I'm sure I'm preaching to the choir, but there really should be some safeguards that can trip along the way for what is clearly an individual account. Also there should always be hard limits available to turn on (maybe turned on by default).
Perhaps some kind of "we only let your bill be X% higher than the rolling average for your account" coupled with "First time you hit $10, $50, $100, $500, $1K .... firebreaks, alarms coupled with auto-stop/shutdown if you don't respond with a day or two". All of this would be available to turn off so it would just serve as a safety net.
> Also there should always be hard limits available to turn on (maybe turned on by default).
Absolutely.
As I said on here a few days ago in a discussion about AWS finally launching hard caps ... I really don't buy the stories the US providers tell you that "its too difficult" or "what if you suddenly go viral".
The "viral" bit is easily solved through basic monitoring of metrics that everybody should be doing. I believe the cool-kids give it the fancy name of Site Reliability Engineering (SRE). All you need to do is top-up your balance / adjust your cap if your metrics are trending upwards for an explainable reason. Its not rocket science. Just set a reasonable yet affordable buffer above your most ambitiously expected figures.
As for the "too difficult" that's just a lie. Its 2026. You're a cloud provider. You've got the infrastructure. You've got pre-existing APIs.
Credit card providers don't give people unlimited spending, they set a hard limit based on credit risk, I don't see why cloud providers should just let the numbers roll.
There are at least six providers in Europe I can name who offer hard caps on their services. So it is possible.
> All of this would be available to turn off so it would just serve as a safety net.
You can implement this yourself with the API.[0] Unlike a naïf disable everything setting, you can shutdown services selectively and trigger specific shutdown stuff in your services so you don't lose any data.
It looks like this relies on a new project-based multi-account system. As someone with an existing personal AWS account I wonder if I'll be able to use it.
Hm, edited out snark. I think that's an easy trap to fall into, and it's good to warn against.
What I agree on (top comment): there should be laws against providing cloud services without a fee cap. Another edit: businesses and hobbyists are different beasts of course. You can't demand scaling and reliability and a hard fee cap. For traditional shared hosting, this is mostly a solved problem AFAIK.
That's what prevented me from using Firebase for a hobby project in 2023.
The only available killswitch was some weird workaround with a Google Sheets monitoring the bill and triggering an action (give or take latency) when it exceeded some amount...
> You can't demand scaling and reliability and a hard fee cap.
Why not? Just because you can scale to million or billions doesn't mean that you should do it automatically without any supervision. Just like because your BMW M5 can reach a top speed of 305 km/h, you shouldn't drive at that speed all the time. Heck, some should never drive at that speed.
OK, I meant "auto-scaling", which is what most of these dev-aimed services we are talking about offer, right?
Anyway, reliability is already enough of a criterion when you set up a site that does some expensive thing in an infinite loop, gets (D-)DoSed, etc.
When you're trying to develop a product to sell, these are all things to look out yourself and that's fine I guess.
Just find it sad that the providers of these services apparently often don't make clear to their customers the billing responsibilities that they enter, although technically, sure, it's all written in the terms / pricing.
Auto-scale to one hundred bucks cause I'm a poor student and that's all I have.
Auto-scale to a million cause I'm a big corporation and I can deal with a bad fiscal year.
By the way, I wonder how well is the debt collection auto-scaling going so to speak.
"The market" is not a benevolent fairy godmother with your best interest at heart.
It is a machine that optimizes profit and absolutely nothing else. It does not and cannot consider what is "good" or "right" or even "legal" unless and until one of those things directly and indisputably hurts profits too much.
This is magical thinking. "The market" is fundamentally incapable of making things better for you, the consumer.
I agree, up until the question is how transparent the risks are.
For example, I think that OpenAI's system of incentivizing automated credit purchases borders on being predatory. Not because it would be hidden info. Just because the product is clearly aimed at consumers who do things that they might not fully understand.
For me, I don't habe any issues with their current design.
But for John Doe vibe-coding their nutrition analysis app, I feel it's wrong to advertise automatic payments and long-running tasks without providing a clear fee cap option.
I think the OP just points out that if you never read the code you are playing with your wallet. It's a gamble and in this case it resulted in considerable losses for an individual.
The vast majority of my personal stuff runs on $6-$12 VMs. No matter what happens, what dumb mistake I make or an agent makes on my behalf, I can only ever be out $6-$12. And, this is exactly why. The "free tier" all these big cloud companies offer is kind of a trap. Sure, you can do a lot for free, but mistakes happen and they've got your card on file.
Use fixed price hosting resources, those cannot bite you and if they're too small you can always expand by buying more virtual hosts, or even program your own simple scaler (which i am 99.9% sure you will not need this or next year after starting a project). AI is capable of setting up local database, and everything you need without paying 10x to a cloud provider.
I had the exact same thing happen a few weeks ago - a DO alarm accidentally set to a past time, retriggering immediately. Claude caught it within a couple minutes from its log tail, though.
Often the most expensive lesson of your life (as OP put it) is also the most valuable lesson. Everybody makes mistakes, learn to expect failures so you can mitigate the effects when they happen.
