Surprise $104,500 Bill? Breaking Down A BIG Mistake

This video is NOT sponsored or endorsed in any way by my sponsors.
The price spike problem of Netlify, Vercel, and other modern tech startups is terrifying. I don't love how the narrative around all of this has gone though. Thought it was worth breaking down.
Ton of sources on this one
old.reddit.com/r/webdev/comments/1b14bty/netlify_just_sent_me_a_104k_bill_for_a_simple/
biilmann/status/1762924788350136475
daniel_nguyenx/status/1762383650765910034
news.ycombinator.com/item?id=39520776
Netlify/status/1762518910107033798
michaelaubry/status/1757539928534315322
rauchg/status/1743003771901452765
shoeboxdnb/status/1643639119824801793
kzbin.info/www/bejne/i2TJqpaNjKZkqsk
Check out my Twitch, Twitter, Discord more at t3.gg
S/O Ph4se0n3 for the awesome edit 🙏

[@t3dotgg]

Quick update: Between filming and publishing this video, Vercel announced that they're introducing options for a hard spend cap. Check out Guillermo's Twitter for more info

[@neociber24]

That's sounds great, there are a lot of projects that are just for hobby

[@cmkruger1697]

yeah definitely going to migrate over to Vercel now. That tweet scurrred me

[@Pete133]

Suspiciously good timing…

[@cthree87]

A hard spend limit puts the onus on the site owner and off the platform. DDoS should not be considered "spend" and not limit legitimate traffic. It also means (probably on page 87 of the agreement) that the limit means the owner is accepting liability for the cost of hitting the limit. This isn't ad spending limits, it's shutting down your site/business and taking it offline. Bad move

[@Dipj01]

@@cthree87still better than going bankrupt as a hobbyist. And for serious sites that don't want to shut down on DDoS, all they have to do is not enable the hardcap.

[@patrickwasp]

if your site can never be worth $100k, you should care way more about not getting that bill vs your site going down. There should absolutely should be bill limits.

[@smithastley1616]

I was only using Vercel to host a small React app that I show to potential employers. If they charge me even a $1 for this, that's already way more than I wanted to pay.

[@yozhis1]

@@smithastley1616 bUt yoU WeNt ViRal🤡

[@complexity5545]

Yeah, I don't know what theo was talking about here. Shut that site off. People like Theo make me wonder sometimes, but then I realize he's the Corp type. These teaching are unwise for entrepreneurs who don't want to strike it rich, but just make $250_000/yr or less or $50_000/yr. These guys are perverting programming and IT. That company is absolutely looking to "F" certain people/clients. Auto-scaling and auto-billing is bad (especially as a default configuration). Theo might be a gambler.

[@Pete133]

$100k is so much money… and a 3MB file is not even that big. If there is anything that makes me want to stay away from serverless, this is it by a long shot.

[@smithastley1616]

@@Pete133This right here is it. This should be a wake-up call for the serverless industry.

[@gadgetboyplaysmc]

Lol if this dude never got attention, imagine getting charged $5k for a static site.

[@yannick5099]

$55 per 100 GB? Hetzner charges like 1€ per 1 TB (20 TB initially included) of outgoing traffic or nothing at all depending on the service. It’s like the dark ages of SMS and mobile internet.

[@SpotDemo4]

The difference is that netlify uses a CDN, so you're getting PoPs in Europe, South America, East/West US, Asia and Australia. If you've ever used Hetzner's servers in Germany, you know the peering can get really bad.

[@thewhitefalcon8539]

That's right. That's what it actually should cost for a well connected data center. Maybe a few times that. Not 550 times that.

[@tenten8401]

Been with Hetzner for like 6 years now, probably will continue to be with them indefinitely until it's no longer an option. Prices are great, uptime's been great and whenever I've needed to ask support some dumb ipv6 networking questions related to their service or have them cancel a server or whatever they've been there. Ran off a small VPS the majority of the time there that hosted Mailcow email, wordpress website, VPN and couple other things. Bill never exceeded $12/m even when I hammered the VM with livestream video encoding for weeks straight. 20 TB outgoing bandwidth included, incoming is unmetered. Currently run off one of their server auction boxes, i7 7700, 64g ram and 2TB x2 HDD for ~$35/m. Needed a dedicated box so I'd have iGPU transcoding access for said livestreaming stuff :p

[@derockx]

yep they take AWS prices (which is what vercel is hosted on, and AWS is already expensive) and then multiply by like 10 then present that to you as the cost for using their service.

