Not to mention the strong conflict of interest for netlify, who stands to gain from their customers being attacked. Netlify is getting paid for something criminal in nature having occurred.
It's like who is responsible for credit card fraud? If customers are responsible for credit card fraud, and it's their responsibility not to get scammed, then who implements fraud prevention measures and what effect would that have on the volume of fraud?
I don't really get why people put their tiny static sites on hosts designed to never fall over no matter the traffic generated, no matter the situation. You're running a blog, not a government service. You don't need AWS or Netlify.
The ability to withstand almost any DDoS attack for a high price is a valuable service. It's not a scam. The people who get these huge bills just picked a hosting service that doesn't fit their requirements. I can promise you that the $3 shared hosting providers won't charge you $5k, five minutes after the DDoS starts your site just goes down.
The core product is already enterprise-grade. Netlify's pricing page basically turns into a "contact sales" button when you select "enterprise", probably for businesses that did their math and are trying to get a discount. Everything about their website seems to target medium to large businesses or hopeful startups.
You're assuming Netlify is paying for bandwidth in $/GB, when in reality they're probably paying $/gbps and thus have no costs to cover when a customer temporarily bursts their bandwidth.
In your example, a DDoS sucking down bandwidth would cost more than a DDoS would had it been about total transfer volume. Their servers can only produce a set amount of network traffic at a time and on one single day, this one customer sucked up 5½gbps continuously, based on the 60TB figure provided in the reddit post.
This kind of extremely bursty traffic takes capacity that would otherwise be usable for tens or hundreds of customers, but to meet their guarantees, they must scale out massively to catch these bursts. I think it makes sense that making them dip into their bandwidth reserves should cost more than the average cost of a network transfer.
I don't know the actual costs Netlify has, and I'm sure the support rep saying they can drop this down to 20% or even 5% shows that there's a buffer here, but the 5 grand OP was asked to pay seems to come awful close to what you would pay on other high-reliability providers, such as Amazon. The max fee is probably to push their expensive customers into special deals (or to their competitors), but I find their 5% offer quite reasonable.
There's also the question of whether Netlify is even accurately tracking this bandwidth...
Budget hosters will either cut you off completely (shut down your VPS) or throttle your network. For instance, Contabo doesn't charge extra, but it does reduce your network speed to 100mbps if you're exceeding an average connection speed of 100mbps over a timespan of 10 days. Leaseweb offers you the choice to power down a VPS when exceeding the bandwidth cap (though this is disabled by default).
If you need more bandwidth, Hetzner is popular, and charges around €1 per TB of bandwidth if you exceed their free bandwidth (+VAT, the $104k bill would be €40 under Hetzner, as 20TB is included for free) and provides configurable automated traffic email notifications before you hit that. Personally, I would add a warning after the very first terabyte, because I don't know what personal project even uses that much bandwidth.
Their dedicated servers don't seem to have a bandwidth limit, though there seems to be a fair use policy (there's this thread: https://lowendtalk.com/discussion/180504/hetzner-traffic-use... where a user complains about Hetzner threatening to end the contract after exceeding 250TB of traffic).
Many VPS providers and shared hosters won't send you these huge bills, but you should always read up on their policies when renting servers of any kind. These hosters don't come with free tiers (which I assume is the reason people consider services like Netlify in the first place) but they will usually tell you how they deal with bandwidth issues in their FAQs.
I think you could argue that Netlify is guilty of racketeering in OP's case.
1. They admit illegal activity happened (a DDoS attack).
2. They demand money to be reimbursed for the illegal activity. However, the reimbursement they ask is several hundred times higher than the actual damages incurred.
Upon review, it does not look like this is the case. I have several very low traffic projects on which would have never been anywhere close to the free limit. However, if I get involved in a random spam attack, it seems I could be on the hook for several thousand dollars.
This is incredibly dangerous. Netlify is often used as a beginner friendly free tier for static hosting. Not as something that is cheap, but as something that is free. This is just an overall dangerous position to put people in.
The price of cdn bandwidth is about 0.01/gb on low volume (cloudflare, aws, azure…) so op should be billed around $500 with 40TB. Netlify probably buys this for way less. He was presented a bill at $104k, « generously » reduced to $5k, still a x10 margin. Vercel and Netlify are outrageously expensive for what they do.
Are they also transparent about the fact that they
1. Won't do anything about a DDoS, and
2. In case there's a DDoS (or some other unusual traffic spike), you'll only get notified waaaaay after the fact when you get the $100K bill, instead of getting a timely alert that would allow you to shut your site down to prevent getting extreme charges?
No and no.
It's a scam.
Not too mention: if the primary purpose of these services is to allow a DDoS and then charge the user for it — then, yup, you're guessing it right: it's a scam.
When their business model makes DDoS attacks profitable for them... They're not in the hosting business, they're in DDoS/extortion business.
they could ask the user for their budget when they are setting up their account as a basic guardrail, or they could give you a call
What I think Netlify needs on their Plans page is to include "DDoS attacks is included in your traffic" as well as their 20%/5% charge system.
> and can see why the lack of limits would make it a bad option for plenty of people
Just out of curiosity, can you see any scenario where it WOULD be a decent option to use a free tier where you may be hit by a $20,000 or $5,000 bill out of the blue and outside of your control? You say "plenty" so I assume you consider this a reasonable system to some?
Who controls the DDOS bots? Are they truly a separate entity? There is no direct evidence to link them together, but you would think that an honest company would be more proactive in preventing problems like this for their customers.
According to the linked reddit story, this is a known issue with Netlify and their response to past incidents is basically to pound sand. It all adds up to them purposefully trying to find ways to generate a high bill for their customers and hoping a small amount will pay for it.
> they probably should have a giant warning page for new users who don't know that this is how this kind of service works
Pick one