10 ms·
When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No pr
by phoenixhaber 1y ago
When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No problem that makes sense - it's an easy way to prove authentication as a bot can't spam a credit card (or else it would be financial fraud and most likely a felony).
Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. I had them refund the bill (as in how am I going to pay it?) but to this day I've hated Amazon with a passion and if I ever had to use cloud computing I'd use anyone else for that very reason. The entire service with it's horrifically complicated click through dashboard (but you can get a certification! It's so complicated they invented a fake degree for it!) just to confuse the customer into losing money.
I still blame them for missing an opportunity to be good corporate citizens and fight bot spam by using credit cards as auth. But if I go to the grocery store I can use a credit card to swipe, insert, chip or palm read (this is now in fact a thing) to buy a cookie. As opposed to using financial technology for anything useful.
- croes 1y agoThat’s why I prefer prepaid cards or those I can easily freeze to prevent any booking.
- jsheard 1y agoIf your card is declined and they don't feel like forgiving the bill, won't they just send debt collectors after you instead?
- croes 1y agoYes, but it's better they need to get their money than you need to get your money back. 100.000 easily can put you in ruining debt. It's the better position to still have your money even if you have to pay.
- kleinsch 1y agoFreezing a card doesn’t mean the debt is erased. They can still take you to collections.
- 1oooqooq 1y ago"your honor, they provided the credit card to prove their identity for the free plan and now we want to collect 100k"
- cjbgkagh 1y agoI’ve not read the fine print but I’d be worried that there would be something in there that allows this.
- Nextgrid 1y agoThere are light-years between what a company thinks their ToS “allow” and what a court would actually determine is allowed. Plenty of ToS clauses in major contracts are unenforceable by law. In this situation if it were to actually go to court I’d expect the actual bill to get significantly reduced at the very least. But because it’s a completely bullshit charge based on bandwidth usage (which costs them nothing) it won’t go anywhere near that and will just get written off anyway.
- cjbgkagh 1y agoCourts can be rather capricious, I’d rather avoid them as best as possible, even if you are likely to win having to fight something like this in court is punishing.
- motorest 1y agoAnd then they pull out the invoice where they prove without any doubt that you actually used pay-per-use services and ran up a 100k bill because you failed to do any sort of configuration.
- 1y ago
- franktankbank 1y ago[flagged]
- hvb2 1y ago> The entire service with it's horrifically complicated click through dashboard (but you can get a certification! It's so complicated they invented a fake degree for it!) just to confuse the customer into losing money. By that logic, any technology that you can get certified in is too complicated? Most systems are now distributed and presenting a holistic view of how it was designed to work can be useful to prevent simple mistakes. Traffic requires a certification (license) too. Must be a fake degree as well because they made it too complicated
- cyanydeez 1y agoThe history of making things complicated often involves "unintended" use by malicious actors. But infact, it is intended side effects. Things like Jaywalking or "no spitting" laws let police officers harass more people _At their whim_. And they're fullying designed that way but left as "unintended" for the broader public scrutiny. So, just like, learn that "logic" is not some magic thing you can sprinkle on everything and find some super moral or ethic reality. You have to actually integrate the impact through multiple levels of interaction to see the real problem with "it's just logic bro" response you got here.
- awestroke 1y ago> By that logic, any technology that you can get certified in is too complicated? In IT, I am inclined to agree with that. In real engineering, it's sometimes necessary, especially dangerous technology and technology that people trust with their life
- cuu508 1y ago> dangerous technology and technology that people trust with their life Software runs on so many things we depend on IMO it also in many cases falls in the "dangerous technology" category. Non-hobby OSes, non-hobby web browsers, device drivers, software that runs critical infrastructure, software that runs on network equipment, software that handles personal data, --IMHO it would not be unreasonable to require formal qualifications for developers working on any of those.
- ctvo 1y agoI took a workshop class and was told to setup a track saw. The course didn't bother explaining how to utilize it properly or protect yourself. I ended up losing a finger. I truly hate Stanley Tools with a passion and if I ever need to use another track saw, I'll use someone else.
- jsheard 1y agoProtect yourself how? Most cloud providers don't support any way to immediately abort spending if things get out of hand, and when running a public-facing service there are always variables you can't control. Even if you rig up your own spending watchdog which polls the clouds billing APIs, you're still at the mercy of however long it takes for the cloud to reconcile your spending, which often takes hours or even days.
- mlhpdx 1y agoYes, they do. You create resources and you delete resources and if you care about cost you creat alarms and tie them to scripts that automatically delete resources. It’s basic stuff.
- Galanwe 1y ago> I ended up losing a finger You forgot to mention Stanley Tools paid for the hospital bill.
