News for hackers. Stuff that matters.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by sirwitti on Tuesday June 28, 2022 @12:04PM (#31909468)
I'm very much on the boring technology side of things with respect to hosting.

40€ / month gets you a very powerful dedicated server that can easily handle millions of requests per day and performs incredibly well and can be managed easily.

If you also use containers you even get quite a bit of flexibility and agility.

To be honest I don't really understand the sentiment that developers can get away with not knowing basic sysadmin stuff and at the same time have to spend relevant amounts of time, energy and money to get up to speed with cloud solutions, k8s and so on.

But then again, I'm not one of the cool kids...

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jjav on Tuesday June 28, 2022 @04:10PM (#31912408)
> To be honest I don't really understand the sentiment that developers can get away with not knowing basic sysadmin stuff and at the same time have to spend relevant amounts of time, energy and money to get up to speed with cloud solutions, k8s and so on.

Agreed. I hear some saying it's nice to deploy on a lambda because you don't need to know anything about the runtime environment. But it's never quite true. As you say, you do have to become an expert in all the intricacies of these proprietary deployment environments to get the best out of it and avoid getting burned. So an amount of effort has to be spent, anyway.

But the drawback is that now you spend this effort on learning what is after all a proprietary product of AWS. While AWS is massively popular, the knowledge doesn't translate to anywhere else so it locks you in. If you spent similar time learning the basics of Linux deployment and administration, your knowledge is lower level and more general.

But where it really gets you is when things go wrong and you need to dig deep to diagnose. Can I attach a debugger or watch socket traffic or run bpftrace or do any kind of diagnostics at all on that lambda instance? Oh sorry no, good luck.

Unless your budget is so low you can't afford a $5 VPS and your traffic is so low that your lambda bill will never reach $5, you're really better off deploying on a VPS that you control and can debug. Keep it simple.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by amerkhalid on Tuesday June 28, 2022 @10:33PM (#31915805)
> But the drawback is that now you spend this effort on learning what is after all a proprietary product of AWS. While AWS is massively popular, the knowledge doesn't translate to anywhere else so it locks you in. If you spent similar time learning the basics of Linux deployment and administration, your knowledge is lower level and more general.

Exactly, I learned Linux in late 90s. There are a few new softwares like nginx instead of Apache but I can bring up a new VPS and set it up using essentially same knowledge from late 90s. With a CDN and caching, you really do have a massively scalable service.

Don't get me wrong, I love Cloud but I will never use it for personal projects. It just feels like renting vs owning. My personal projects will have bugs, and I don't want to be on hook for thousands of dollars.

Learn Linux/Sysadmin once, and you can likely use that knowledge forever.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by GGO on Tuesday June 28, 2022 @05:20PM (#31913158)
Could not agree more. I have multiple VPS servers running for personal email, file storage, ci, and some side projects. Maintenance and management is really low - everything is backed up to S3 and if things go down, it will take an hour or so to restore it, but I can tolerate that kind of downtime as long as data is not lost. I think cloud platform is easier to sell once you need a robust HA.

As for performance, one of my projects can sustain 300rps which is more than enough. Sure it cannot scale automatically to thousands and millions but I don't think many projects have that requirements.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by zxcq544 on Wednesday June 29, 2022 @05:06AM (#31917893)
VISA has 2000 rps for all payment stuff. So it is what it is :)
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by majkinetor on Tuesday June 28, 2022 @05:36PM (#31913330)
I couldn't agree more.

On top of that, cloud tech can't be "set and forget" because of deprecation of apis and services.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by wizofaus on Tuesday June 28, 2022 @11:27PM (#31916129)
I'm sure we weren't the only ones bitten by that in the last few years, when AWS deprecated node 12 and then .NET core 2.1. Yes there were warning emails etc. and there's good reason to keep up with using the latest tools etc. where possible, but at some point you'd like to think "this component is stable, no need to touch it again".
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jpalomaki on Tuesday June 28, 2022 @12:55PM (#31910149)
Servers can also be liability. You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures, figure how to implement data encryption at rest, implement high-availability and so on.

Good platform-as-service can solve many things for you and let you focus on the core thing you are providing.

Obviously not everybody needs to worry so much about the stuff mentioned above. If you are providing SaaS solution, there’s a good chance some customer will start asking these questions as part of their procurement process.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by rollcat on Tuesday June 28, 2022 @03:13PM (#31911813)
I agree with you in general, that it's best not to solve problems you don't have, but it's worth considering what exactly do the alternatives offer, as you might end up trading one kind of complexity or maintenance burden for another.

Fixed workload, shared dev boxes, all kinds of small-scale operations fit very well onto a bare metal / VPS box in someone else's rack. The maintenance work often boils down to setting up cron with unattended upgrades and borgbackup, Docker with Traefik+ACME as the web frontend, etc.

PaaS solutions will often pull you in the direction of getting "addons" or using extra paid services for every component you might need: a relational database, a cache, a queue, a load balancer... Which are usually a very good call if you need to scale up, but which could've all been entries in your docker-compose.yml if that's all you needed.

Most importantly, and regardless of your hosting strategy, you can't just dismiss security, disaster recovery, or capacity planning. Clouds have outages and bottlenecks too, and no product can save you from human error.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by drdaeman on Tuesday June 28, 2022 @03:49PM (#31912184)
> You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures, figure how to implement data encryption at rest, implement high-availability and so on.

Hey, that's not exactly a correct comparison. You don't simply get half of those in the cloud either. Log monitoring and disaster recovery is something you have to figure out yourself, the best clouds have are some foundations to build upon, and possibly - some cookiecutter template that might fit your use case (if you're really lucky it'll even be decent). And you can get same stuff on traditional servers, just with different pre-baked solutions (which also may or may not fit a particular use case and may vary from perfectly good to quite crappy).

People love to brag about all the features (most not needed for your casual website), but somehow no one tells the fact that those features just won't be there when you'll start to use the cloud - because you have to be actively aware that you need them, explicitly enable some, and explicitly spend time learning, setting up and testing others. Unless we're talking about PaaS (and not a "classic" cloud like AWS, GCP or Azure), you still need someone with some sysadmin experience - except that this person must wear a different kind of sweater (with $Cloud logo rather than Tux or Beastie).

All you get is some hardening an OS + managed software (like LB servers and databases) patching. Which is something that's not that hard to do on a self-managed server (well, the software updates part; hardening is a rabbit hole). But not application patching, mind you - that's your responsibility to maintain your app, the very best it can do is to run a security audit (which you can get as a service separately). And even though managed databases are tuned (still a lot of manual tuning to do if you want the engine to truly purr) and maintained they aren't all that fun and peaches the marketing materials say - sometimes you just have to e.g. spin up your own self-hosted PostgreSQL to perform the tricky migration, then replicate it back to a managed solution.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by masukomi on Tuesday June 28, 2022 @03:35PM (#31912034)
> You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures...

There are many hosts out there who will take care of _all_ of that for you. You just need to install your stuff on the box, and they take care of the rest. Logs and monitoring... you'll prolly want something custom anyway rather than whatever anyone else offers.

> figure how to implement data encryption at rest,

you have to do that anyway

> implement high-availability and so on

again, many hosts who provide easy ways to manage that for you.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by icedchai on Tuesday June 28, 2022 @04:37PM (#31912712)
You'd be surprised. I've worked at many startups and mid-sized companies. You don't actually "need" to do most of those things. I've did a consulting job for a company with 100's of millions in revenue that didn't patch its servers for years. One had a 1400 day uptime!
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by drdaeman on Tuesday June 28, 2022 @04:53PM (#31912874)
> didn't patch its servers for years. One had a 1400 day uptime

Well, this isn't exactly the best practice to follow - but, yes, this is very common, and it works (until someone finds that there's a vulnerability to exploit). So, from a purely practical perspective - software updates are certainly not a hard requirement, one can do quite well without them (just be aware about the risks).

Anyway, there are many fairly age-tested solutions for updating software on the fly, live kernel patching and live network sockets included.

And a lot of cloud software updates (e.g. managed databases) incur noticeable downtime so you need a failover (and appropriate software design that can survive it). But then you can do the very same thing with two servers, no cloud magic necessary.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by manishsharan on Tuesday June 28, 2022 @07:02PM (#31914231)
Hardening servers isn't as hard as it used to be. Ansible does a pretty good job and there are several examples of using it to harden your server. If you are using a VPS .. you could use packer and start with a fleet of servers based on your custom image.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by drdaeman on Wednesday June 29, 2022 @03:16AM (#31917354)
Oh, I don't disagree, I just meant it can be as complex as you want it to be. Hardening is just a rabbit hole that can go on almost forever - it's never really final until you declare that enough is enough, typically there's always something more one can do, if they have time and capacity.