[@NithinJune]

well it’s because of interest rates. Companies can’t afford to burn money on unprofitable offerings

[@nishantdesai3705]

who are these viral services that are getting (0 to million users immediately) that I am not hearing about?

[@carlogustavovalenzuelazepe5774]

temporal piracy data maybe

[@J-wm4ss]

infinite craft probably

[@justingolden87]

It could be a marketing campaign for someone/something big, let's say Adelle or Pepsi or someone has a big marketing campaign, new website, commercials and tweets and it gets a hundred thousand viewers from nothing within an hour. If Netlify/Versel just took down the site because they thought it was a ddos, then Pepsi would NEVER use Netlify/Vercel.

[@hobbit125]

they live in the imaginations and aspirations of millions of Vercel users.

[@cw6913]

@@hobbit125temporarily embarrassed tech giants 🥴

[@wlockuz4467]

I think the worst part about this whole argument is that public callout is the only way to get something like this sorted. The more I think about it the more terrifying it gets. Its exactly like KZbin's copyright strike system, if a small guy gets unfairly striked there's no way he will get help, unless by some miracle he gets some attention in the community. You said "chill, it gets handled" as if that the case with every incident. There have probably been many cases that just got unheard of and that's sad because the only medium to get attention of these companies is Twitter. Companies don't need to worry about my moment of glory, they need to give me more control.

[@tedchirvasiu]

Yes, one of the main reasons most cloud providers kept me away. It's unreal how most of them don't implement such a simple feature as being able to set a spending cap. Just feels like a scam waiting to happen. It's like going to a restaurant, getting no menu and after you eat you get charged $100.000.

[@Dipj01]

yup, its intentional. They want that moneh, at any cost.

[@LV-md6lb]

The problem is that what about those who cannot just tweet. It should NOT be necessary to reach great publicity to have it handled appropriately.

[@asagiai4965]

That is actually a good opinion. What happened to actual customer service. The one which doesn't need you to have twitter/x or Facebook?

[@martini9388]

This is so true. The takeaway is that if you don't get your case spread virally in social media you are left with 20.000$ bill to pay for your hobby project. Hell no! thank you very much.

[@Burbanana]

a spend limit is a very basic and optional thing, and for many basic projects for students, teachers, or professionals who set up PoCs; it's such a useful tool. It's not about "I only have 100 dollars" Theo, because I know you have responded to a comment like that in a very ignorant way. It's about the budget you have for doing thes things. If your school or company, or yourself, sets a limit of 100 dollars and tells you that the rest is on your own dimes; you WILL want to limit that to 100 dollars before even starting to do anything, together with a warning at 75$. For many people, 100K isn't just a 'scary number', it's making or breaking their livelihoods. So please, take a step back and touch some grass.

[@Gornius]

This is insane for my. I am hosting all my hobby projects on single VPS instance. No CDN, no "Edge Computing". Just a server running in docker container and being reverse proxied. I can already see someone not using my hobby project because "This page loaded in 0.78s instead of 0.33s, duh...".

[@Dotshell]

fun fact: in 2006 the VP of Google said that half a second of loading time resulted in a 20% loss in traffic. glinden.blogspot.com/2006/11/marissa-mayer-at-web-20.html

[@turc1656]

I am doing the same thing, except for the docker container. Have multiple services and APIs, plus a 50gb DB all on a single Linux box on Linode for like $15 a month. Everything runs perfectly fine. Yes, these are hobby projects with very minimal traffic but I can also scale it relatively easy by beefing up the hardware with a few clicks and a reboot.

[@ryangrogan6839]

"Moment of glory" sounds a lot like encouraging someone to double down on their debt because you dont want to miss your jackpot. I would rather have my site halt dead in its tracks than to incur unresonble costs.

[@murtadha96]

At least make it an option. Maybe certain projects do require that hard limit when it comes to billing. Maybe I don't care if my personal blog dropped new requests, but I do if my startup site does.

[@MrLordLowbob]

yes and no, there are businesses that absolutely win out and generate lots of money with scaling traffic and for those a limit would be killing the project. The thing is, thats not the case for all projects and thats why there should be the _option_ to have a limit in place (and one should be asked on account creation if you want to set this limit and some few sentences of the implications of setting this vs not setting this. )

[@ryangrogan6839]

Yes, I agree, each business has its own model for profit. If scaling works, do it. But there are a lot of start ups where a bill can make or break your company. I too think it should be an option that you can edit at any time.

