than 72 hours by tgsovlerkhgsel on Wednesday August 01, 2018 @11:21PM (#17669037)

How do pay-as-you-go cloud providers handle DoS attacks (the "smart" ones that simulate a lot of expensive legit-looking traffic, not simple volumetric ones)?

That's the thing that terrifies me. If I'm using S3/Cloud Storage etc., I'm getting charged for each GB of outbound traffic, and I have to assume that the bandwidth available to serve my files is almost infinite.

[ Parent | on HN ]

Re:How we spent $30k in Firebase in less than 72 hours by bufferoverflow on Thursday August 02, 2018 @02:09AM (#17669539)

You should rate-limit and cache the potentially expensive paths of your app. There's no real way to protect against a clever DDoS, someone will have to eat the costs.

[ Parent | on HN ]

Re:How we spent $30k in Firebase in less than 72 hours by zwily on Thursday August 02, 2018 @08:33AM (#17670940)

You can’t really rate limit server-side with Firebase. If a client has read-permission on a data node, an attacker can just read from there as many times as they want.

There are some ways to limit writing using the rules engine but you’ll still get charged for failed writes. :)

Only real way to rate limit firebase that I know of is to put some sort of proxy service in between, but then you lose a lot of the advantage of using FB in the first place.

[ Parent | on HN ]