Also, out-of-box distributions those days can be said to be already "hardened" compared to what we had 15 years ago.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by davidfstr on Tuesday June 28, 2022 @03:05PM (#31911734)
> Servers can also be liability. You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, […], have backup and disaster recovery procedures, regularly test the procedures, […] and so on.

Much of this complexity I eliminate by using the Immutable Server pattern:

Specifically I deploy my app as a Docker container hosted on a virtual machine cluster managed by AWS ElasticBeanstalk. OS upgrades and patches (outside the container) are done by AWS.

If anything goes wrong with a VM I just terminate it and a different fresh VM spins up to take its place.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by huksley on Tuesday June 28, 2022 @03:52PM (#31912205)
This is that I was thinking doing also - switch to using Elastic Beanstalk.

What do you do if you need to launch another instance of the app? For staging or testing.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jsiepkes on Tuesday June 28, 2022 @01:04PM (#31910269)
I'd rather worry about (and fix) those technical problems then having to deal with possible billing-pocalyse.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by folkhack on Tuesday June 28, 2022 @01:43PM (#31910701)
Also the cost of those services vs. a few well-configured basic VPS hosts is nuts. I was shocked to learn that to get MySQL/Postgres in GCP it's often >$40/month - even for the insanely tiny instance sizes. We're talking for like 20G storage...

In contrast I've ran some pretty hot-and-heavy MySQL/Postgres databases on basic DO/Linode VPS's for half of that cost with much success. I get these cloud tools give a ton of "out of box" features - but you are paying for it at the end of the day.

Anecdotally I've noticed a huge shift away from general devs/engineers having general CLI/Linux/sysadmin knowledge.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by turtlebits on Tuesday June 28, 2022 @02:23PM (#31911170)
If you had no knowledge on standing up a DB server (installing, configuring, monitoring, logging, access control, and backups, restricting network access), how much time would that take you to learn? That and your VPS requires setup for access control, patches, updates, monitoring, logging.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by folkhack on Tuesday June 28, 2022 @02:40PM (#31911375)
Point taken, upvote given, but for a lot of people standing up a standard redundant DB config for MySQL and Postgres isn't that big of a deal.

I say this as an engineer who has a ton of relational DB experience. Before cloud providers w/DB options were so plentiful devs/engineers/sysadmins would have to set this up by hand.

---

> If you had no knowledge on standing up a DB server

My point is, "but yea what if you do?" There's actual value in that I've found, especially when I'm looking to save pennies at the early-stage of a startup while in the customer aq phase. Many folks have expertise in those areas without needing a cloud provider.

I do get the "but all of these things!" argument (access control, patches, updates, monitoring, logging) but often those are easily solved/solvable problems even without leveraging cloud offerings. I can get very far along with an ELK/TIG stack + uptime robot and basic VPS networking features... all for a very affordable monthly bill on the infra.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by fartcannon on Tuesday June 28, 2022 @04:11PM (#31912419)
Starting a db on a web-server and running apt update/upgrade are fundamental parts of working on the web.

If you or any of your developers don't know how to do that, you/they should seriously seriously spend the 40 minutes it takes to learn.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by moreira on Tuesday June 28, 2022 @05:55PM (#31913562)
I feel like that’s where you separate the pre-cloud and post-cloud devs.

It’s not hard to imagine a dev being brought up 5 years ago into a React world, with JS in the backend and something like Vercel or Netlify to deploy their app.

Someone like that might be entirely uncomfortable when dumped into a plain old Linux server, and would definitely take longer than 40 minutes to even get their head wrapped around what’s going on.

That’s not a knock on them - they get their job done, and to the business that’s all that matters. But yeah, just trying to, I don’t even know, empathise? Try to understand? Who knows. It’s just a different world now.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by fartcannon on Tuesday June 28, 2022 @07:06PM (#31914265)
Symapthy, is more like it. Theyve been convinced by the cloud rental services that it's different now and too hard, when it's really not because all that SaaS is still running on a webserver. There's just a new gate keeper with a huge marketing budget that charges by the minute now.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by justsomehnguy on Wednesday June 29, 2022 @04:49AM (#31917813)
> and would definitely take longer than 40 minutes to even get their head wrapped around what’s going on.

If a grown up person (who is presumably making a good money in their React/JS thing) can't figure on how to install a web server in 40 minutes (with all SO, Google and a bazillion of articles on how to do so) then...

Like come on, twenty years ago you still needed to get your ass off the chair and go to the bookstore, find and buy a proper book and actually read it. Now you just need to type "Ubuntu 20 install webserver" in to the search and voila.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by justsomehnguy on Wednesday June 29, 2022 @04:44AM (#31917794)
The same amount of time if I would need to "stand up" a rented DB, including figuring out a bazillion of providers and options, configuring proper instance sizes, turning needed knobs for backups to work... Or you suppose what a rented service doesn't need anything at all?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @03:22PM (#31911896)
Serverless is almost always a trivial cost compared to VPS. With lambda, you get like 1M free invocations per month and the price per ms is `$0.0000000017` for 128MB on ARM.

If your endpoint takes 10ms to run and you're running it constantly for a month, it will cost you less than $0.05 (it will actually be about half of that because you get the first 1M invocations free each month, but ignoring that...).

As you point out, running RDS is more expensive, but RDS isn't serverless. You would probably want to look at DynamoDB for a serverless database, which is considerably more affordable than RDS.

Moreover, the serverless stuff is considerably easier to configure and operate than a VM.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by icedchai on Tuesday June 28, 2022 @04:43PM (#31912761)
A 10ms invocation sounds like a myth. I've certainly never seen one that low for a lambda that actually does anything. All the serverless stuff I've worked with (mostly in Python) operates slower than a CGI script. 100's of milliseconds minimum. When your serverless endpoint needs to integrate with other AWS services, the configuration can get complicated fast. VPC endpoints, IAM roles, security groups... it goes on and on.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @04:55PM (#31912894)
If your lambda runs very infrequently, you'll see more cold starts which will take hundreds of ms, but warm starts are pretty easily in the single-digit milliseconds (at least for a Go lambda). If you're doing a bunch of compute or sync I/O in a loop then your functions will take longer.

But less frequent invocations are actually an even better case for Lambda versus a VPS because it suggests less wasted time (yeah, you have to pay for cold starts, but with a VPS you're paying for all of that time your service is up irrespective of whether or not it's being used).

> 100's of milliseconds minimum. When your serverless endpoint needs to integrate with other AWS services, the configuration can get complicated fast. VPC endpoints, IAM roles, security groups... it goes on and on.

This is all true for a VPS as well. Assuming you care about reliability, you need to run multiple instances of your VPS behind a load balancer which implies a fair bit of networking. Moreover, you need to manage the hosts themselves, so configuring log aggregation, metrics collection, process management, SSH, deployment, hardening, etc, etc, etc.

Further still, your compute will need to communicate with the comparable services as in your lambda hypothetical, so you still need to deal with IAM and some more networking stuff. Maybe you'd say "gotcha! I would just run my databases on my VPS instances!" which is cool, but now you need to configure monitoring, backups, replication, failover, and so on for your databases versus using DynamoDB (and I would bet a lambda/dynamodb workload than the same workload on a reliable VPS/whatever-database stack).

Of course, if you're running a hobby blog or something that doesn't need reliability of scalability, then a $5 VPS is probably fine (maybe even an S3 bucket behind a CloudFront distribution, which would likely be free).

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by icedchai on Tuesday June 28, 2022 @08:56PM (#31915172)
Yes, cold starts are definitely a problem. One of the advantages of VPSes is its all hot, ready to go, obviously. You pay for that performance, for that lower latency, and I'm fine with that.

My big problem with lambda / serverless is the developer experience is pretty awful. The time between making a change, deploying, and seeing the result of that change is slow. You can work around this (with tools like localstack), but it's often not close enough to the real environment. You'll still waste tons of time debugging permissions issues when you do a real deploy.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @11:35PM (#31916181)
Yeah, it depends on the application. If you're very latency sensitive, then you'll probably want to keep your lambda warm or just pay more for VPS. But the original context was cost, not latency.

> My big problem with lambda / serverless is the developer experience is pretty awful. The time between making a change, deploying, and seeing the result of that change is slow. You can work around this (with tools like localstack), but it's often not close enough to the real environment. You'll still waste tons of time debugging permissions issues when you do a real deploy.

