Hacker News Reader

Comment by tedggh | Hacker News Reader

I got a 20K bill once and it was actually drafted from my bank account. It took me a couple of months and involving the office of the AG of my state to get the issue resolved and get my money back. Since then I never touched any AWS product, moved my small stuff to Azure. It’s been years since AWS have these issues with billing, you can find the stories online, students billed 60K for a compromised account launching servers to mine crypto which AWS somehow was unable to flag and block, and let run for months.

View on HN

AWS is basically a utility. I think it's inevitable that their carelessness around billing will end up with them being regulated like one.

I can't think of another regulated utility that doesn't provide service to (essentially) all humans directly in their homes.

Everyone knows what water and electricity are, the vast majority couldn't explain what service AWS provides.

And utilities are typically natural monopolies. They're good candidates for regulation because they're essentials and they don't have competitive forces to keep them behaving reasonably.

AWS has plentiful competitors. If you don't like their behavior, don't patronize them!

I wonder what fraction of homes don't load anything from AWS on a daily basis. I suspect it's way below 50%.

(Of course, they don't know they're using it, they're using a service on it)

That’s why you always use a spend limited card with variable cost providers.

Or just own your own hardware. Spend a few bucks at Microcenter, build a machine, and there's simply no mechanism by which they could decide later that you should actually pay 100x more, and then magically suck it out of your bank account.

None of this can happen unless you first cede control.

Most debit/prepaid cards will get rejected. Credit Cards technically have a limit but they really don't. It's an open line to your finances.

I’ve never had a limited card get rejected. Granted I use ones from privacy.com. That’s also what I have hooked up to my aws / amazon.

They are also not all that limited. I used a Privacy.com card for a New York Times trial subscription, which of course I could not cancel online, so I just let it expire. A few days past the renewal date, I saw a $waytoomuch charge on my card.

I wrote to Privacy, and this was their reply:

> Jun 1, 2022, 5:21 PM EDT

> I've been reviewing your dispute and wanted to touch base with you to explain what happened.

> It appears that the disputed charge is a "force post" by the merchant. This happens when a merchant cannot collect funds for a transaction after repeated attempts and completes the transaction without an authorization — it's literally an unauthorized transaction that's against payment card network rules. It's a pretty sneaky move used by some merchants, and unfortunately, it's not something Privacy can block.

> We are refunding the transaction to the original funding source used for this purchase. You should see this refund reflected in your bank statement in the next 5 business days. However, please note that since this merchant uses force posts, they will continue to do this monthly until the subscription is cancelled. Please contact them to have the subscription cancelled.

> Let me know if you have any questions or concerns!

That seems like it shouldn't be even allowed.

For a while I had a portion of my "homelab" on AWS. I was an educator in a classroom where the students were learning cloud stuff, and the instructor was encouraging the students to stand-up cloud environments for learning, so I figured that I would do the same.

I used AWS' free tier, of course, and I enjoyed the initial setup in EC2, and I did a LAMP-stack MediaWiki installation. It wasn't too difficult, but two things sent me away forever.

1. It was impossible, or at least highly labor-intensive, in this modern era to adequately secure an ordinary Linux system running Internet-facing services. I put fail2ban and I filtered a lot of ports, and still spammers attacked me on Layer 7.

2. It was impossible, actually impossible, to limit or cap my cloud expenses in any billing cycle. Sure, run free-tier all I want. Sure, come in within the limits almost every month. But if I configured one thing wrong, or one thing went runaway, I'd have a sizable bill that I couldn't dispute. And even worse, those "runaways" weren't necessarily things in my sphere of control, but could be triggered by basically anyone coming in and using my VPC resources, especially egress network traffic.

So I closed out my cloud account, and I developed a lot of sympathy for businesses and corps that now are forced to run "in the cloud" rather than on-prem or their own machine rooms, but now they have no way to control expenses.

This is why traditional bare metal and VPS rental wins for any kind of private or small business use.

I wouldn't expect their detection of hacked accounts to be 100% correct. Sure, it might be obvious when a human takes a look, but humans can't proactively look at every account's usage.

> I got a 20K bill once and it was actually drafted from my bank account.

Service provider lesson #1: Never ever ever enable auto-pay! The convenience (and even the savings, if applicable) aren't worth the risk of the service provider autonomously slurping up all your money.

Right, and good luck getting a correct bill from Azure. And when you are finally fed up, it will take months to close your Azure account.

Exactly. It seems like a step down in every way.

Reply on news.ycombinator.com