[@jamespeirce2582]

For “they don’t want this” to really feel genuine they would have had to pursue an honest solution *instead* of trying to negotiate a $5000 bill. That was predatory.

[@metropolis10]

I'm glad they are introducing hard caps. Especially on free tiers. I think you make great points for scenarios where going viral you want to auto-scale, but if your site has no way to recoup costs... i.e. no payments that will increase as traffic increases, no albums sold as your mp3 is downloaded... then I never want to have a "legit" 100k bill because I just don't have the money to pay it, no matter how popular my thing gets. No hard caps only make sense when you're able to scale your profits with the traffic.

[@MuhammadSaied]

55$ per 100GB bandwidth? Are they sending that file to Mars? that's 10 times more expensive than what it should be

[@av8419]

that is a SHOKING price

[@wlockuz4467]

Simply speaking Vercel is basically a wrapper around AWS, so its essentially: AWS charges + Vercel's operational charges + Vercel's margin

[@ExploringBeyond]

@@wlockuz4467 That's crazy that there's a market for this but makes sense. I recommend going with either DigitalOcean or Linode in the US anyway. You won't ever get a sticker shock. Although Linode might end up getting DDoS'd here and there which is why I don't use them anymore. But if AWS services are really needed then people should just take the free AWS training for a day lol It's enough to get started. But cloud isn't meant for everyday peasants like us. It's meant for enterprise who get into an enterprise agreement and get the benefits from cloud with a reasonable price if on-prem is not possible.

[@Sasoon2006]

Not 10, that is 500 times more expensive than it should be.

[@justingolden87]

@@Sasoon2006 where are you getting 10 cents for 100gb?

[@goodnight_noom]

"Vercel would probably not want me to make this video" -> proceeds to advertise Vercel for 27mins

[@desoxy2093]

yes...

[@benjaminhon86]

We don't know how many customers did not get refunded.

[@RemotHuman]

Some people want their site to live no matter what like you do, but some people have a different use case and aren't trying to go viral. That's why they should have the option for both. Not every use case is the same. That's probably why some people on twitter were saying to use one server because they don't care if there site shuts down when they go viral (other people do care rightfully)

[@hobbit125]

Theo: "I'd pay infinite $$ not to have my site go down." So relatable. So in touch with his audience.

[@MrHamsterbacke756]

As usual

[@TimeLemur6]

Missed the point much? If you're running a hobby site, that's valid. But I don't think that's what these services are really targeted at. If it works for you, great. But don't complain about it not meeting your needs over those of the target market.

[@jackdixon6681]

If the website is making you more money from visitors than it costs, then it makes complete sense.

[@hobbit125]

@@jackdixon6681 sure. but 99% of web sites are nowhere near the point that they can take a six figure oopsie on the chin in the name of "well, at least my site won't go down." And if you are, you can pay a lot less to just hire staff that knows how to set up AWS, etc. vs. relying on Vercel.

[@hobbit125]

@@TimeLemur6 the actual target market is people who think they are going to get the kind of traffic that warrants this. The ones who actually do generally aren't on Vercel.

[@kwando88]

You always have a different perspective of things, I find that enlightening. I would rather have my service be taken off the internet than having to beg for mercy on social media.

[@abel090713]

better hope to god the algorithm picks up your tweet.

[@dtkedtyjrtyj]

As someone who _isn't_ an extrovert. paying the 95% discount seems like a better option than going on X . I see something like this blowing up and assume it already happened ten times and whoever it was didn't complain hard enough.

[@Rundik]

Many of this companies don't even allow you to set spending limit. I think it's intentional at this point

[@sushiroikura]

Read the video title and got worried, I instantly went to netlify to check my billing. I'm on their free tier and they don't have my payment details...

[@jacoblockwood4034]

For context, video got renamed. The old title was "BREAKING: Huge Netlify bill goes viral" or close

[@rawallon]

It's funny how your profile picture matches the comment

[@yrnc]

@@jacoblockwood4034 yeah, old title was "BREAKING: Surprise Netlify Bill Goes Viral, Terrifies Developers"

[@itamarlu]

literally me right now

[@wlockuz4467]

Always use burner cards for hobby projects.

[@Dipj01]

Uhh, it doesn't have to be either or? We can have both options. You should be able to put a hard limit on it, or allow it to scale "infinitely".