I haven't had much of a problem. Once I figure out the shape of the inbound payload, it's pretty easy to test locally. I can't think of any reason the runtime environment would be an issue. Debugging IAM is tedious, but I just created one Terraform module that I use for all of my functions so I don't have to slog through the IAM stuff every time I make a function.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by icedchai on Wednesday June 29, 2022 @09:03AM (#31919540)
I personally have not had a lot of problems with local lambda development. However, when assisting coworkers, I often see problems where dependencies aren't packaged properly (lambda layers), permissions are missing, code is not properly modularized (everything in one big handler file), people editing code live on AWS to debug problems they can't replicate locally, etc.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by folkhack on Tuesday June 28, 2022 @04:11PM (#31912425)
> Moreover, the serverless stuff is considerably easier to configure and operate than a VM.

Yep - and to be 100% candid on my current project I'm running 100% with GCP Functions, AppEngine Task Queues, and Firestore for persistence. I'm also AWS certified and have worked as a DevOps engineer in a PCI-regulated environment leveraging things like DyanmoDB, Lambda, etc.

Cool part about running that way is my current billing is near zilch. Woo! Totally on-board with what you're saying... literally living it now =)

I'm just saying that there's a ton of ways to skin a cat. And, personally I wouldn't paint with as large of a brush to say "serverless stuff is considerably easier to configure and operate than a VM." A lot of times this rings true, but I anecdotally wouldn't say it is always the case.

I'm being pedantic, but I'm also trying to make a case that not always do cloud design patterns/"best-practices" make sense.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jjav on Tuesday June 28, 2022 @04:21PM (#31912523)
> Serverless is almost always a trivial cost compared to VPS.

Not my experience. Our AWS lambda cost is close to $1K/month and the usage isn't that much so we could easily host this on a few (for redundancy) of the smallish VPS instances for far less money.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @05:17PM (#31913130)
For batch workloads (not latency sensitive, can run at or near full capacity, etc), but most of the time Lambda is more affordable. You'll need to say more about your workload though.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jpalomaki on Tuesday June 28, 2022 @01:37PM (#31910650)
Take for example OS and app upgrades. Quite often you have few requirements, for example 1)all updates should be first tested in test env 2)updates need to be installed in timely manner 3)critical updates need to be installed quickly (30 days is too slow)

When you start thinking these, they are not so easy. (1) means you can’t just run “apt upgrade” on every server - you need to manage the updates to make sure they get tested first. (2) is kind of ok, but requires some work on regular basis (at least checking things) (3) means you need to monitor the updates for your stack and classify them. You can get feeds for example for Ubuntu, but does that cover whole stack. And checking these weekly (or daily) actually gets boring.

All this stuff can be done, but IMHO it is time consuming and takes time from more important things. The weekly/monthly JIRA tickets for checking x, y and z get quite annoying when you also have n other things to finish. Then you start slacking on them and feel the pain when trying to collect evidence for the next procurement process check.

If you have tens or hundreds of servers and can have a separate infra team with professional sysadmins then this is all fine. My rant is mainly for small teams, where same guys are supposed to develop and run things.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by wooque on Tuesday June 28, 2022 @02:17PM (#31911106)
Small teams should just configure apt unattended upgrades and call it a day. I do this with my personal server and haven't had any issues for years.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by remram on Tuesday June 28, 2022 @07:43PM (#31914561)
You should probably reboot it then.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by ImPostingOnHN on Tuesday June 28, 2022 @03:40PM (#31912088)
I'd rather have to to plan and budget than have to deal with patching (after testing the patch) every piece of software on a system the moment a patch comes out to avoid an undetectable rootkit being installed during that gap
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @02:45PM (#31911449)
An occasional $4K charge is negligible for a business (almost everyone is better off dealing with this sort of overrun than troubleshooting servers, all else equal), and anyway this is a particularity of AWS CloudFront's billing protections rather than a fundamental flaw with serverless.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by ggktk on Tuesday June 28, 2022 @05:03PM (#31912988)
In most countries in the world, $4K charge is absolutely not negligible.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @05:22PM (#31913182)
I doubt this is true. If you're operating a tech company anywhere in the world, I'm guessing $4K is pretty close to negligible. In whatever case, indexing by country is misleading, "tech companies" in general is more interesting, if there are a handful of tech companies in the third world for which this doesn't hold, it doesn't invalidate the generalization.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jsiepkes on Wednesday June 29, 2022 @08:44AM (#31919365)
In SMB companies around the world "an occasional $4K charge" is definitely not negliable.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Wednesday June 29, 2022 @09:45AM (#31920014)
Again, we’re not talking about SMBs, we’re talking about tech companies generally. (What share of SMBs are there doing serverless or with any cloud footprint at all?)
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cft on Tuesday June 28, 2022 @01:27PM (#31910512)
I ran a website with 37 million users and 3.6Gbps peak bandwidth (JavaScript+thumbnails, no video) from my own two racks of Linux servers thay i have not systematically updated for years. The OSes were beyond the lts support winows. I manually compiled my own updates, but very rarely and only those that i deemed critical. Granted, the site stack was completely custom so the standard automated hacks didn't work. In 15 years there were no accidents.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by booi on Tuesday June 28, 2022 @01:51PM (#31910782)
I dont think this should be standard. It sounds like you’re saying you ran a service with 37 million people’s information on a software stack that was so old that not even the vendor is supporting it anymore and could be riddled with security issues that you wouldn’t even know much less be able to detect? It may work but certainly not going to get any security certifications this way..
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cft on Tuesday June 28, 2022 @01:57PM (#31910861)
I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a lot of monetary sense. We would also have lost our merchant accounts very quickly (although CC numbers were not stored, only MD5s, but i suppose they could have been captured from the application's memory after TLS decryption but before MD5 hashing, although this would have been a difficult task even on a rooted server). I am 99.999% confident by observing and recording loads, traffic, logs and other parameters of all servers that there were no intrusions. I understand that there's market size and appeal for bureaucracy and certifications, but i have my own data.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by krallja on Tuesday June 28, 2022 @09:28PM (#31915399)
MD5(CC#) is trivially reversed, so I hope that’s not what you were doing.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by booi on Sunday July 03, 2022 @11:53PM (#31973337)
Omg. cft should not be allowed anywhere near credit card numbers.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Fnoord on Tuesday June 28, 2022 @02:11PM (#31911036)
Do you save logs? If yes, there's your PII.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cft on Tuesday June 28, 2022 @02:19PM (#31911128)
Thankfully, the servers were not in Europe! I said "hardly". It's genuinely amusing how people downvote facts, simply because they don't fit the zeitgeist.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Fnoord on Tuesday June 28, 2022 @06:13PM (#31913766)
Nobody mentioned Europe, except you. If you are referring to GDPR this still applies if you host outside of Europe.

We disagree webserver logs contain 'hardly any PII'. You may find it insignificant PII, but it does not constitute 'hardly'. IMO its a circumstantial goldmine.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cft on Wednesday June 29, 2022 @06:32PM (#31926508)
In the US at least one court found that IPs were not PII

https://www.huntonprivacyblog.com/2009/07/10/washington-cour...

I am curious who "we" are- a royal plural?

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Fnoord on Thursday June 30, 2022 @04:24AM (#31929975)
And in EU, it is.

We referred to you and me.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by TurningCanadian on Tuesday June 28, 2022 @02:27PM (#31911218)
Not to mention that a successful compromise could be used to serve malware to the users.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Fnoord on Tuesday June 28, 2022 @02:10PM (#31911022)
With unattended-upgrades you might get away with such behavior. Also, spme webservers have a great track record. Then its the question if your other services are secure, and your JS/CSS.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cft on Tuesday June 28, 2022 @02:21PM (#31911155)
Nginx and apache (upgraded from 2.2 to 2.4 once)
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tete on Tuesday June 28, 2022 @06:03PM (#31913659)
> Servers can also be liability. You need to document, implement and maintaing hardening, have a process for regularly patching os and apps, monitor logs, have backup and disaster recovery procedures, regularly test the procedures, figure how to implement data encryption at rest, implement high-availability and so on.

That is true.

> Good platform-as-service can solve many things for you and let you focus on the core thing you are providing.