- 1y ago
- JJMcJ 1y agoThis is an example of why cloud hosting is so scary. Yes, Amazon, and I assume Azure and Google's cloud and others, "usually" refund the money. But I don't want to be forced into bankruptcy because my five visitor a week demo project suddenly becomes the target of a DDOS for no reason at all and the hosting company decides this isn't a "usually" so please send the wire transfer.
- JackSlateur 1y agoThey have billing limits https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html https://docs.aws.amazon.com/cost-management/latest/userguide...
- agwa 1y agoThose are not in fact limits: > There can be a delay between when you incur a charge and when you receive a notification from AWS Budgets for the charge. This is due to a delay between when an AWS resource is used and when that resource usage is billed. You might incur additional costs or usage that exceed your budget notification threshold before AWS Budgets can notify you, and your actual costs or usage may continue to increase or decrease after you receive the notification.
- appreciatorBus 1y agoThese aren’t limits though, they are just budget notifications. What would be helpful, would be if when you set up your account there was a default limit – as in an actual limit, where all projects stop working once you go over it - of some sane amount like $5 or $50 or even $500. I have a handful of toy projects on AWS and Google cloud. On both I have budgets set up at $1 and $10, with notifications at 10% 50% and 90%. It’s great, but it’s not a limit. I can still get screwed if somehow, my projects become targets, and I don’t see the emails immediately or aren’t able to act on them immediately. It blows my mind there’s no way I can just say, “there’s no conceivable outcome where I would want to spend more than $10 or more than $100 or whatever so please just cut me off as soon as I get anywhere close to that.” The only conclusion I can come to is that these services are simply not made for small experimental projects, yet I also don’t know any other way to learn the services except by setting up toy projects, and thus exposing yourself to ruinous liability.
- DanielHB 1y agoYou are attributing to greed what can easily be explained by just not giving an f. They don't care that much about small customers.
- motorest 1y ago> When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. Is it just me or is this just a cheap excuse to grab a payment method from unsuspecting free-tier users?
- zdragnar 1y agoAWS services aren't designed for people just learning to program. Beanstalk and other services have billing limits you can set, but those aren't hard limits because they are measured async to keep performance up. With that said, AWS is notoriously opaque in terms of "how much will I pay for this service" because they bill so many variable facets of things, and I've never really trusted the free tier myself unless I made sure it wasn't serving the public.
- raw_anon_1111 1y agoAs does Lightsail…
- Disposal8433 1y ago[dead]
- xhkkffbf 1y agoSomething similar happened to me, but not at the outrageous scale. I wanted to try some AI example on Bedrock. So the tutorial said I needed to set up some OpenSearch option. Voila. A few days later I had a bill for $120. The scale is not as horrible, but the principle is the same.
- cjbgkagh 1y agoI use AWS out of expedience but I hate the no-hard-cap experience and this is my primary reason for shifting (WIP) to self hosting. Plus self hosting is cheaper for me anyway. In general I would like a legally forced liability limit on unbounded subscription services, perhaps a list maintained at the credit card level. If the supplier doesn’t like the limit they can stop supplying. The surprise $100K liabilities are pure insanity.
- wiether 1y ago> When I was learning to program through a bootcamp I spun up an elastic beanstalk instance Didn't the bootcamp told you to, at least, setup a budget alert? I'm not trying to reduce AWS' responsibility here, but if a teaching program tells you to use AWS but doesn't teach you how to use it correctly, you should question both AWS and the program's methods.
- deleted 1y ago[deleted]
- jauntywundrkind 1y ago> cloud computing I'd use anyone else for that very reason. The entire service with it's horrifically complicated click through dashboard just to confuse the customer into losing money. I feel like this brand of sentiment is everywhere. Folks want things simple. We often figure out what we need to do to get by. Over time we learn the reason for a handful of the options we initially defaulted through, find cause to use the options. Some intrepid explorers have enough broader context and interest to figure much more out but mostly we just set and forget, remembering only the sting of facing our own ignorance & begrudging the options. This is why k8s and systemd are have such a loud anti-following.
- jcims 1y agoI've got a $25k bill right now because I had enabled data-plane audit logging on an sqs queue that about a year ago I had wired to receive a real-time feed of audit events. So for every net-new audit event there would be an infinite loop of write events to follow. My average daily bill is about $2 on that account and has been for nearly ten years. It suddenly ballooned to $3k/day and zero warning or intervention from AWS.