[@murtadha96]

Precisely. But somehow, that simple idea, never occurred to ANY hosting provider. I wonder why.

[@Fupicat]

It's good that the providers are willing to refund giant bills, but there is no argument against implementing spend limits. It's just basic responsibility with your users, especially since these platforms made it so easy to infinitely scale (and infinitely rack up bills), when not every website needs that. Otherwise, this drama will keep repeating itself. That "discount" offer from Netlify support was embarrassing.

[@benjaminhon86]

Yep if people like theo want the can just set a spend limit of 1000000 but there should always be spend limits

- $55 per 100GB is crazy. Hetzner charges 1 euro per TB AFTER the first 20 TB. Bunny CDN charges $4.5 per 100 GB for the most expensive zone. - 3.44 MB file is not a big file IMO to be hosted with the rest of the website on a blog. Also if the file was 1 MB as you suggest at 20:00 the charge would still be insane at around $30000 right?

[@lazyh0rse]

"they don't mean it" what theo said. I mean, I would say that's their entire profit margins

[@danhorus]

If the file was 1MB, it could be downloaded 3x as much and the bill would be the same, right? The attacker is consuming bandwidth after all

[@jitx2797]

55$ is crazy man.... Honestly I can get a low spec dedicated machine on Hetzner for 55$ for whole month

[@arfathahmed3433]

Regardless of how many arguments we get defensive or otherwise, ultimately it’s ‘choice’. What the people are demanding is to have that choice. It doesn’t remove the problem it just adds trust in the platform which I believe a bill waiver and a nice public response doesn’t cut it for most.

[@martinlaak]

Theo - why not an option for spending limit? I should be deciding if I risk the site go down or risk a huge bill. Very much depends on the kind of site I am building.

[@martinlaak]

Sorry, just read your update. An option for hard spend cap is a good idea - especially when you are still developing and testing.

[@ghostinplainsight4803]

AWS refunded me ~$5K once when I accidentally switched on a large instance of Elastic Search.

[@twitchizle]

Ikr, they also refunded my 5 dollar when i exceeded free tier. Love them. Also i cant sign up aws anymore

[@sirsainted]

You basically just said "Your bill got refunded. Get over it." and holy shit bad take.

[@Wielorybkek]

going bankrupt on a hobby project is my greatest nightmare

[@asagiai4965]

Hot take. Having a Transparent pricing, ability to limit budget of services, and ability to learn usage is a must on this type of services.

[@Descent098]

Forgive my ignorance on this one. but for files like this are there not options to cache? I use github pages for most of my deploys and static files like these get cached to a CDN (cloudflare on my side). Or is this the price for outgoing bandwidth on their CDN? Edit: really should start finishing the video before commenting

[@kenneth_romero]

i feel that edit brother

[@arfathahmed3433]

For others - Cloudflare doesn’t charge bandwidth for cached content. Vercel charges for all bandwidth cached or not. Additionally, Vercel’s (and NextJS’) middleware act before cache, so nothing stops middleware from being hit which has its own overages. Adding Upstash rate limiting everywhere protects heavy operations but rate limiting itself has Redis read/write costs. We may be over thinking but for people like us who are cautious, an option of spend limit is very attractive

[@RemotHuman]

Will it still get refunded if you go public and you don't have any twitter followers?

[@simonhartley9158]

High traffic sites like Reddit and Hacker News would be the way to go in that case.

[@GoldenretriverYT]

Your bill will be kindly reduced to 5%!

[@AnotherComment-rl6fv]

all serverless should have a hard budget limit, i'd rather have a project go down than have such huge bills.

[@juwulez]

I just had this happen to me this past week with AWS and a 4k USD bill - and seemingly they just disabled/suspended my account before I was able to finish my chat with support and even the unfinished conversation there only resulted in a potential "billing adjustment" as well. In my case, I somehow accidentally spun up some AI compute resources, without even really noticing because I don't really know how it happened, and as far as I can remember / hypothesize I think it was a situation of "free tier" being time-capped instead of usage capped, which is a great way to end up with lots of people in this situation..... ugh.

[@Krzysiekoy]

This whole "make a viral social media post" and the bill gets voided sounds so fucking bad and horrifying. "I just tweeted", "somebody decided to 'go public'". What if your post don't go viral? What if you don't know any better? Its nice that these companies are willing to void the bills to avoid bad PR, but holy shit that dynamic sounds so fucked up. JESUS FUCKING CHRIST, allow for spending limits and allow the website to simply fail (if I want that) instead of whatever this whole situation is.