I don't see how with platform-as-a-service solutions you can skip documentation, maintenance, log monitoring, disaster recovery, backups, test procedures, or encryption at rest.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by asddubs on Tuesday June 28, 2022 @02:49PM (#31911504)
you can get servers with managed hosting, still at a fixed rate each month
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by kif on Tuesday June 28, 2022 @12:59PM (#31910194)
Reading some replies here, it’s no wonder some startups go bankrupt while investing so much in infrastructure — all while not having enough users to justify more than a single dedicated server.

Scalability should be the last thing in mind if your product sucks.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cortesoft on Tuesday June 28, 2022 @03:29PM (#31911976)
My frustration with replies like this one is assuming that everyone here is working on personal projects or at tiny startups trying to get users.

A lot of us work at big companies with lots of users and demand and aren't just making POCs, but every time we bring up scaling or maintenance or monitoring we are told not to worry about that yet.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by foepys on Tuesday June 28, 2022 @04:07PM (#31912373)
Why should you be worried about large bills if you are working at a big company?

This whole Tell HN is about personal projects where costs matter, the startup tangent here is just a jab at people underestimating the raw processing power of modern hardware.

Big corps can do what big corps do with their big corp money. 200 user startups don't necessarily have hate kind of money but pretend they will be big corp very soon and thus need to spend big corp money.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by sirwitti on Wednesday June 29, 2022 @03:16AM (#31917355)
Fair point. If your usecase actually needs to be able to handle massive loads, then things might be different.

But then there will probably needs to be a devops team and careful planning how to architect infrastructure anyway.

Also in such cases cloud pricing becomes prohibitively expensive unless you get a special deal.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jlmorton on Tuesday June 28, 2022 @01:37PM (#31910644)
I'm a fan of boring technology too, but I would like to suggest to you that Serverless _is_ kind of boring.

Essentially you just upload a ZIP of your application, and register a handler function that takes a JSON payload.

Obviously this is quite a bit more boring than a K8s cluster, with a bunch of nodes, networking, Helm charts, etc.

I would posit that even compared to something like a DO Droplet, Serverless is still kind of boring. Everything is going to fit into the model of registering a handler function to accept a JSON payload. There's no debate about whether we're going to have Nginx, or what USGI runtime we're using. It's just a function.

And with Serverless, your cost for doing a couple million, 2-second-long requests is about four cents.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jjav on Tuesday June 28, 2022 @04:25PM (#31912577)
> I would like to suggest to you that Serverless _is_ kind of boring

It's not my kind of boring, although I sort of see what you're saying.

It presents a simple facade, but it's built on complex infrastructure you have no way to have any visibility into. So when things go wrong it's a nightmare.

To me boring tech means super simple, KISS to the extreme. Something I can diagnose fully when necessary without any layers of complexity (let alone proprietary complexity I can't access) standing in the way.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by gkapur on Tuesday June 28, 2022 @01:59PM (#31910883)
The challenge with serverless is building systems that rely on more complex backend processes and existing code and doing things like testing using most of an existing codebase. Serverless is great for nodejs/javascript stacks that are database and front-end heavy but don't need more complexity like queueing, event streaming, or more complex architectures. Then serverless becomes a huge mess normally and the developer experience becomes a giant catastrophe, as well.

Here the OP kind of got caught by the terrible DX that is almost natural to serverless IMO.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by bilalq on Tuesday June 28, 2022 @05:35PM (#31913320)
I'd argue serverless handles those cases even better. SQS for queueing and Kinesis for streaming have you pretty much covered. Much easier to manage those than setting up a fleet of workers that are all long polling for messages and managing heartbeat signals or routing to a DLQ manually.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tomcam on Tuesday June 28, 2022 @04:06PM (#31912365)
DX? Does that mean Developer Experience?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by bilekas on Tuesday June 28, 2022 @01:50PM (#31910779)
> your cost for doing a couple million, 2-second-long requests is about four cents.

This seems wrong to me ? Can you explain a bit more ? Are these just API requests or ?

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jlmorton on Tuesday June 28, 2022 @01:56PM (#31910844)
It's admittedly a simplification and a best case. For AWS Lambda, the price is in GB-seconds, and the amount of CPU available to your function is itself a function of the memory allocated.

The price is $0.0000166667 for every GB-second on X86. So it looks like I've also misplaced a decimal. It's $0.20 per 1M requests with 1GB of memory.

Lambdas can be sized from 128MB to 10GB, and pricing depends on the resources allotted.

Ultimately, this pricing just represents the compute time for a function to complete. That function can do whatever it wants.

There are additional costs to put an API Gateway in front of it, for instance, to make it a publicly accessible API.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by stevewatson301 on Tuesday June 28, 2022 @02:08PM (#31910994)
Lambda function endpoints[1] are a replacement for some use cases.

[1] https://aws.amazon.com/blogs/aws/announcing-aws-lambda-funct...

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by refulgentis on Tuesday June 28, 2022 @02:45PM (#31911450)
I'm not day to day on cloud stuff, haven't been in a while, that's why I'm asking this, not intended to be passive-aggressive:

So if I had a "hello world" function, that basically just returned a constant JSON payload...I'm seriously looking at a pittance, pennies for millions of requests? I.e. $0.20?

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by NorwegianDude on Wednesday June 29, 2022 @01:30AM (#31916805)
No. You would also have to pay for memory usage and bandwidth.

Millions of requests for a static file is easily done on a dedicated server in a few seconds if the file is small. $0.2 per request is very expensive.

To put things in to perspective: If you buy a very cheap new server for $1K, then you would be able to handle small static requests worth thousands for dollars each day according to AWS pricing. That's a nice return on investment!

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by detaro on Tuesday June 28, 2022 @02:54PM (#31911595)
yes.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by NorwegianDude on Wednesday June 29, 2022 @01:16AM (#31916722)
It's not $0.20 per 1M 1 second request with 1G memory. It's $16.87, and $33.53 for the 2 seconds you mentioned in your parent post.

It's $0.20 per request, without memory.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by vorticalbox on Tuesday June 28, 2022 @02:48PM (#31911486)
Also s3 costs for storing the lambda function code, dependencies and that functions past versions.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by huksley on Tuesday June 28, 2022 @03:55PM (#31912235)
Exactly! If you make your app compatible with serverless by following some restrictions, deployment is pretty boring.

In my opinion, it is easier to switch from serverless pattern to VM instances, and much more difficult to switch from VM to serverless without a major rewrite.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by that_guy_iain on Tuesday June 28, 2022 @04:19PM (#31912499)
I literally benchmarked an application I've written on a €34 euro dedicated server to 480 requests per second. Which comes out at 1,244,160,000 requests per month. If I ever reach a level anywhere near that renting a few more to provide reliability and failover would again be reasonably cheap.

This all comes while keeping the data on servers belonging to EU companies. Using Cloud servers is rather dodgy as shown by the fact Google Analytics, Google Fonts, etc are all illegal.

Everyone keeps talking about the ease of just getting a new server and not having to spend time repairing servers. This is an over sold problem. How often have we ever dealt with hardware problems 8-10 years ago? I only remember one server going down because of hardware issues that cause problems all the other times there were failover servers and the hardware issues were fixed by datacentre staff before anyone even noticed there was an issue in the first place. With tools like ansible and chef, you can provision a new server super quickly so even if the server gets a corrupt configure of whatever, you can just wipe the server and rebuild.

Most of us are not at the scale where we would realsitically see the benefits of cloud computing for hosting.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by shepardrtc on Tuesday June 28, 2022 @12:22PM (#31909716)
> To be honest I don't really understand the sentiment that developers can get away with not knowing basic sysadmin stuff and at the same time have to spend relevant amounts of time, energy and money to get up to speed with cloud solutions, k8s and so on.

There was a thread here the other day on how DevOps has failed. And this should hopefully show everyone why DevOps is needed. Cloud infrastructure is complex and needs specialists, otherwise simple mistakes can be very costly. If I make a new lambda, you better believe I'm watching invocations.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by jvanderbot on Tuesday June 28, 2022 @12:55PM (#31910154)
Or does it? The whole point of GP is that you don't need the complexity that would require devops staff to manage if you are not serving > 10s of millions of reqs in huge bursts with long stretches of dead time between.

I don't know, I'm curious about the actual requirements vs the marketing buy-in and resume building that may happen when designing the system.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by itsmemattchung on Tuesday June 28, 2022 @01:33PM (#31910609)
Amen.

I've consulted for companies that went all in on AWS Lambda + AWS SQS, only to transition them to an EC2 instance that performs the same computations at a fraction of the cost.

No — you do not need K8 on day one.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by folkhack on Tuesday June 28, 2022 @01:59PM (#31910891)
> EC2 instance that performs the same computations at a fraction of the cost

And typically with much lower latency/request times.

