9 ms·

Ouch. If Troy Hunt of all people can make this mistake, it can happen to anybody. HIBP is an awesome service funded totally by donations, so it's too bad this h

• tpetry 5y ago
  Every cloud makes this mistake easy! You have to manually activate billing alerts for everyone because they want you to spend more snd more each month. I am still waiting for a cloud without these dark patterns. But that will never happen because it‘s leaving a big amount of money on the table by not being hostile.
  • TedDoesntTalk 5y ago
    > I am still waiting for a cloud without these dark patterns. This is how mobile and landline phone companies made enormous fortunes before flat rate billing. It’s called post-paid vs pre-paid billing.
  • iso1631 5y ago
    Get a VPS from linode for $5 a month and it costs $5 a month.
    • nix23 5y ago
      Or hetzner, or Vultr.
    • gkhartman 5y ago
      They have transfer limits and an associated overage fee iirc. I can still see this sort of thing happening if that is the case.
      • iso1631 5y ago
        My understanding is you hit your bandwidth cap and that's it, no more bandwidth. (edit) looks like that's not the case, I'm sure I used to have to buy a second instance a few years ago if I did want to use more bandwidth that was allocated
      • BenjiWiebe 5y ago
        I barely even realized that, since my hobby stuff doesn't come anywhere near the limit. For those curious, the overage rate is $10/TB ($0.01/GB) after the transfer included in the plan. The smallest amount of included transfer is 1TB for the $5/mo VPS.
        • Ostrogodsky 5y ago
          Or just go with Hetzner and have a limit 20X as big with cheaper prices https://www.hetzner.com/cloud https://www.hetzner.com/cloud
    • tpetry 5y ago
      Sure that's what i am doing. A beefy dedicated machine with no bandwidth pricing. But that also means i need to do everything by my own. I don't get any of the worry-free services of AWS.
      • iso1631 5y ago
        Like the $10k/day bills? Odd definition of 'worry free'
      • nojito 5y ago
        How is surprise billing not a worry?
      • christophilus 5y ago
        I worry far less about my Netcup servers + BunnyCDN than I ever did about my AWS bills.
    • ozim 5y ago
      Not really as there is network traffic quota: If you use up your monthly network transfer pool, you can continue to use your Linodes normally. That being said, you will be charged $0.01 for each additional GB at the end of your billing cycle.
    • hkt 5y ago
      Personally I like Mythic Beasts and use their raspberry pi servers and VPSes. Much less terrifying pricing and the support is good too.
      • tome 5y ago
        Yes, their support is amazing. I can email the support address and have a real human who knows what he/she is doing reply within minutes or hours at most.
        • hkt 5y ago
          Exactly! It is quite refreshing to not have to battle past first line to find someone with the understanding to help. No shibboleth required. Cheaper hosting, too.
  • nix23 5y ago
    >Every cloud makes this mistake easy! Funny enough...Oracle (OCI) makes it better, you can buy oracle"coins" 1to1 with $ and load your account just with what you think you need.
    • christophilus 5y ago
      If Oracle cloud is still shenanigan free in 2 decades, I’ll consider it. Until then, Oracle gets $0 of any budget I’m in charge of.
      • nix23 5y ago
        See you when your a even more inflexible (and old) guy who makes the bet on one horse, look i give a *hit about (or anyone else) oracle, what i care for is migration without problems from one provider to another. Hard requirement: My image can run on it (freebsd and linux), no proprietary BS, no special stuff, give me vm-"harware" make it fast, make it cheap, make it reliable, that's it..that's it. And ATM i like oracle hetzner and vultr at most. If one of those change to my disgust i change, no big deal...just some dns rewrite.
      • Nextgrid 5y ago
        The Oracle cloud UI is extremely slow and terrible to work with. I'd prefer shenanigans every so often than having to deal with that crap on a daily basis.
        • nix23 5y ago
          Kind of funny, for me it's faster then Amazon.
  • harry8 5y ago
    Dark patterns - this sounds like a colour scheme you don't care for. "Predatory death-trap pricing" captures the spirit of the thing with rather more clarity. It is wholly intentional after all.
    • gwd 5y ago
      > Dark patterns - this sounds like a colour scheme you don't care for. Or craft clothing for goths? But the "dark" comes from its association with evil: "Defense against the Dark Arts", "The Dark Lord", "Turn to the Dark Side of the Force". It's a clear implication that the people are "selling their souls to the devil": knowingly doing something "a little bit evil" to achieve their aims.
    • OrderlyTiamat 5y ago
      > Dark patterns - this sounds like a colour scheme you don't care for. I can see your point- if I'd never seen the term before I might have a similar reaction. But it's quite a common term now I think.