[@desoxy2093]

yes.

[@RaulRuizH]

I've shutdown all my projects in Netlify.

[@cmoullasnet]

Any service that has a free tier and doesn’t allow spending caps is trying to take advantage of this exact situation. There’s literally no other reason to not *offer* spending caps.

[@gardnmi]

I think the "ruining the moment of glory" is a bad argument for keeping your site alive. If you have something that people are interested in they will come back.

[@MrLordLowbob]

there is a point of things going viral vs not going viral though. people going to your site, experiencing cool shit, twittering about it. if they trickle in and only a few poeple can experience and share it, you may never come to that viral part because of algorithms doing their thing. tbh, thats still probably only relevant for a small share of web projects. spending limits should be at least an option - always.

[@Fanaro]

But it's kind of absurd that these platforms are taking that long to adapt to the age of DDoS attacks. The Stripe example is beyond any shame even.

[@vinaynk]

This is the case with many of the platforms now. They sell you the stuff in such a way that it takes a lot more effort to put some limits. Same with many cloud providers. Nasty business practices. You either pay in terms or money or in terms of self-respect.

[@MeriaDuck]

5:55 way back when the internet was very young (nineties), I worked at a company that was both ISP and hosting provider. A customer had a bad link published somewhere on national tv and the 404 page contained an image. That cost the customer lots of bandwidth. I, as a temp tech support guy, mentioned if they should warn the customer, but they decided not to... That customer was quite a large organization, and could probably pay. My point is, do not discount malice (played off as ignorance) too easily.

[@LuLeBe]

Lots of projects on these services are demos, personal projects, experiments etc. None of those need to be online. Even if my demo legitimately went viral and had 100k users, I'd rather have it shut down. I do not have $5k to spare on a sudden bill. I am no startup looking to break through. I enjoy programming and trying things out etc, and if something really went viral, I could still get a notification that it was shut down, investigate, think about it, and maybe get it back online the next day. Chances are my users would mostly return.

[@osiristeam6959]

That is exactly the problem I have with "serverless" hosts. Its good and all that they offer refunds, but I bet not a small amount of people still get screwed over because they failed to get media attention. Regular hosts with a fixed monthly price usually also offer ddos protection, however the ressources are limited which gives you a greater insentive to watch out for malicious users and performance bottlenecks in your own code.

[@bugged1212]

The future is hosting off your home servers. I have hosted a site with about 2-3k requests per hour that has run without any downtimes over months now. The cost of compute has gone down but the cost of cloud has not. The era of self hosting is going to be back again.

[@araozu]

I get your argument. The huge bill can be forgiven, but the lost customers won't forgive, they won't come back. I get it. It's true But what if I DON'T want to reach that scale? What if I'm writing a simple prototype? Or following a tutorial? Or just liked using Nextjs and I'm using it for a site that I EXPECT and WANT to have low traffic? Don't you think that I should be able to set a hard limit? Why should my hello world app be able to scale big, along with my bill? Why should that be the default? If I'm building the next big thing of course I want the escalability, of course I don't want to lose a single customer to a hard limit. But based on this video and your comments it seems that you think that I should actually want my hello world app to go viral, get those huge bills and be grateful that I wasn't allowed to set a hard limit. It makes no sense to me.

[@administrator4728]

I wonder if Theo here is going to make another video finally accepting how terrible this take is.

[@nickwoodward819]

"Get refunded every single time" They literally don't. He was given a discount, they had a specific policy for these situations. You think they'd have a policy if no one had ever used it and paid up?

[@explodingcamera]

Small correction, R2 has zero egress bandwidth cost.

[@snipernosnipey8162]

"I promise you if I had tweeted...", wow this guy is so disconnected from reality it hurts.

[@collinoly]

Haha first I would have to create a twitter account

[@jacoblockwood4034]

If you tweet about billing issues and @vercel, it's likely that they will respond, especially if the bill is big enough that it would merit retweets etc

[@zuma206]

He's not wrong. It still sucks that you need to relentlessly tweet to companies like Netlify and Vercel to get these sort of bills revoked, but he's not wrong. I've seen quite a few cases of bills like these being revoked after people reach out to higher-ups at these companies through twitter.