GCP functions, AWS Lambdas, etc... my anecdotal experience is that they are way slower for request times vs a $20 VPS running the exact same workload.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tick_tock_tick on Tuesday June 28, 2022 @06:21PM (#31913844)
But managed K8s is so easy to setup and makes life and the development cycle so much easier you're basically robbing yourself if you don't.

I assume you just dropped a shit ton of features on your move to that EC2 instance unless of course you wasted more time then it would take to get everything working better on Lambda/SQS.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by itsmemattchung on Wednesday June 29, 2022 @09:11AM (#31919611)
The actual compute is decoupled from the CI/CD pipeline. Moving to an EC2 instance does not preclude us from leveraging Lambda and other technologies.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by nousermane on Wednesday June 29, 2022 @12:59AM (#31916647)
> easily handle millions of requests per day

Yes. People don't realize how little that is. Million requests per day is 12 requests per second, on average. Even if we factor in peak load at 20x that, it is still well within reach of exceptionally modest hardware, assuming at least vaguely sane software stack.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Keyframe on Tuesday June 28, 2022 @12:07PM (#31909515)
Yeah, but how will you scale up your multi-dozen-users-at-the-same-time app easily then?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by aeturnum on Tuesday June 28, 2022 @01:01PM (#31910232)
Scaling is a hard problem. I've worked at places where we used a whole network of auto-scaleable services and guess what - you will still have problems. Each managed service has tradeoffs, often ones that you only encounter once you'd made a substantial commitment to that service. There is no free lunch and you're fooling yourself if you think there is one.

Often you get lucky and the cluster of managed services you select happen to scale along the metrics of your resource use. Many people's resource use patterns are similar and the managed service people take advantage of that. This is nice! But it's a trade for downside risk: you may find that your resource use patterns differ from the 90% case and your spend goes up very fast or your scaling hits a wall.

In my experience a lot of designing a service architecture is picking where you want your complexity. Services (in or out of containers) running on VMs have a simple billing and architectural model. In my experience they form a good basis to organize your other resources around and are a good foundation to grow from.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by ecshafer on Tuesday June 28, 2022 @02:14PM (#31911069)
I think this is a joke people missed. Surely scaling multi-dozen-users-at-the-same-time was obvious enough that people didn't start talk about scaling seriously, but that's what happened.

If you app has multi-dozen users, and needs to "scale" something is wrong.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Keyframe on Tuesday June 28, 2022 @05:27PM (#31913234)
Yeah, my joke didn't scale well. We did well with servers (sans cloud) and comolex apps before.. something changed in collective mindset in the meantime.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Nextgrid on Tuesday June 28, 2022 @01:06PM (#31910292)
How do you scale your cloud app?

Usually, the hard part of scaling isn't raw compute power, it's scaling your datastore after you've already exhausted the option of throwing more compute power at it, and this problem remains whether you're on the cloud or not.

Until you hit that problem however, throwing more hardware at it is the right solution (you may be surprised just how much load a single Postgres server on bare-metal can handle).

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by eropple on Tuesday June 28, 2022 @01:37PM (#31910643)
I agree with this in general, but would caveat that AWS etc. have made throwing more hardware at the datastore solution a lot easier. You're right that a bare-metal Postgres monster can serve a lot--but Aurora Serverless V2, if you can live with its (pretty mild IMO) quirks and if you can pay for it, is a profoundly hard-to-argue-with offering.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by salawat on Tuesday June 28, 2022 @12:16PM (#31909638)
Buy more servers, loadbalance, and don't take the short painful route architecture-wise?

It isn't really that hard.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by valbaca on Tuesday June 28, 2022 @12:23PM (#31909726)
Can't wait to end my next system design with "just buy more servers. scaling isn't really that hard."
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by grogenaut on Tuesday June 28, 2022 @01:00PM (#31910224)
I've done exactly this in many meetings. It's a balance between infra costs and dev time optimizing spend. Typically ping pongs back and forth.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by devmor on Tuesday June 28, 2022 @12:26PM (#31909764)
There is a point where that becomes exponentially prohibitively expensive.

At a former startup where I worked as senior engineer, that was our original approach. Then one weekend we tripled our userbase and horizontally scaling required massive changes in database architecture, sharding solutions, etc.

"Just buy more servers and load balance" is the short painful route. Carefully planning out and taking advantage of scalable architecture that can be provided to you less expensively because it too, runs at scale is the hard method. The fact that its easy to shoot yourself in the foot with it doesn't make it the easy route.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by salawat on Wednesday June 29, 2022 @07:30AM (#31918743)
>Then one weekend we tripled our userbase and horizontally scaling required massive changes in database architecture, sharding solutions, etc.

You took the short easy route out of the gate instead of building for what you were planning to handle. This is the opposite of what I espouse. If you were going about it my way, you build that in from the ground up. Harder and a bit bumpier to roll out from the get go, but has worked well for me in the past.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by devmor on Wednesday June 29, 2022 @01:21PM (#31923086)
If you want to spend capital for an unpredictable eventuality that may never pass over taking advantage of another company's investment to scale cost... sure, that's definitely the hard route.

I wouldn't call it "good" or "intelligent", but it's definitely hard.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by bilekas on Tuesday June 28, 2022 @01:48PM (#31910755)
This. The company I work for use AWS and that makes sense for the level they scale at etc and I'm sure they work out a deal with Amazon.

I have a few dedicated servers monthly cost ~100$, never ran into any problems, for a brief period I needed to pay cloudflare for some dns management that was getting a bit heavy, but even that was because I didn't know enough as to how to optimize.

For any personal projects etc / POC's even startups launching to less than 100k daily users (traffic and load type dependant ofc) hold off on the AWS>

I also don't like the lambda architecture in AWS as it seems to lock you into it in a sense, you're almost tied to that infrastructure for good. Yes you can rework it but thats tech debt that may not be possible.

Love AWS but only as an enterprise solution.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @12:15PM (#31909629)
You're going to understand where the cool kids come from once your single dedicated server goes down or can't handle the load any more. As soon as you try to scale horizontally or become highly available and start to think about how to do it you end up falling into the same rabbit hole.

> If you also use containers you even get quite a bit of flexibility and agility.

Yeah... and then the only difference is between a single host and multiple hosts. Guess which one Kubernetes is for?

With all due respect and no offense intended, your perspective sounds a lot like "I've never attempted to scale so I can't understand the problems"

> can get away with not knowing basic sysadmin stuff

I promise you that the knowledge you need for your single dedicated server is also needed for k8s clusters, and I definitely can't imagine anyone who can maintain a k8s cluster but can't maintain a single linux host. It's more like that scaling horizontally comes with exponentially more difficult problems than what you're used to or have heard of.

Obviously the billing is an issue but that doesn't negate the whole concept. They should definitely implement better expense controls. A simple hard cap to activate if you want would fix this for good.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by zamadatix on Tuesday June 28, 2022 @12:37PM (#31909925)
For 99% of projects you're never going to hit the point a single server (or group of servers if you truly need redundancy for some level of uptime) can't handle the load. For the other 1% that end up needing that scale I have a hard time accepting it's actually better to start building for massive scale day 1 instead of day 1000.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @12:47PM (#31910053)
This is such a narrow perspective. It’s not always about load, most applications can benefit from some level of redundancy and using AWS etc doesn’t equal a massive scaling operation forced upon you. In fact, the other options would. I'll give you some common examples.

You have a script that needs to run, without fail, at a certain time every day.

You have an endpoint that is mission-critical and even a second of downtime would cause insane manual workload.

You have an endpoint that needs to have as little end-user latency as physically possible.

These are all real examples from my work in fintech. The solution to all of them is a few dollars in cloud functions in Lambda and Lambda@Edge. Now imagine having to provision, orchestrate and maintain dozens of dedicated hosts all by yourself, simply for these handful scripts. The expense of employee time alone would make it absolutely idiotic to go that route and if anything this would equal massive scale day - but even worse, because you didn't even plan for it beforehand.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tluyben2 on Tuesday June 28, 2022 @12:53PM (#31910132)
I work in fintech (banking and payments) and most of our clients aren’t even allowed to host on aws; they have to go for a local provider because aws doesn’t have a hosting hub in their country. Not sure what part you work in but this has never been a problem in the past 20 years with just servers, switches, load balancers etc.