- mikeocool 1y ago> I had them refund the bill (as in how am I going to pay it?) but to this day I've hated Amazon with a passion They refunded you $100k with few questions asked, and you hate them for it? I’ve made a few expensive mistakes on AWS that were entirely my fault, and AWS has always refunded me for them. I imagine if Amazon did implement “shut every down when I exceed my budget” there’d be a bunch of horror stories like “I got DDOSed and AWS shutdown all my EC2s and destroyed the data I accidentally wrote to ephemeral storage.”
- franktankbank 1y agoIn what world is that not the preferable solution? Want to know if your shit is actually robust just set your cap and ddos yourself as the first test of you architecture.
- VectorLock 1y agoYes, a sign of resilient architecture is to shut down when it encounters some stress.
- franktankbank 1y agoConsider it like a crumple zone in a car.
- VectorLock 1y agoOops you hit a pothole now your car won't go. Terrible analogy.
- deleted 1y ago[deleted]
- 0cf8612b2e1e 1y agoGiven how complicated configuring AWS is, surely there could be some middle ground between stop all running services and delete every byte of data. The former is surely what the typical low spend account would desire.
- ChrisMarshallNY 1y agoThese "refund after overcharge" things are not without benefit to the corporations. They get a nice tax write-off. It's couch-cushion change for them, but it adds up. They have whole armies of beancounters, dreaming this stuff up. It's also the game behind those "coupons" you get, for outrageously-priced meds that aren't covered by insurance. If they charge $1,000 for the medication, but give you a "special discount" for $90%, they get to write off $900.
- franktankbank 1y agoSmells like fraud.
- __loam 1y agoYeah man the whole industry is like that. OpenAI gets to say they raised X billion dollars and update their valuation but they don't mention that it's all cloud compute credits from a gigantic Corp that owns a huge amount of the business. They claim to be a non-profit to do the research then when they've looted the commons, they switch to for profit to pay out the investors. There's shit like this throughout the industry.
- Nextgrid 1y agoA lot of things are "fraud" when an individual or small business does it but perfectly normal and considered merely good business acumen when done by a big corporation. Even more so now that the US government is openly for sale (it was always for sale, but before at least they had the decency to pretend it wasn't).
- alberth 1y agoI’m fairly certain that’s incorrect. Businesses are only taxed on actual revenue earned. What you decide to charge—whether $100, $50, or even giving it away for free—is purely a business decision, not a tax one. — This is different from a nonprofit donation scenario though. For example, if your service normally costs $X but you choose to provide it for free (or at a discount) as a donation to a non-profit, you can typically write off the difference.
- VectorLock 1y agoAmazon refunded you and you hate them for it? I think one of the reasons I appreciate AWS so much is that any time there has been snafu that led to a huge bill like this they've made it pretty painless to get a refund- just like you experienced.
- Vvector 1y agoIf it is a "free tier", Amazon should halt the application when it exceeds quota. Moving the account to a paid tier and charging $100k is not the right thing to do.
- cperciva 1y agoGood news! This is exactly how the free tier works now.
- christophilus 1y agoI agree, but I could also see how someone would complain about that: “Our e-commerce site was taken down by Amazon right on our biggest day of the year. They should have just moved us up to the next tier.”
- ndsipa_pomu 1y agoSeems like the most flexible option is to put a spending limit in place by default and make it obvious that it can affect availability of the service if the limit is reached. My credit cards have credit limits, so it makes sense that a variable cost service should easily be able to support a spending limit too.
- pixl97 1y agoThen let that be the non default option.
- derefr 1y agoThe default option is always going to be the one that makes the majority of Amazon's paying customers happy.
- hk1337 1y agoIt’s interesting because on the posted site there’s only 2 AWS posts on the main page and they’re rather mild compared to the other posts using google, vercel, cloudformation, etc.
- bratwurst3000 1y agoallways set cost alarm and max spending. AWS has great tools to controll costs. You could have blocked this with good config but I understand its confusing and not super apparent. IMHO there should be a pop up or sth asking " you want to stop the instance the moment it costs anything?" its so easy to get billed a ridicules amount if money
- 104 1y ago[dead]
- 62 1y ago[dead]
- clickety_clack 1y agoI’ve never trusted AWS with personal work for exactly this reason. If I want to spend $20 on a personal project I should be able to put a cap on that directly, not wake up to a $100k bill and go through the stress of hoping it might be forgiven.
- alkonaut 1y agoI would never use a cloud service that doesn't let me set a hard cap for any service. Not just an alert. A hard cap.
- damontal 1y agoWhich cloud service does this?
- alkonaut 1y agoI have no idea. I know Azure does for the student/msdn/and similar accounts which are the only cloud services I use for personal projects. So I Azure doesn’t even have my credit card.
- deleted 1y ago[deleted]
- spyspy 1y agoCloud Run lets you cap the number of instances when you create a service. So you can just set max_instances to 1 and you never have to worry about a spambot or hug of death from blowing up your budget. I run all my personal sites like this and pay (generally) nothing.