[@neociber24]

It's like KZbin, it's easier to contact them on Twitter specially if you are big that using THEIR actual customer support.

[@dakdevs]

I primarily use X for nearly ALL of my customer support. So I think it’s you that is disconnected from X.

[@LucasEKindinger]

The thing is: Why not provide a *option* to a hard limit to project? For example, I don't mind if my sideprojects or POCs goes down because it reach the ceil limit I previously set, and check later what to do. If someone expect your project to be viral, the ceil limit can be set to "off" (or even by default);

[@mrrolandlawrence]

not having a spend limit made me migrate all my databases from google to supabase as they have a spend cap. i slept easy after that. saying that you have no idea that your site might explode in popularity is no excuse for no spend caps. not all sites want extra traffic. i built apps for specific customers.

[@guidomaruccib]

What I don’t get about the argument of not putting a hard limit and then pause / stop the service or reject request is why not making opt-in? As the customer I should be able to put a hard limit budget for services that could spire out of control and I as the developer / business owner decide wether I’m ok with having authentic traffic but not having the budget and the willing to loose the traffic.

[@shacharronzohar6960]

I hate how Theo keeps defending these companies. One of the main problems with how Vercel and Netlify would barely give their customers the time of day, until they go public or an influencer notices them.

[@benjaminhon86]

These cloud companies make it really complex to set limits there should be a way to set a hard $ limit instead of some limit based of some weird resource usage

[@CarlosEduardoLeao]

The argument for ensuring the continuous uptime of my website is indeed valid, yet it shouldn't come at any expense. While allowing site owners to set an upper limit is essential, establishing a maximum billing threshold is also crucial to prevent unexpected surges. This precaution becomes especially relevant for smaller projects where temporary downtime due to errors is acceptable, rather than risking the stress of encountering exorbitant billing spikes unexpectedly. It's a tradeoff I'm willing to make to maintain financial stability and peace of mind.

[@le_ch1mp]

Their "hobby" tier should always limit automatically. You should have to "opt-in" to dynamic pricing/scaling. If you launch a product, campaign, etc. you usually expect things to scale proportionally and are aware that costs can spike (therefore you usually monitor the traffic for the duration of the launch / campaign). I left Netlify etc. exactly because of being scared of a hobby blowing up and bankrupting me.

[@yarrichar]

I agree with your point that these platform's promise of ease of use implying some level of protecting users from DDOS attacks etc. I'm not sure how to reconcile that with Guillermo's shared responsibility point though (which I also agree with). The way I read that is that there is a chance I won't get refunded if they believe they've done enough. But at the moment "enough" is very fuzzy and uncertain.

[@rickdg]

AWS wrappers exist precisely to handle these issues gracefully instead of dropping a bill unto the client. Even AWS themselves have been getting better.

[@rzr1191]

With AWS whenever our services experience an internal issue like too much unnecessary work, they either get slow or go down (and we get notified on slack). From there it's easy to either increase the elastic limit or investigate what's going on.... plus we don't get charged absurd markup for bandwidth Is that more work than just using vercel? Yes. Do we ever have to worry about surprise bills? Nope. Being able to set a spending limit is absolutely critical... it should be YOUR CHOICE! I love serverless (especially CF's implementation with v8 isolates) but seems like a lot of people are jumping on that train for bad reasons - they're choosing to simply pay more to avoid fixing the inefficiencies in their system. A simple rate-limit/spending-limit option would solve that problem

[@Galakyllz]

At 26:43 "Everytime this happens it gets handled". How do you know that? Where does this confidence come from? They told him to pay 5%, his post went viral, and now he's paying 0%. The fact that they had a counter offer at all tells me that this happens often enough and that most people pay it off. Why else would they even suggest a percentage. You're either naive or disingenuous and it's painful to listen to.

[@qariuki2587]

I think Netlify used the Anchoring tactic to make a sale here. I doubt that a site that serves 200 people a day got a DDoS attack. DDoS attacks are costly for the perpetrator as well so motive here is wanting. Even if you give Netlify benefit of doubt that the attack was real, how do they explain their inability to flag a website on their platform that was in free tier for 4 years suddenly becoming such a huge success? I would imagine they would be all over your inbox with special rates to keep you on their platform. I think Netlify got tired of this freeloader. How dare he uses free tier for 4 years. He was basically ripping them off. They then came up with this DDoS thing to make him cough up 5k using a Machiavellian tactic like Anchoring.

