Top
Best
New

Posted by operator-name 6 days ago

Serverless Horrors(serverlesshorrors.com)
620 points | 484 commentspage 6
fnord77 6 days ago|
looking forward to the "LLM token horrors" version
mdaniel 6 days ago|
I thought there was an OWASP for "denial of wallet" vulnerabilities but this link was the closest one I found https://www.prompt.security/vulnerabilities/denial-of-wallet... (although the link makes it sound like they're offering denials)
kjs3 5 days ago||
We call them "Billing Fatigue Attacks". Keep an eye on your autoscaling, kids...
game_the0ry 6 days ago||
I have a feeling I will be downvoted for this, but...

Have the people posting these horror stories never heard of billing alerts?

skippyboxedhero 6 days ago||
Many of the stories on the site are from people who have billing alerts.

If you have bot spam, how do you actually think their billing alerts work? The alert is updated every 100ms and shuts off your server immediately? That isn't how billing alerts can or should work.

McGlockenshire 6 days ago||
Yes, actually, if continuing to run the service is going to exceed my available budget then I do want the service turned off! If I can't pay for it, and I know I can't pay for it, what other possible choice do I have?

Do any of you people have budgets, or do you all rely on the unending flow of VC money?

skippyboxedhero 6 days ago||
That isn't how this can work. If you are running a service and then find out that AWS is spamming you every 100ms to find out what your CPU is doing (or calling out every 100ms) then people would be quite unhappy.

The majority of these massive bills are due to traffic, there is pretty much no way that AWS could stop your server in time...if they had the choice, which they don't.

I think my original point was unclear: I am pointing out that if you just think about how this stuff can possibly work, billing alerts can not work in the way you expect. The alert is updated async, the horse has bolted and you are trying to shut the gate.

I don't use AWS for personal stuff because I know their billing alerts won't stop me spending a lot. Don't use them if that is a concern.

I do use AWS at work, we are a relatively big customer and it is still very expensive for what it is. The actual hardware is wildly overpriced, their services aren't particularly scalable (for us), and you are basically paying all that overage for network...which isn't completely faultless either. Imo, using them in a personal capacity is a poor idea.

morcutt 6 days ago||
There is also WAF.