5 ms·

I think this nets to a < 0.01% delta to our bill. Is this really that big an issue in practice? For hobbyist projects, maybe? But for larger customers, this is

by jhgg 7y ago

I think this nets to a < 0.01% delta to our bill. Is this really that big an issue in practice? For hobbyist projects, maybe? But for larger customers, this is a drop in the ocean. I actually think this is a (somewhat) smart move. It incentivizes you to use a NAT gateway to egress traffic to your instances. You can either run your own fleet (it's very easy - but you gotta fix it if it breaks), or use their managed NAT solution (more expensive, but with less worry hopefully) - and not just tack on a public IP to every instance that needs internet connectivity. We did this from the get-go (running our own NATs) - and only have a few public IPs relative to the # of instances we run.

yyhhsj0521 7y ago
For many startups, using this more difficult but technologically sounder solution could mean hiring another engineer they can't afford.
- sbarre 7y ago
  Setting up an inbound proxy VM that NATs all your other machines is not "difficult". There are plenty of tutorials online for doing this with nginx or Apache, and even a junior dev ops person should be able to do this in a few hours' work. I highly doubt this requires hiring another engineer.
- 0xEFF 7y ago
  GCP has had CloudNAT for some time now. It’s a checkbox in the GUI and just works.
rohan1024 7y ago
It's not about the cost. Every Internet connected system(at least in cloud. Ideally every system) should be publicly accessible but instead of providing it by default they are providing it as feature. If you don't want to show VM to the world then you use NAT but they have got this backward. This is slippery slope. One day they might charge you to open a port to external world.
- jasonvorhe 7y ago
  Which internet standard is the source for that claim?
- dub 7y ago
  "Every Internet-connected system should be publicly accessible" That sounds like a security or data leak nightmare waiting to happen. I would prefer not entrust my data with a company that feels there's value in having all of their instances publicly addressable.
  - rocqua 7y ago
    NAT is not a firewall. Whilst NAT does not necessarily hurt security, a system that becomes unsecure if not behind NAT is not properly secured.
  - rohan1024 7y ago
    NAT has messed up Internet so much that people can't even ensure security without it. You have firewall for security. If we had not relied on NAT for security we would have actually configured them. Anyways, we are gonna have to configure firewalls for IPv6 because there is no NAT.
    - geggam 7y ago
      Heh, The container network ecosystem is crap because of NAT and what seems to be a lack of understanding around networking
    - criddell 7y ago
      I understand that with IPv6 you don't need NAT to fix scarcity problems, but is IPv6 technically incompatible with NAT?
  - coleca 7y ago
    Actually, Google professes in their "BeyondCorp" security model a zero-trust architecture. You shouldn't be assuming that just because your instance isn't publicly accessible that it is secure. (See: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/) Which makes this move even more surprising, because GCP reference architectures have traditionally been focused around public facing Internet access. Unless, it is a sign that GCP is getting more traction and Google is running out of public IPs to be handing out like candy. This could be an economic incentive to encourage people to conserve these IPs.
idunno246 7y ago
If it’s 0.01% then why should google bother with it? All it does is cost goodwill for a negligible amount of money. We have vm external ips turned off at the org level. It feels like every day we have to explain to a new person that no, that google written tutorial doesn’t work because it assumes public ips are available. Entire services don’t work with this flag on. The other shitty thing is it feels like at least once a month we get some email of a price increase or deprecation that causes some fire drill, and then we ask our tam to tell us the actual cost and he can’t because he has no idea it’s happening so the burden falls on us
- CydeWeys 7y ago
  IP addresses are limited and even small costs are better at forcing people to conserve limited resources than "free". For an example, 5 cents isn't much, but charge that per plastic bag and suddenly people are using a lot fewer disposable bags.
- xenophonf 7y ago
  [our customer representative] has no idea it’s happening Why do you continue to do business with GCP if their customer service is that bad?
  - jrockway 7y ago
    Because it's a lot cheaper than AWS, whose $500/month customer service is just as bad?
    - jalk 7y ago
      AWS support is indeed pretty crappy. $500 is not a fixed price. You pay 10% for the first 10K/month, 7% of $10K-$80K and so on. The Developer plan is 3%, but is pretty worthless - it should be renamed to rookie-plan or similar - you can get the same answers on SO for free within minutes instead of waiting days. Getting past first-level support on the Dev plan with harder technical issues takes weeks in my experience. see https://aws.amazon.com/premiumsupport/pricing/ https://aws.amazon.com/premiumsupport/pricing/

by jhgg 7y ago

yyhhsj0521 7y ago

For many startups, using this more difficult but technologically sounder solution could mean hiring another engineer they can't afford.