[@negativerfan]

Why not a have a switch for people who want to have the site live 24/7 that is toggled off in default state?

[@shadowpony9243]

this is why i prefer traditional hosting and not all the serverless junk ( not all are junk, but can easily become junk when coding incorrectly for a serverless environment )

[@BrentMalice]

is there anything else other than a ddos that could get you a random huge bill like this? that recursion bit kinda scared and confused me so that may be one and im just too dumb to understand, other than its loading itself a lot? im too poor to get charged that much while learnin too lmao. took my 4mb video off the site already and put it on youtube link

[@ggnova8581]

You can use cloudflare over vercel as cloudflare has option to cache js and css too and i use that over vercel and my bandwidth and speed also increases

[@kaioneal6160]

This is why we love Theo! Theo talks about things that really matter to engineers & developers. Theo addresses the many pain points we experience while providing perspectives from both sides ( the company & the devs / engineers ) and this is what makes him stand out amongst the rest.

[@blenderpanzi]

With React & Co. JavaScript assets are sometimes > 1 MB these days. (I know, insane.) So that can happen easily just with "normal" assets.

[@Mempler]

They should add an "Recently, there has been a lot of traffic. Is this correct ?" If you press "No" it should temporarily be artificially slow down requests, and "yes" should just continue the website as is

[@blinking_dodo]

Such an bill increase *should* have set off major alarm bells within the organization; they should have initiated contacted. If i suddenly got billed 104000 instead of just "19", i would simply refuse to pay. Rather, i wouldn't even want to use a service of which the pricing isn't fixed.

[@DryBones111]

The number one most obvious reason that it is the platform's responsibility to mitigate overages due to malicious traffic is that they want to get paid. Nobody in their right mind would pay a bill in the thousands on a hobby site. If you receive that invoice, laugh and throw it in the trash. If Netlify sends me a $30 bill, that's my problem. If they send me a $100,000 bill, that's their problem.

[@balkibartokomous]

Can't lie I worry about this all the time

[@onthefence928]

They should have a plan rate limit where going over incurs a fixed overage fine but doesn’t block traffic. The bill should then be followed up by a call with customer service to work out a better pricing plan for the new usage

[@monkyyy0]

I feel like any time a projects hosting cost 2x the last month of in a hourperiod an on call support person should do a spot check for if it's on reddit or a ddos and either congratulate or warn the user

[@AHN1444]

I'm about to launch a real estate CRM in which I store photos in a Google bucket. I am terrified by the fact that I can't set a limit, only alerts, but no actual limit. I will have to do workarounds in order to prevent this.

[@libradrag0n]

Restricting public access and using signed URLs is one way to have control. I've seen that done with automotive resale sites.

[@kmp3e]

What’s the point of a spend cap if it increases when you hit it?

[@murtadha96]

There isn't any spend cap.

[@Svish_]

Vercel Security Checkpoint is great, but... really wish there was an option between ON and OFF of "ON ONLY when there's unusually high traffic happening"

[@NuncNuncNuncNunc]

Not limited to startups. Google has the same problem and sometimes the DDOS comes from inside the house. No way to rate limit, no way to block IPs, no way to autolock site. Places API is a scam top to bottom. Spend limits on dev could save a lot of hassle.

[@christianknuchel]

This is the reason I avoid hosting that charges fees beyond the included bandwidth limit. It may throttle when hitting the limit, or be an unlimited bandwidth offer with a slow uplink, that's fine with me. Metered paid bandwidth without a limit in particular is a bankruptcy trap. *Never* do that if you're not a company or a millionnaire. This is a rule everyone should follow, unless they know they can ignore it, and *why* .

[@Sindoku]

What I would like to know is who puts the bill in a situation like this if it’s not the developer does notify put the bill I don’t think notify owns all their servers aren’t they just using something like AWS or maybe even AWS itself does AWS give them a break with AWS with the bill or whatever AWS company they are using their infrastructure as a service for?

[@narrei666]

why i want a spend cap: i have multiple apps, each for a company of 40-100 employees. i know my spend limits for each company im serving, skyrocketing like a startup is impossible.

[@Mempler]

Looks like vercel is playing the long game to prevent such mistakes in the future and potentially prevent that their customers go bankrupt and that they pay for honest mistake and bad pr. Which honestly is a great thing, certainly will use vercel in the future!