      • harry8 5y ago
        Not it is not. It is common industry jargon for people who work with websites. Nobody else knows what it is. If you had to pick a term to sound as inoffensive as possible for fraudulent, deceptive conduct while still sort of capturing the thing without being abjectly false you could do no better than something that sounds like a colourscheme. "Mr Politician what do you think about $big_co using dark patterns?" "Mr Politician what do you think about $big_co engaging in predatory death-trap pricing schemes to defraud consumers?" What is being asked in one of those questions is clear to everybody. The other is jargon and excludes the majority of the population from understanding the intended meaning. And note, you don't have to agree that it is "predatory death-trap pricing" at all. That is simply in the above sentence an accusation. Words have meanings. That the accusation be understood clearly by as many people as possible is important.
        • OrderlyTiamat 5y ago
  • Dave3of5 5y ago
    Also the billing alerts is just that an alert. They should have something in place to put a hard cap on monthly spend. That way his free website would go offline when he's spent > $X. As you say they make it hard deliberately. Edit: Turn out Azure have this: https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/spending-limit https://docs.microsoft.com/en-us/azure/cost-management-billi...
    • fendy3002 5y ago
      Eh after skimming it I feel like there's still gotchas with it. Not every account can turn it on and looks like there aren't custom limit. CMIIW, it'll be my first cloud provider if I can set one.
    • danuker 5y ago
      I see there is a spending limit for the "intro" or "preview" plans designed for students, Visual Studio users, and resellers (the "hook" part in "hook, line, and sinker"). Not for actual cloud usage, like an actual pay-as-you-go plan where this would be useful. https://azure.microsoft.com/en-us/support/legal/offer-details/ https://azure.microsoft.com/en-us/support/legal/offer-detail...
      • ghaff 5y ago
        Yeah, there are trial accounts and things but as far as I know, none of the big cloud providers have a way to say "Under no circumstances are you to charge me for than $X per month even if it means shutting down services."
      • Dave3of5 5y ago
        Yeah I see that too I'll add that to my comment tbh I think what I said still stand it's been made hard or maybe said a different way is: It's very easy to overspend on these big cloud providers Oh I can't edit the comment now oh well sorry if I've confused anyone.
      • Monotoko 5y ago
        A lot of Chinese cloud providers like Aliyun will only allow pay and go, because there’s no way to recursively bill My own instances go down all the time when I forget to ‘top up’ the account
  • dx034 5y ago
    Hetzner's cloud offer is limited but they limit your possible spending by default and it's very easy to set up billing alerts. I guess they mostly do it to ensure they get the money at the end of the month, but it's equally useful for their users.
    • tpetry 5y ago
      Additionally Hetzner's egress pricing is a lot more cheaper. On hetzenr you pay 1,19€/TB (1.13$/TB) vs. 90$/TB on AWS. That's about ~80 time more on AWS!
  • sgustard 5y ago
    If I leave my water running then go on vacation I'll have a huge water bill too. I don't conclude my water company is intentionally trying to overcharge me. The more reasonable conclusion is: building an alert system that addresses every customer need is hard. Most enterprises (where all the customer focus is) want minimal downtime above other considerations, including cost.
    • addicted 5y ago
      This is like you leaving your tap running slightly as you go on winter vacation so the pipes don’t freeze over. But the water company does not actually allow you to install proper taps to regulate the water so you use duct tape to do so, and due to an earthquake something falls on the tap causing your duct tape solution to fail leading to a massive surge of water, leading to your massive water bill. Did the water company cause this? No. Your duct tape solution wasn’t resilient enough because it didn’t factor in an earthquake. But I would be justifiably mad that my water company does not allow me to install actual taps, and allows unforeseen and unpredictable situations to make me run up huge bills that could otherwise have been avoided with a proper tap.
    • Nextgrid 5y ago
      The problem with the cloud is that the entire Internet is in control of your tap and can choose to open it and waste infinite amounts of water with no way to implement a cap.
• moritonal 5y ago
  So I guess one method would be to set spending-limits when you setup your account. But that'd lead to constant moments of having to bump your budget (or worse, get approval to do so from Accounting) when you're trying to work. There are both spending limits and alerting that you could use, but would be impossible to predetermine from Azure's perspective, so they rightly ask you to.
• Grollicus 5y ago
  Do you have any substance to your allegation of Microsoft hiding behind their pricing model? This is very straight forward from their view, before: almost no traffic = almost no costs, now: huge traffic = $$$. On the other hand, it doesn't seem that Troy did try to talk to them about this and seems to want to eat the costs himself. As it was his mistake. I think that's commendable. I also think with the amount of free advertisement Troy has done for them they'd be open to this and I can imagine we might see a followup post like "MS was so nice they waived my costs".