I prefer aws over metal for these kind of setups, but for many other cases I definitely do not; just a dedi or a vps with docker or k8s and/or something like openfaas is enough for almost all startups and beyond. Making it literally impossible to make mistakes like OP. And when needed maybe failover or load balancing.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @12:58PM (#31910186)
I don’t know about that, the hedge fund I work for is US-based and AWS can be fully SEC and FINRA compliant.

We also have a few dedicated servers, but mostly only for infrequently accessed data and logging that doesn’t need to be highly available.

I really can’t understand why this argument keeps coming up. Different solutions for different usecases. Yet anytime Kubernetes or cloud functions are discussed people come in and go like “hurr durr my single Hetzner dedicated server can do all of that and doesn’t have these problems”

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tluyben2 on Tuesday June 28, 2022 @01:27PM (#31910514)
Because some people here do exactly the same thing with aws/cloud. Not you but many here treat aws like it’s the thing you should use ‘because scaling and failover and omg 1 sec downtime’. And then the stories like OP showing that it is dangerous and my experience that most who do this are overpaying and could do with a hetzner server or, better even, a $5/mo vps, even if they do it right (which they are not, generally from all setups I have seen).

I agree with you though on the case by case.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:46PM (#31910740)
Obviously the billing mechanism (or, lack of control) is an issue but that doesn't negate the whole concept. They could (and should) easily fix this by implementing hard caps to activate if so required.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by iforgotpassword on Tuesday June 28, 2022 @01:53PM (#31910807)
Nobody says there isn't any use case for AWS. The point is that "the cool kids" like to start their side projects on AWS. Nothing about it is mission critical. I guarantee you op is not working on some Fintech stuff.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:59PM (#31910893)
How's that bad? Isn't this how we all learned? By playing with cool modern technology?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by drbawb on Tuesday June 28, 2022 @03:42PM (#31912107)
I feel like learning how to configure bird, bind, haproxy, rdbms clusters, redundant MXs, etc. has taught me far more than spinning up equivalent virtual infrastructure on a public cloud would have. Getting to play with the underlying FOSS technologies is far more rewarding to me than using the commercialized versions on someone else's stack. Plus it helps me evaluate and architect my products for competing clouds, rather than my "knowledge and understanding" being tied to one particular vendor's offerings & lexicon. (Another advantage of knowing the underpinnings of a cloud is that it makes reading post-mortems[1] with a morning coffee so much more enjoyable.)

Assuming we're talking about side-projects/hobbyist development: when I'm doing that I want as few variable expenses as possible, and they usually don't require the purported benefits of the cloud. If such a project needs to scale: I'll bolt it onto a cloud at that point, or sprinkle in specific services to address the pain points.

[1]: https://tritondatacenter.com/blog/manta-postmortem-7-27-2015

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @04:52PM (#31912861)
> I feel like learning how to configure bird, bind, haproxy, rdbms clusters, redundant MXs, etc. has taught me far more than spinning up equivalent virtual infrastructure on a public cloud would have.

I agree with this, but the choice of what other individuals play with is not ours to make. There's still countless of youngsters working on bare metal, for whatever it's worth, they just grow up in a world with a lot of existing abstractions now.

> Assuming we're talking about side-projects/hobbyist development: when I'm doing that I want as few variable expenses as possible, and they usually don't require the purported benefits of the cloud. If such a project needs to scale: I'll bolt it onto a cloud at that point, or sprinkle in specific services to address the pain points.

100%, but the choice is free for anyone themselves to make. OP is furthering his knowledge and experience in a very specialised and highly sought after sector. Maybe he'll come to the same conclusion at some point, or maybe he comes from bare metal and has different perspectives now and thinks that redundancy is always awesome.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by razemio on Tuesday June 28, 2022 @01:25PM (#31910494)
Pretty easy, OP sounds exactly like a guy who would have been perfectly fine with a single (Hetzner) server. Then these arguments popup and they are most of the time right. I agree with you, that it always depends on the use. However, hurr durr Hetzner Server seems to be the more reasonable choice here (once again).
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by huksley on Tuesday June 28, 2022 @04:01PM (#31912302)
OP here.

Hetzner provides incredibly beefy machines for a good price.

I’ve been managing 2 machine cluster setup in the past using Hetzner and it worked fine.

Unfortunately I have had an incident with one machine going bad unexpectedly(RAM issue) and I was forced to spend whole day setting up a new one.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:34PM (#31910617)
Why? If you had the choice between complete redundancy and infinite scaling by default while having almost zero work, or using a dedicated server that you need to configure and constantly maintain, what would you choose?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by iforgotpassword on Tuesday June 28, 2022 @01:56PM (#31910849)
If with one thing, a single mistake can result in a $5k bill, and with the other I have a guaranteed fixed bill of 50 bucks a month, then unless I have enough money to burn, the choice is crystal clear. Maybe you wipe your butt with 100$ bills. Others aren't that lucky.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by tluyben2 on Tuesday June 28, 2022 @02:37PM (#31911334)
Exactly; if it is ‘the same’ but with a guarantee of max 50$/mo then sure, I would pick that, but that is not the case, also not with caps. So it is an entirely different case and usually the 50$ option actually brings you very far without any financial risk outside that $50/mo.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @02:43PM (#31911412)
The choice is only crystal clear until AWS etc implement hard caps to activate if needed. Then having some Lambda functions is not only exponentially cheaper than a whole dedicated server and by default highly available and redundant, but also equally as safe financially wise.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by NorwegianDude on Wednesday June 29, 2022 @01:44AM (#31916873)
> You have an endpoint that needs to have as little end-user latency as physically possible.

If you need the lowest possible latency then you should definetly do it yourself. Lambda, even with provisioned concurrency has a very high latency...

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by taylodl on Tuesday June 28, 2022 @01:25PM (#31910488)
If the solution you're building is business-critical then you already have a problem day one: you need high-availability. That means you need at least two servers. As soon as you add that additional server your troubles have begun. Doesn't really much matter whether you add 1 server to your setup or 100.

Your problems compound if you have to consider disaster recovery (DR) and need an offsite location you can failover to. Now you have to contend with data replication and all its concerns.

So even if your application only has a few dozen users things can get quite complex quite fast. AWS makes it simple, practically push-button. Deploying in multiple Availability Zones (AZ) is a no-brainer, and it isn't horribly difficult to deploy in multiple regions, complete with data replication. All while having no servers to configure and maintain. No containers to contend with, no Kubernetes to fight with. To me it's the most stupid-simple solution available today and it's ridiculously cheap! At least so long as you test before you deploy for world exposure!

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:33PM (#31910607)
I completely agree with you. I really suspect some people have never seen themselves how insanely, mind-bogglingly powerful AWS is.

Try doing this [0] with your dedicated servers in under 10 minutes.

And then try attaching highly-available scripts/cloud functions and dozens of different integrated functionality in seconds.

And then try setting up good Network ACL, firewalls, route tables, NAT gateways, load balancers with a few clicks.

... and people here are seriously suggesting that instead using AWS would equal a massive forced scaling operation. Lol.

[0]: https://i.ibb.co/TKmB9HX/image.png

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by cortesoft on Tuesday June 28, 2022 @03:31PM (#31911990)
Sure, but not all of us are working at tiny startups or on personal projects. Many of us here work for large companies that have real scale already and are trying to solve those problems.

Why does everyone assume everyone else works at tiny startups?

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by zamadatix on Wednesday June 29, 2022 @10:32AM (#31920672)
At that point you're already at day 1000 and already know what scale you need for the project so none of this conversation is relevant. You already have hit the point you need to build it a certain way.

I've never worked at a startup, until last year I never worked at a company with less than 100k employees.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Tuesday June 28, 2022 @02:00PM (#31910898)
> With all due respect and no offense intended, your perspective sounds a lot like "I've never attempted to scale so I can't understand the problems"

With all due respect, I don't think you've ever actually put together a local cluster.

A simple 4 machine k8s cluster sitting literally on dirt in my basement can scale out to the equivalent of thousands of dollars of AWS spend a month. I broke even on the initial purchase outlay for my workloads in less than a year.

The problems are almost never scaling the web servers. The problem is scaling the infrastructure that those servers need to be useful.

Generally - your DB is the first pain point, your network is the next.

If you can run it in a container, that service probably isn't the bottleneck for scaling, it's going to be whatever is providing the persistent disk for that service, and the network between the two.

Both of those things happen to also be fairly expensive to scale in the cloud as well.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by icedchai on Tuesday June 28, 2022 @09:14PM (#31915302)
I have a k8s cluster in my basement (concrete floor, not dirt.) It's fine for dev work, but unsuitable for production. The real problem is redundant, reliable internet: cable internet upstream bandwidth sucks after 20 - 40 megabits/sec, and can't get fiber here yet.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Wednesday June 29, 2022 @11:07AM (#31921234)
This is fair.