[@Dotshell]

I get not having "When your spending is over x$ your site goes down" being the default - but very often these services don't even offer the option of doing this. I wouldn't want to spend over 100$ on a site hosted on Vercel and i'd be 100% OK with my site going down when that limit is reached. when it reaches 10x that i don't want to have to go to support and negotiate over a bill i wanted to avoid in the first place.

[@abrahamsimonramirez2933]

If own the servers and infrastructure cost why you have to charge according to scalability? just make a fixed price for each tier and of course the custom ones for the corporations but still a fixed price, that's the only ethical way to go about it.

[@EmreCan-ky1vn]

Can't we have a safe mode that it blocks these kind of things. Also sends emails like "Hey safe mode blocked this action. Wanna check?"

[@sourabhshukla6123]

I still think the option for spend limit should be provided or at least option to set up spend alert should be provided as these kind of stories only scare beginners to deploy their hobby projects publicly.

[@IanZamojc]

a 3.5MB file isn't even that large an asset considering the 5MB unoptimized hero images that make it into landing page designs. There can be even fatter asset targets lying around that are critical for a site to work.

[@rvdende]

The answer is to enforce setting a spending limit when creating the account.

[@RamiroFarias1]

The thing is, I actually DO want my site to go down after X amount of dollars. If you host small projects for interviews or for yourself, there shouldn't be any "moment of glory", every spike in traffic is a DDOS. An optional, non-default hard limit on spending would be a great solution for everyone.

[@brandonmansfield6570]

I've researched this topic to death. The cloud billing spike. Devs like memory safe languages. People and businesses like billing safe services. Billing safe is likely much more important for most. When something like this happens it clearly demonstrates that the service is NOT billing safe. The cash grab play which Theo criticizes is closer to the truth than many realize. Companies will often cough up such billing spikes. Clearly the Netlify play is to negotiate down for those who bother to call. Indicating that yes, they do want this money and this is part of their planned strategy. Or at least was. Sure, they don't like the optics but they often do like the cash that comes in more, otherwise real financial controls would be offered. Which is always a highly demanded feature. Some billing spikes have bankrupted companies, these stories are hard to find because the organizations no longer exist. There is a very clear survivorship bias at play in these stories, hard to tell how much of the requested "forgiveness" of spikes actually happens. It makes those of us who pay close attention to this very nervous about these services. That is also why you see the response that you do.

[@alexmipego]

It's very convenient you can't easily know the origin of the DDOS. For all you know, your own cloud provider is buying the ddos.

[@nothingtoseehere5760]

It's not ok to cause this kind of stress. They could have simply reached out to investigate before sending the bill and it would have avoided all this mess.

[@FranzAllanSee]

Sounds like Customer Success has a revenue KPI - that’s why their knee jerk reaction is to charge and not the customer’s success

[@yashsaxena9]

Damn, new fear unlocked. do I need to take down my website now :(

[@DanielVagg]

Possibily was a copyrighted sound file. When I was managing the student dev servers at a university in Australia, students would upload copyright movies, clips and music. We would commonly hit the generous bandwidth limits we set (always the movie or mp3 directly), my guess at the time, was DDoS from publishers to take the offending site down.

[@weltsiebenhundert]

Why a billing max is bad? Or a RED EMAIL if x10 traffic? Make it just a default checkbox, so you can uncheck it.

[@bluescorpian]

I feel like there should be bill limits for dev projects.

[@noriller]

They could add something like: "how will the project scale?" then if you put it as "nope", then more than 100 users would already be sus. Then you could have other options like expecting 1000 users by end of month, or whatever... Then, of course... maybe AI (or just statistics) to check if growth seems to be within the expected range. So you could be notified with: "is that success in you app or you just being spammed?" And also: so, remember when you said it would scale to 10k? Is everything ok there buddy?

[@dae2530]

If one address hits for only one file, but not for most files required for the page, that's an anomaly.

[@frustratedalien666]

My wife built an AWS account for her co-op project and got a bill of $4 and we were pissed off about that. Imagine getting $104k. She'd probably give up on this profession lol

[@RomediusWeiss]

TIL: before I start to fiddle with those services it is good to create a limited company to avoid personal bancrupcy as an additional firewall

[@CatMeowMeow]

I would like a hard spend option on all platforms. Everything I do is something I would rather have gone down then spend $20 on. If my bill is $20 something is really wrong. None of my projects intend to make money. They just intend to serve a niche group of a few hundred people with no revenue.