News for hackers. Stuff that matters.
Re:DigitalOcean App Platform by donmcronald on Tuesday October 06, 2020 @05:22PM (#24702460)
No. I don't think so.

The concern for me is a lack of hard limit on spending on GCP, Azure, and AWS. If I screw up and allocate a bunch of resources unintentionally, I'm left holding the bill. That's a terrible setup for PaaS because all programming involves mistakes eventually, especially for new users learning the system.

Granted, there are likely limits on accounts, but those are to protect the services from fraud, no to protect the user from overspending. The limits aren't well defined and it's not something you can rely on because MS might consider $10k / month a small account while it's a ton of money for me.

Azure customers have been asking for hard limits on spending for 8 [1] years with radio silence for the last 5.

There's a difference in goals I guess. If I spend more than expected I WANT things to break. Microsoft, Google, and Azure want me to spend unlimited amounts of money, even if I don't have it. At least AWS can be set up using a prepaid credit card so if I screw up they have to call me to collect their money and I negotiate.

1. https://feedback.azure.com/forums/170030-signup-and-billing/...

Re:DigitalOcean App Platform by ev1 on Tuesday October 06, 2020 @06:46PM (#24703268)
It's a difference in goals.

- Hobby kid doesn't want to overpay, shut everything down

- Business absolutely doesn't care about spend, if they get some kind of marketing result traffic spike they just want the site to stay up even if it blows the average budget

Guess which one they optimise for?

Re:DigitalOcean App Platform by bleepblorp on Tuesday October 06, 2020 @08:15PM (#24703988)
Very large businesses might not care about spend, but pretty much everyone else does.

Almost everyone will be unhappy if they're stuck with a six figure bill for non-converting visits because their site went viral. Everyone will be unhappy if they're stuck with a six figure bill because their site was used in a DDoS reflection attack, or got pwned and used in a DDoS attack directly.

Everything I run on nickle-and-dime-to-death cloud services, such as AWS, won't even respond to unauthenticated requests (Nginx return 444, or reachable only via Wireguard) precisely to mitigate this risk. To do anything else is just financially irresponsible.

I've even considered coding a kill switch that will shut down AWS instances if they exceed billing limits, but the fact that AWS charges a fee to check your spend via an API makes this awkward and speaks volumes about Amazon's motivations.

Amazon's refusal to offer spending caps on AWS benefits Amazon and only Amazon.

Re:DigitalOcean App Platform by mwarkentin on Tuesday October 06, 2020 @09:17PM (#24704332)
They have free anomaly detection on spending now (not sure how useful yet).
Re:DigitalOcean App Platform by FpUser on Tuesday October 06, 2020 @07:09PM (#24703514)
>"Business absolutely doesn't care about spend, if they get some kind of marketing result traffic spike they just want the site to stay up even if it blows the average budget"

While this statement can be true in some cases I vividly remember bosses of largish (budget wise company) running around like headless chickens yelling to kill every running instance of service just because they were hit by way more "success" that they've planned for.

Re:DigitalOcean App Platform by manigandham on Wednesday October 07, 2020 @01:52AM (#24705648)
Hard spend limits are not an easy problem with cloud. There are too many things that incur costs. Everytime this comes up, I ask the same question: what do you expect to happen when the quota is hit?

Shutdown your servers? Wipe your SSDs and storage buckets? Remove your DNS records? Should it be permanent? If not then they're just subsidizing the costs. If it's soft-limit then its just a warning, and if you just want a warning then billing alarms already exist in every cloud.

Also for most customers, the data and service is far more important than the cost. Bills can be negotiated or forgiven afterwards. Lost data and customers can't.

Re:DigitalOcean App Platform by imtringued on Wednesday October 07, 2020 @07:53AM (#24707275)
>Shutdown your servers? Wipe your SSDs and storage buckets? Remove your DNS records? Should it be permanent? If not then they're just subsidizing the costs. If it's soft-limit then its just a warning, and if you just want a warning then billing alarms already exist in every cloud.

You know. When I hit the storage limit of my SSD it doesn't wipe my data. It just ceases to store more data. When I rent a server for a fixed price and my service is under a DDOS attack then it will simply cease to work for the duration of the attack. If there is a variable service like lamba that charges per execution then lambda can simply cease to run my jobs.