I've used both comcast and google fiber while running my basement cluster. I think on google fiber I would have said production usage would be fine - I would pretty reliably get 1gbs down and ~800mbps up.

I wouldn't have redundant net, but the upload speeds are fine.

On Comcast... Comcast is really kind of a joke. Even on expensive business plans they cap upstream at 35mbps in my area (down is 1gbps) and the fastest way to get throttled to actually try using that upstream capacity.

Comcast does give me redundant failover to 5g by default now, which I guess is nice, but it's not worth much when I can't send a ton of data over the line anyways.

So point taken - if you're going to have to rent a room in a major metro for fiber access anyways, you probably want to be paying for cloud services (sadly - you'll pay a lot, since outbound traffic costs are high, and if 30mbps upstream isn't doing it for you, you're gonna blow through the free 100gb fast)

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @02:04PM (#31910942)
> With all due respect, I don't think you've ever actually put together a local cluster.

I have, and still do. It's neither redundant nor highly available. The power source isn't, the internet connection isn't and it's also located in my basement and not multiple regions.

> The problems are almost never scaling the web servers. The problem is scaling the infrastructure that those servers need to be useful.

There you go..

> Both of those things happen to also be fairly expensive to scale in the cloud as well.

No. [0]

[0]: https://i.ibb.co/TKmB9HX/image.png

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Tuesday June 28, 2022 @02:18PM (#31911118)
With regards to your image... so what? Virtual networking equipment is virtual - I too can spin up hundreds of subnets for nothing.

My internal transfer costs are also.... drumroll... zero. (ok - technically, at some point I bought a 10gbs switch and 500ft of ethernet cable)

Lets talk about what it costs you put data back out onto the net, or into a different region. Then lets compare long term storage costs.

Because that shit is only cheap in the "hobbiest" range. Outside of that, outbound data and storage is fucking expensive in the cloud.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @02:26PM (#31911195)
> I too can spin up hundreds of subnets for nothing.

Really? In completely different physical locations with inter-region routing and NAT gateways for each region that route into a redundant load balancer? Then you're right and don't need AWS any more. However, I'd suspect your costs would not be very affordable either.

> Lets talk about what it costs you put data back out onto the net, or into a different region.

If you're seriously trying to compare your residential internet connection with something like this I'm not going to go there..

> Then lets compare long term storage costs.

Same logic applies.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Tuesday June 28, 2022 @03:08PM (#31911767)
You do realize we're agreeing?

I'm saying the things that are hard to do yourself aren't fucking cheap in the cloud either.

My counter point (and the one you keep dodging) is that the things that are EASY to do yourself aren't fucking cheap in the cloud, and they scale out just fine for the vast majority of non-Saas businesses.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @04:43PM (#31912760)
I realize, but I still disagree with one of your points:

> My counter point (and the one you keep dodging) is that the things that are EASY to do yourself aren't fucking cheap in the cloud, and they scale out just fine for the vast majority of non-Saas businesses.

And I don't even disagree with it for its inherent correctness, but because nobody ever said you absolutely have AWS for something that doesn't need it. Most users here tend to discard cloud platforms for even the most obvious and suitable use-cases, and keep on iterating how their single dedicated server can do all of it. I'm also not a big fan of telling someone they don't need to use AWS if it's clearly a side hobby project because that is how we all learned.. by playing with cool modern technology for fun.

The real issue is super simple.. AWS just needs a hard cap functionality so stuff like this can't happen.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Wednesday June 29, 2022 @10:49AM (#31920946)
> I'm also not a big fan of telling someone they don't need to use AWS if it's clearly a side hobby project because that is how we all learned.. by playing with cool modern technology for fun.

I guess I don't really see the appeal of putting a hobby project into a space where a simple mistake can literally cost you thousands of dollars, with very little recourse.

I get to play with the vast majority of the fun tech - I just choose to do it on a k8s cluster I own, with extremely predictable costs, and frankly - more scaling capacity than I think most businesses need.

> Most users here tend to discard cloud platforms for even the most obvious and suitable use-cases, and keep on iterating how their single dedicated server can do all of it.

And this isn't really my stance - I'm absolutely not advocating for a single dedicated server (fuck - even my hobby instance is HA, 3 machines with a network lb, on a 5 hour UPS, with a redundant network. I personally don't care as much about the redundant network, but comcast provides it free to business customers in my area anyways through 5g equipment).

But I do think most (and I mean 75%+) businesses can spend 10k on a single server rack and go for literal years without problems.

If your business is not selling software as a service - don't buy into the bullshit marketing.

Even if your business is selling software as a service, think about it first. Small businesses tend to get sweetheart deals on costs in AWS, GCP, and Azure because their usage costs for those companies amortizes out to roughly zero, and because they know damn well that they'll end up paying through the nose if they make it to mid-size (or even just screw up once or twice - two fuck ups like the one here and you'd have bought yourself a decent server rack!)

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Nextgrid on Tuesday June 28, 2022 @03:01PM (#31911694)
> It's neither redundant nor highly available. The power source isn't, the internet connection isn't and it's also located in my basement and not multiple regions.

For a lot of projects this doesn’t matter. The cost of downtime might be lower than the cost of high availability and occasional downtime is OK.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by swatcoder on Tuesday June 28, 2022 @12:30PM (#31909831)
I'm not trying to dismiss the value there is in having highly scalable cloud architectures available to the projects that need them, but a huge proportion of projects will never need them.

Most projects don't even actually suffer for modest downtime, although you can achieve AWS-comparable downtime even without AWS/Google/Azure-style "cloud" architecture.

It can make a huge difference in operating and engineering costs to know which bucket your project fits in. Good architectural foresight can even let you smoothly move from one to other if unexpected growth or a pivot indicate that it's warranted.

Engineering is about understanding the scope/scale of problems, not about being dogmatic or getting caught up in problems that don't apply.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by digianarchist on Tuesday June 28, 2022 @12:34PM (#31909886)
I was thinking more of when the unpatched Ubuntu 12.04 is exploited via an SSH 0day and the server is used to host a Citibank phishing website.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by nojito on Tuesday June 28, 2022 @12:22PM (#31909719)
Most people don't need to scale and even running 5x redundant servers is cheaper than a comparable cloud solution.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by 300bps on Tuesday June 28, 2022 @12:31PM (#31909846)
Running Lambda, I get a million calls per month for free. Then it's 20 cents per million calls.

Just curious - have you really researched cloud solutions or did you just compare the price of hosting EC2 instances in AWS vs having your own server? Because that's not what cloud is about.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Tuesday June 28, 2022 @01:43PM (#31910709)
> Running Lambda, I get a million calls per month for free. Then it's 20 cents per million calls.

And you are overpaying by a significant chunk. My raspberry pi - the old cheap one - can handle 10 million requests a day without breaking a sweat. If I push it, I can get up around 90 million requests a day without too much effort (it's only about 1 request/ms)

I really don't think most devs understand how fucking cheap hardware that's comparable to these services is.

Now - you might be using a host of other valuable features that your cloud provider gives you (things like edge servers near your customers, or truly significant outbound network traffic flows, or a very robust multi-region setup, or disk backing of some sort, etc).

But generally speaking - you ARE overpaying for cpu cycles in the cloud. It's not really up for debate.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:48PM (#31910751)
Of course you are paying more for AWS than for a damn raspberry pi.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by horsawlarway on Tuesday June 28, 2022 @02:47PM (#31911476)
You say this like it's obvious that AWS is better.

There are certainly cases where AWS can be better (ease of edge networks and multi-region availability come to mind)

But outside of a very small set of cases (most of which are when companies are victims of their own success - which is actually a wonderful problem to have) what's the compelling reason to actually use AWS if "Of course I am paying more" for it?

In my opinion, if you can still run your db on a single machine - you don't fucking need the cloud yet. That covers a pretty large chunk of businesses.

Most of the "cloud" is convincing business that could self-host their entire stack on a raspberry pi in a basement that they should be spending thousands on cloud compute costs a year.