sbarre 7y ago
Setting up an inbound proxy VM that NATs all your other machines is not "difficult". There are plenty of tutorials online for doing this with nginx or Apache, and even a junior dev ops person should be able to do this in a few hours' work. I highly doubt this requires hiring another engineer.
0xEFF 7y ago
GCP has had CloudNAT for some time now. It’s a checkbox in the GUI and just works.

rohan1024 7y ago

It's not about the cost. Every Internet connected system(at least in cloud. Ideally every system) should be publicly accessible but instead of providing it by default they are providing it as feature. If you don't want to show VM to the world then you use NAT but they have got this backward. This is slippery slope. One day they might charge you to open a port to external world.

jasonvorhe 7y ago
Which internet standard is the source for that claim?
dub 7y ago
"Every Internet-connected system should be publicly accessible" That sounds like a security or data leak nightmare waiting to happen. I would prefer not entrust my data with a company that feels there's value in having all of their instances publicly addressable.
- rocqua 7y ago
  NAT is not a firewall. Whilst NAT does not necessarily hurt security, a system that becomes unsecure if not behind NAT is not properly secured.
- rohan1024 7y ago
  NAT has messed up Internet so much that people can't even ensure security without it. You have firewall for security. If we had not relied on NAT for security we would have actually configured them. Anyways, we are gonna have to configure firewalls for IPv6 because there is no NAT.
  - geggam 7y ago
    Heh, The container network ecosystem is crap because of NAT and what seems to be a lack of understanding around networking
  - criddell 7y ago
    I understand that with IPv6 you don't need NAT to fix scarcity problems, but is IPv6 technically incompatible with NAT?
- coleca 7y ago
  Actually, Google professes in their "BeyondCorp" security model a zero-trust architecture. You shouldn't be assuming that just because your instance isn't publicly accessible that it is secure. (See: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/) Which makes this move even more surprising, because GCP reference architectures have traditionally been focused around public facing Internet access. Unless, it is a sign that GCP is getting more traction and Google is running out of public IPs to be handing out like candy. This could be an economic incentive to encourage people to conserve these IPs.

idunno246 7y ago

If it’s 0.01% then why should google bother with it? All it does is cost goodwill for a negligible amount of money. We have vm external ips turned off at the org level. It feels like every day we have to explain to a new person that no, that google written tutorial doesn’t work because it assumes public ips are available. Entire services don’t work with this flag on. The other shitty thing is it feels like at least once a month we get some email of a price increase or deprecation that causes some fire drill, and then we ask our tam to tell us the actual cost and he can’t because he has no idea it’s happening so the burden falls on us

CydeWeys 7y ago
IP addresses are limited and even small costs are better at forcing people to conserve limited resources than "free". For an example, 5 cents isn't much, but charge that per plastic bag and suddenly people are using a lot fewer disposable bags.
xenophonf 7y ago
[our customer representative] has no idea it’s happening Why do you continue to do business with GCP if their customer service is that bad?
- jrockway 7y ago
  Because it's a lot cheaper than AWS, whose $500/month customer service is just as bad?
  - jalk 7y ago
    AWS support is indeed pretty crappy. $500 is not a fixed price. You pay 10% for the first 10K/month, 7% of $10K-$80K and so on. The Developer plan is 3%, but is pretty worthless - it should be renamed to rookie-plan or similar - you can get the same answers on SO for free within minutes instead of waiting days. Getting past first-level support on the Dev plan with harder technical issues takes weeks in my experience. see https://aws.amazon.com/premiumsupport/pricing/ https://aws.amazon.com/premiumsupport/pricing/