  • NicoJuicy 5y ago
    He's an Azure MVP. He already has 13 k in credits/yr, which could absorb the costs ( just guessing here)
    • mdoms 5y ago
      He's also independently very wealthy. Dude drives a GT-R and AMG C-Class (as at 2017, probably upgraded by now). He got a generous payout when he was laid off from Pfizer.
• baybal2 5y ago
  Who is Hunt Troy?
  • jacquesm 5y ago
    The guy behind 'Have I been pwned', a website where you can check if your login credentials to some website have been leaked. https://haveibeenpwned.com/ https://haveibeenpwned.com/
• j1elo 5y ago
  > If Troy Hunt of all people can make this mistake, it can happen to anybody. Exactly this. As a low-level / embedded / non-cloud stuff dev, I've been getting up to speed through all the cloud-ification of the industry, but I'm still scared (not literally ofc) of running most things on my own on any big cloud provider (smaller ones seem more manageable). I'm reading this and seems like being a customer of cloud services is like walking a dangeous path filled with gotchas and caveats, just jumping from cover to cover while hiding from danger, and hoping you're safe and didn't mess it up so far, "fingers crossed". Like this tiny detail that he didn't realize was critical, so I would fall on it too plus on another 500s small papercuts: "oh I set cache up, so I hope all is well". "Yeah, no you aren't, I guess you didn't think of this detail about maximum cached file size! Gotcha, Game Over!" Yeah cloud providers should have clearer communitacions and etc etc... but the fact of today is that they don't. So I'd never sleep well feelin 100% confident that I had covered and taken into account every minuscule detail and possible scenario that could end up being a disaster.
  • qw 5y ago
    > I reached out to a friend at Cloudflare and shortly thereafter, the penny dropped Another advantage is his big network that he can ask for help. There's also a chance that his blog post will reach the right person in Azure and he'll get a reduced bill. As someone who doesn't have the same network or the "fame", I am concerned about what would have happened to me in that situation.
  • chasd00 5y ago
    Remember when no-sql came out and everyone was rushing to it because "rdbms don't scale"? I'm beginning to feel the same way towards "cloud" in the Azure or AWS sense. You can go really really far with standard issue VMs from linode or digital ocean and so on. I wonder how many are overpaying for Cloud services so far above and beyond what their actual needs are.
  • sydthrowaway 5y ago
    How are you teaching yourself?
• Nextgrid 5y ago
  Putting anything internet-facing on the cloud is as irresponsible as posting your credit card number publicly. Anyone can essentially charge you an infinite bill and you can't do anything about it until it's too late. Maybe it's not a problem when you're dealing with millions of VC money, but there's no way in hell I would host anything in a bandwidth-metered cloud service when my or my own company's money is involved.
• capableweb 5y ago
  Correct me if I'm wrong, but Troy Hunt is a person focusing on security, not infrastructure, deployments or development even. If anyone is near making that mistake, it's people like Troy Hunt. Operators would of course see the problem easily (paying for bandwidth like that would be the first warning sign), while they are sometimes blind to other issues, like security.
  • Closi 5y ago
    > Correct me if I'm wrong, but Troy Hunt is a person focusing on security, not infrastructure, deployments or development even. Eh, I don't know - either way he is a Microsoft Regional Director and MVP for Cloud (as well as security), runs courses on cloud deployment on Pluralsight, and has done speeches on Azure and reducing cloud bills, so if a he can get stung it doesn't say a whole lot good about my chances.
    • capableweb 5y ago
      Thanks for the correction :) I had no idea he did all of those things in addition to the security work. Certainly doesn't paint Azure or him in a good light then.
• brimble 5y ago
  There's an entire surprisingly-large industry built around providing better UI to the major cloud providers, so you can actually tell WTF is going on with billing, access control, networking, et c. They're so hostile that it has to be intentional.
  • scapecast 5y ago
    The underlying issue is that the cloud console is owned by a single product team, and THEY decide what gets exposed - not the underlying product teams for the individual services. At least that's the case for AWS. The result is that you get a lowest common denominator type of dashboard. And hence a whole industry of providing just a prettier dashboard on top of AWS / GCP / Azure metrics. Datadog started with a prettier dashboard for Cloudwatch data. Cloudability started with a prettier dashboard for the Cost and Usage Report. And also works the other way around. The individual product teams buy development environments to circumvent the console restrictions. For example, a few years ago, the Redshift team purchased "DataRow".