Fuck - the most damning evidence is simply how much fucking money these companies are making from upselling you cpu cycles that they're getting mostly for free. For the 4th quarter of 2021, amazon reported a profit of 5.2 billion on ~18 billion in revenue from AWS.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by eropple on Tuesday June 28, 2022 @01:34PM (#31910618)
So I'm actually in the process of doing Lambda versus persistent costing right now for a new project, where it's heavily load-based and very spiky, but the work on each packet of information is actually very lightweight. The tricky part here in AWS is not Lambda, which is pretty reasonable in general--the pitfalls I'm seeing are around data storage. DynamoDB is stealthily very expensive, either provisioned or on-demand. Right now I'm converging on lambdas for compute and RDS/S3 for storage, but what really makes AWS shine for this use case more than anything else is SQS.

SQS is so good and that there isn't a great, easily deployed (sorry, RabbitMQ) option for exactly what it does is a real push towards AWS. (GCP Cloud PubSub is close enough, but I know AWS way better than I do GCP.) If I didn't need this, and I felt confident managing RabbitMQ as a queueing solution, I don't think AWS would be a compelling solution because $60 in Hetzner nodes, in a HA configuration, could do a lot of work.

(If this thing works I'll need an on-prem solution anyway, so I'll probably have to build that too--but that's "good problems to have".)

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Mo3 on Tuesday June 28, 2022 @01:55PM (#31910829)
DynamoDB is not required to use cloud functions. You can either use regular RDS like you said, Aurora or even just your own EC2-based cluster (all of these you can attach to the VPC the functions are attached to as well) and there's a lot of nice developments going on like Cloudflare D1.

Totally agree on SQS, knowing PubSub as well I'd say they're pretty much on the same level. All the interconnectedness is where cloud platforms shine

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by eropple on Tuesday June 28, 2022 @03:25PM (#31911935)
To clarify, I mentioned DynamoDB because it has a unit-costs model rather than an amortized-over-time cost model, and when you can harness that (and then focus on a simplified COGS model) you can do very well.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by gunapologist99 on Tuesday June 28, 2022 @02:40PM (#31911383)
NATS and NSQ are better than SQS if you can deploy them yourself. ZeroMQ is a great option as well, but it probably will require some major brain changes, since it doesn't fit most people's mental model of what a queuing server looks like.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by eropple on Tuesday June 28, 2022 @03:29PM (#31911978)
ZeroMQ is too weird for me, yeah. NATS JetStream and NSQ are both promising but their durability options are unclear and while I have a background in devops/system architecture, I'm looking at building something whose entire staff is literally only me and so while I'm sure I can deploy it, I'm not sure I can effectively run it. SQS will do what I expect it to do, and that's pretty powerful.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by codegangsta on Tuesday June 28, 2022 @03:35PM (#31912023)
disclosure: I work at Synadia

We do have a hosted version of NATS called NGS that is multi-cloud, multi-geo and is really easy to set up https://synadia.com/ngs

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by gunapologist99 on Tuesday June 28, 2022 @03:39PM (#31912069)
Your pricing is really very fair, especially since it's based on resource consumption and not per-request. One suggestion: put your pricing right on the home page. I'm starting to wonder why I am running it myself!

And, you probably know a little bit about NATS, too, since, you know, you wrote it! :)

https://nats.io/support/

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by codegangsta on Tuesday June 28, 2022 @02:53PM (#31911561)
I think NATS is an excellent, and very easy to run and deploy. Pretty much has a "just works" attribute I like to assign to boring technology
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by nojito on Tuesday June 28, 2022 @12:32PM (#31909858)
And? I don't think you are aware of how cheap metal is these days.

Plus the OP has already decided that free tiers don't work.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by throwaway894345 on Tuesday June 28, 2022 @01:45PM (#31910721)
If you're putting your service behind CloudFront, you're probably aiming for DDOS protection and low latency or something that you can't easily get from a VPS. Of course, you can put your VPS behind CloudFront, but you would run into the same issue (albeit the fixed capacity of your server would effectively cap your bill).

A single VPS is great if you don't need reliability or scale, but if you care about those things you probably need at least a few of them running behind load balancers, and you probably don't want humans manually poking at them (but rather you want some reproducibility). Moreover, there's a bunch of host management stuff you're taking upon yourself--configuring metrics collection and log collection and SSH and certs and stateful backups/replication/failover and application deployment and process management and a whole bunch of other things that come for free with serverless.

Implying that serverless/Kubernetes/whatever is just hype ("cool kids") while ignoring the pretty significant discrepancies in requirements is pretty silly.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by stevewatson301 on Tuesday June 28, 2022 @02:12PM (#31911042)
Cloudfront is terrible for DDOS protection though, given that there is a per request pricing (and no, AWS WAF doesn't help as it just imposes additional pricing on top, the only thing it does is to prevent Cloudfront from processing those requests.)

However, if your statement is generally about CDNs such as Cloudflare or Bunny.net that don't have per request pricing, it makes sense.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by foepys on Tuesday June 28, 2022 @04:14PM (#31912445)
E.g. Hetzner will give you DDoS protection for free with every dedicated server you host with them. If you need more security you can also put another provider in front of it.

CloudFront on the other hand will bleed you dry with their pricing.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by kypro on Tuesday June 28, 2022 @01:09PM (#31910319)
With almost service like hosting where there could potentially be unknown costs I always select services with fixed fees and pay annually via PayPal so no card info is stored.

If you have to pay by card and you have to subscribe always use a disposal virtual card. Most of the time these companies won't pursue you for payment because it's simply not worth the effort. The most likely outcome is that they'll just suspend your account. What you don't want happening is them taking money from you before you're even aware what is happening because that way you won't get it back and there's no room for negotiation.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by p0d on Wednesday June 29, 2022 @03:22AM (#31917390)
Another not cool kid here. I've been running my little Saas for 12 years on fixed price cloud vms, €18 total per month (initially shared hosting). I'm sure I will ever hit my providers 20TB monthly traffic limit.

I settled with running lxc containers. I just couldn't bring myself to be bothered about docker. Before I left my last job we started using k8s. I wouldn't use k8s unless in an enterprise environment. Even then I would consider the need. "But Mom, all the cool kids have k8s!"

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by JohnHaugeland on Tuesday June 28, 2022 @11:20PM (#31916097)
> To be honest I don't really understand the sentiment that developers can get away with not knowing basic sysadmin stuff

It's not that. I used to own a VPS ISP. I know how the infrastructure stuff works.

It's that I don't care. I want to write code and deploy it to a new machine.

The time savings as a developer is enormous.

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by turtlebits on Tuesday June 28, 2022 @02:28PM (#31911234)
Standing up a service isn't only about compute. Where is your logging, metrics, alerting? Even with a server, you need methods for access control, hardening, log rotation, updates/patches (what happens when the OS goes out of support?).
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by leesec on Tuesday June 28, 2022 @04:10PM (#31912404)
Where would I learn how to set this up, this 'basic sysadmin stuff'?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by justinhj on Tuesday June 28, 2022 @03:22PM (#31911904)
Cloud functions are not used to look cool, nor are they used solely by people that “don’t know basic system admin”. Their use cases don’t line up with your needs and that is okay.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by thelittleone on Tuesday June 28, 2022 @05:35PM (#31913317)
One benefit is compliance. If my SaaS runs on Lambda and managed DB it offloads a bunch of OS related security requirements.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by zitterbewegung on Tuesday June 28, 2022 @03:57PM (#31912266)
Also , $100 a month can get you a business line with a static IP for self hosting.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by RobRivera on Tuesday June 28, 2022 @05:03PM (#31912978)
I never understood people who are in such a rush not to survey whats available.
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by k8sToGo on Tuesday June 28, 2022 @01:44PM (#31910710)
Powerful yes, what about getting good peering and routing?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by kjhjkhf on Tuesday June 28, 2022 @02:54PM (#31911579)
the cloud means you get to write sexy code and call yourself an engineer

not the cloud means you write boring configuration files and call yourself a sysadmin

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by meatsauce on Tuesday June 28, 2022 @01:02PM (#31910239)
Where can you get a dedicated for 40?
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by lowendstock on Tuesday June 28, 2022 @03:20PM (#31911876)
Check https://www.lowendstock.com

Also Rasmus (of PHP) wrote a series of posts https://toys.lerdorf.com/low-cost-vps-testing a while ago comparing VPS providers in the $10/mo range.

It was discussed on HN https://news.ycombinator.com/item?id=21725853

Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by meatsauce on Friday July 01, 2022 @01:40PM (#31949944)
Thank you
Re:Tell HN: I DDoSed myself using CloudFront and Lambda Edge... by Nextgrid on Tuesday June 28, 2022 @01:04PM (#31910263)
Hetzner, OVH. Hell, if you go with Kimsufi (OVH's budget brand) you can get dedicated for a dozen bucks.