You can neatly separate time based and usage based charges and set a limit for them separately. It doesn't even need to be a monetary limit, it could be a resource based limit. Every service would be limited to 0GB storage, 0GB RAM, 0 nodes, 0 queries, 0 api calls by default and you set the limit to whatever you want. AWS or Google Cloud could then calculate the maximum possible bill for the limits you have chosen. People will can then set their limits so that a surprise bill won't be significantly above their usual bill.

Your comment is lazy and not very creative. You're just throwing your hands up and pretending there is no other way even though cloud providers have created this situation for their own benefit.

Re:DigitalOcean App Platform by manigandham on Thursday October 08, 2020 @11:51PM (#24726622)
The vast majority of overages are due to user error. These errors would just be shifted to include quota mistakes, which can incur data or service loss. Usage limits might be softer than monetary limits which are bounded by the time dimension, but can still cause problems since they do not discriminate between good vs bad traffic.

Before you go around calling people lazy, I suggest you put more thought into why creating more options for people who are overwhelmed by options is generally not productive and can cause unintended consequences and expose liability. With some more thought, you'll also realize that AWS is optimized for businesses and, as stated, losing customers or data is much worse than paying a higher bill, which can always be negotiated after the fact.

Re:DigitalOcean App Platform by fauigerzigerk on Wednesday October 07, 2020 @04:13AM (#24706257)
I want all services to be rate limited. What I don't want is for some runaway process (whatever the cause) to bankrupt me before I can respond to any alerts (i.e within hours).

In other words, I don't necessarily need to set a hard spending limit, but I want to set a hard spending growth limit (allowing for short bursts), either directly in monetary terms or indirectly through rate limits on individual services.

Re:DigitalOcean App Platform by ngcc_hk on Wednesday October 07, 2020 @06:23AM (#24706840)
I avoid those for the sane reason. I do not mind to pay for a few dollars for side projects. But not unlimited bill.
Re:DigitalOcean App Platform by donmcronald on Wednesday October 07, 2020 @05:58AM (#24706715)
> Shutdown your servers? Wipe your SSDs and storage buckets? Remove your DNS records? Should it be permanent?

I'd be absolutely fine with that in a sub-account or resource group as long as I had to enable it.

A while back I wanted to try out an Azure Resource Manager template as part of learning something. Since I was _learning_ it, I wasn't 100% positive what it was going to do, but I knew that it should cost about $1 to deploy it.

With a hard limit on spending I would have set it to $10, run the thing and been ok with the account being wiped if I hit $10. Even $100 I could tolerate. Unlimited $$ was too risky for me, so I chickened out.

The worst part is I can't even delete my CC because it's tied to an expired trial that I can't update billing for.

> Also for most customers, the data and service is far more important than the cost.

So don't enable the hard limit.

Re:DigitalOcean App Platform by manigandham on Friday October 09, 2020 @10:48AM (#24730405)
Since the vast majority of errors are user error, this is just another potential disaster waiting to happen.
Re:DigitalOcean App Platform by user5994461 on Tuesday October 06, 2020 @06:51PM (#24703320)
Yes it can, if you consider hundreds of dollars a significant amount. I do.

A good article is around 50k visits. The most I've done was 300k over a few days of going viral on HN/reddit/twitter/other. I published some stats there https://thehftguy.com/2017/09/26/hitting-hacker-news-front-p...

Re:DigitalOcean App Platform by raphaelj on Wednesday October 07, 2020 @09:41AM (#24708057)
I can't agree more with that.

I run a small side business, and these unlimited cloud plans are just a no go. A medium to large company could totally absorb a 5 figures bill, but that would be a dead sentence to my side project. Also, considering the variable costs of bandwidth of AWS, Azure or Cloudflare, one competitor could simple rent an OVH server and incur insane costs to my business while only spending 1/10 of the money.

Right now, I'm using Heroku (with a limited number of dynos and a single PgSQL database) together with BunnyCDN (which allow me to pay for prepaid usage). If I ever get DDoS'ed, my app will most probably be inaccessible or at least significantly slower, while I'll receive an email alert, from which I can decide myself to allocate more resources.