- deleted 1y ago[deleted]
- wutwutwat 1y agoYou had a credit card with not only a $100k+ limit, but allowed a single $100k transaction on it? I call bullshit
- raincole 1y ago> Amazon then charged me one hundred thousand dollars > as in how am I going to pay it? Really? Amazon charged your card for $100,000 and your bank allowed it? You're filthy rich by most people's standard, and you were able to pay it. Amazon was operating in such a good faith that they ate the computational cost you spent. And you hate them for this to this day...
- catlifeonmars 1y agoLet’s be real: OP needed that money way more than Amazon does.
- mlhpdx 1y ago> Amazon then charged me one hundred thousand dollars as the server was hit by bot spam. That would make you one of the most successful websites on the internet, or the target of a DDoS -- which was it? I assume you're not saying that "bots" would randomly hit a single, brand-new "hello world" site enough to generate that kind of bill.
- pclmulqdq 1y agoMany of the people who have this problem on toy websites end up offering what amounts to free storage or something similar. They are then surprised when "bots" come to "DDoS" them. These bills are as much a product economics problem as a technical one.
- kmoser 1y ago> required a credit card to prove your identity Given the relative accessibility of stolen credit card info, isn't the CC-as-ID requirement easy for a criminal to bypass?
- Nextgrid 1y agoIt's easy yes, but better than nothing. The verification requirements are a balance between desired conversion rate, probability of loss (how many bad guys want to exploit your system without paying) and the actual costs of said loss (in this case it's all bullshit "bandwidth" charges, so no actual loss to AWS).
- phoenixhaber 1y agoSince this seems to be getting some comments. Yes, it is in fact easy to shut down an instance if it goes over a spending limit. As in you monitor traffic tied directly to the billing system and you set up an if statement and if it goes over the limit you shut down the server and dump the service to a static drive. It's the easiest thing in the world - they just don't want to because they figured that they could use their scale to screw over their customers. And now you have the same guys who screwed everyone over with cloud compute wanting you to pay for AI by using their monopoly position to charge you economic rents. Because now things like edge compute is easy because everyone overspent on hard drives because of crypto. And so you have jerks who just move on to the next thing to use their power to abuse the market rather than build credibility because the market incentivizes building bubbles and bad behavior. Smart evil people who tell others "no you're just too dumb to 'get it' (oh by the way give me more money before this market collapses)" are the absolute bane of the industry. It's weird that you have people in here defending the practice as if it's a difficult thing to do. Taxi cabs somehow manage not to charge you thousands of dollars for places you don't drive to but you can't set up an if statement on a server? So you're saying Amazon is run by people that are dumber than a taxi cab company? Ok, well you might have a point. And this is how Waymo was started. I may or may not be kidding.
- rstupek 1y agoNot defending the practice of the cloud providers but you’re oversimplifying the difficulty involved.
- belter 1y agoDid you do any training before launching the elastic beanstalk instance, or you just though a F-16 should be pretty easy to fly, at least according to most pilots?
- crote 1y agoAn F-16 doesn't have a prominently-featured "getting started" tutorial, which has a bunch of step-by-step instructions getting a complete novice 40.000ft into the air at mach 2. AWS also provides training and education on how to use their services. If launching a "hello world" Elastic Beanstalk instance is so dangerous, why doesn't the tutorial require you to first provide proof that you are an AWS Certified Cloud Practitioner?
- belter 1y ago> doesn't the tutorial require you to first provide proof that you are an AWS Certified Cloud Practitioner? An idea I can stand behind. Or do you just let any "self-learner" take care of your banking Oracle or IBM DB2 database...?
- bdangubic 1y agoc’mon mate, be real. aws is absolute shit for beginers, this is such a bad comment
- belter 1y agoYou might have not noticed...But you are making my point for me....
- 63stack 1y agoDo you often find F16s that are (advertised as) free, and you get them with a click of 3 buttons?
- belter 1y agoDo you agree that if they would, they would still be an F-16 ?
- nothrabannosir 1y agoNot that Amazon needs any defending, but for anyone running a bootcamp: this is a good reason to start with services like Heroku. They make this type of mistake much harder to make. They're very beginner friendly compared to raw AWS.
- Etherlord87 1y ago> When I was learning to program through a bootcamp I spun up an elastic beanstalk instance that was free but required a credit card to prove your identity. No problem that makes sense It does on the surface, but what doesn't make sense is to register with a credit card and not read the terms very carefully: both for the cloud service and for the bank service. In this aspect cash is so much better because you have only one contract to worry about...