Serverless Horrors
Serverless and cloud hosting platforms are being criticized for exposing small sites to uncapped, potentially ruinous bills, especially when DDoS attacks or misconfigurations drive unexpected bandwidth or function usage. Commenters argue that the core problem is opaque, post‑paid billing and the absence of simple “kill switches” or hard spend limits, contrasting this with cheaper, more predictable VPS or self‑hosted setups. While some defend serverless as useful when properly configured and throttled, many see current pricing and protections as misaligned with the needs and risk tolerance of hobbyists and small businesses.
Billing risk and lack of “stop‑loss” controls
- Central concern: serverless / cloud platforms allow unbounded spend, especially on bandwidth, with no hard cap by default.
- Many complain that alerts are delayed, optional, and not enough; people want a simple kill switch or spending limit (e.g., “shut everything off at $X”).
- Some argue providers avoid this because it hurts revenue or risks shutting down paying customers during legitimate spikes.
- Others say it’s more about UX and complexity: it’s hard to design a universal, abuse‑proof “off” switch that isn’t confusing or dangerous in production.
DDoS, metered bandwidth, and pricing
- Several stories revolve around DDoS or misconfigurations triggering massive bandwidth bills, even on “free” tiers.
- Criticism that bandwidth is extremely marked up vs raw infrastructure (e.g., Hetzner) and is “pure margin.”
- Some note that traditional VPS/colo has natural caps (finite CPU/bandwidth) and far cheaper egress, so worst‑case bills are limited.
- Others stress that this is more about absurd traffic pricing and poor DDoS/traffic controls than “serverless” as such.
Is this a serverless problem, a cloud problem, or architecture?
- One camp: this is a generic cloud/billing problem; the same could happen with S3/CDN or any metered service.
- Another: serverless exacerbates it because pay‑as‑you‑go and “infinite” scaling make runaway costs easier than with fixed‑size VPS.
- Some point out that certain platforms (e.g., major clouds, Cloudflare, Vercel) do have throttling, concurrency limits, DDoS protection, or spend alerts—but often non‑obvious or incomplete.
Alternatives: VPS, self‑hosting, and tools
- Many advocate cheap VPS or self‑hosting for simple sites: costs are capped, tools like panels or PaaS‑on‑your‑own‑server can reduce admin burden.
- Pushback: secure, well‑managed VPS isn’t trivial for everyone; things like backups, SSH key rotation, and networking are non‑obvious.
- There’s debate over whether cloud providers have successfully convinced developers that VPS/self‑hosting is “too hard,” versus it genuinely being risky for non‑admins.
Broader reactions and meta
- Some welcome increased skepticism of serverless but worry about a knee‑jerk backlash.
- Others see these stories as illustrating how powerful tools plus opaque pricing and weak defaults create “cloud horror” for small users.