Learning to "trade" options probably? A lot of engineers nowadays go thru an X/Twitter inspired "I'm an amateur quant" phase that usually doesn't go well.
I wouldn't be so sure he learned a lesson. From the other posts it seems like this is a common occurrence for them. But you might be right, they said they are moving off cloudflare to something they can better control their spend.
I'm sure I'm preaching to the choir, but there really should be some safeguards that can trip along the way for what is clearly an individual account. Also there should always be hard limits available to turn on (maybe turned on by default).
Perhaps some kind of "we only let your bill be X% higher than the rolling average for your account" coupled with "First time you hit $10, $50, $100, $500, $1K .... firebreaks, alarms coupled with auto-stop/shutdown if you don't respond with a day or two". All of this would be available to turn off so it would just serve as a safety net.
> Also there should always be hard limits available to turn on (maybe turned on by default).
Absolutely.
As I said on here a few days ago in a discussion about AWS finally launching hard caps ... I really don't buy the stories the US providers tell you that "its too difficult" or "what if you suddenly go viral".
The "viral" bit is easily solved through basic monitoring of metrics that everybody should be doing. I believe the cool-kids give it the fancy name of Site Reliability Engineering (SRE). All you need to do is top-up your balance / adjust your cap if your metrics are trending upwards for an explainable reason. Its not rocket science. Just set a reasonable yet affordable buffer above your most ambitiously expected figures.
As for the "too difficult" that's just a lie. Its 2026. You're a cloud provider. You've got the infrastructure. You've got pre-existing APIs.
Credit card providers don't give people unlimited spending, they set a hard limit based on credit risk, I don't see why cloud providers should just let the numbers roll.
There are at least six providers in Europe I can name who offer hard caps on their services. So it is possible.
> All of this would be available to turn off so it would just serve as a safety net.
You can implement this yourself with the API.[0] Unlike a naïf disable everything setting, you can shutdown services selectively and trigger specific shutdown stuff in your services so you don't lose any data.
AWS is finally rolling out a feature that lets you put a hard cap on spending. https://docs.aws.amazon.com/accounts/latest/reference/create...
It looks like this relies on a new project-based multi-account system. As someone with an existing personal AWS account I wonder if I'll be able to use it.
https://docs.aws.amazon.com/accounts/latest/reference/sign-i...
As has GCP.
very related thread from 4 days ago: "We're going to need default hard budget caps on pretty much everything" https://news.ycombinator.com/item?id=49949235
> Vibe Coding failed me
Hm, edited out snark. I think that's an easy trap to fall into, and it's good to warn against.
What I agree on (top comment): there should be laws against providing cloud services without a fee cap. Another edit: businesses and hobbyists are different beasts of course. You can't demand scaling and reliability and a hard fee cap. For traditional shared hosting, this is mostly a solved problem AFAIK.
That's what prevented me from using Firebase for a hobby project in 2023.
The only available killswitch was some weird workaround with a Google Sheets monitoring the bill and triggering an action (give or take latency) when it exceeded some amount...
ehm, no thanks.
> You can't demand scaling and reliability and a hard fee cap.
Why not? Just because you can scale to million or billions doesn't mean that you should do it automatically without any supervision. Just like because your BMW M5 can reach a top speed of 305 km/h, you shouldn't drive at that speed all the time. Heck, some should never drive at that speed.
OK, I meant "auto-scaling", which is what most of these dev-aimed services we are talking about offer, right?
Anyway, reliability is already enough of a criterion when you set up a site that does some expensive thing in an infinite loop, gets (D-)DoSed, etc.
When you're trying to develop a product to sell, these are all things to look out yourself and that's fine I guess.
Just find it sad that the providers of these services apparently often don't make clear to their customers the billing responsibilities that they enter, although technically, sure, it's all written in the terms / pricing.
Auto-scale to one hundred bucks cause I'm a poor student and that's all I have. Auto-scale to a million cause I'm a big corporation and I can deal with a bad fiscal year. By the way, I wonder how well is the debt collection auto-scaling going so to speak.
I think some warnings would be welcome.
“laws against providing cloud services without a fee cap” really sounds to me like something that could and should be fixed by the market.
"The market" is not a benevolent fairy godmother with your best interest at heart.
It is a machine that optimizes profit and absolutely nothing else. It does not and cannot consider what is "good" or "right" or even "legal" unless and until one of those things directly and indisputably hurts profits too much.
This is magical thinking. "The market" is fundamentally incapable of making things better for you, the consumer.
I agree, up until the question is how transparent the risks are.
For example, I think that OpenAI's system of incentivizing automated credit purchases borders on being predatory. Not because it would be hidden info. Just because the product is clearly aimed at consumers who do things that they might not fully understand.
For me, I don't habe any issues with their current design.
But for John Doe vibe-coding their nutrition analysis app, I feel it's wrong to advertise automatic payments and long-running tasks without providing a clear fee cap option.
It's similar to gambling.
I think the OP just points out that if you never read the code you are playing with your wallet. It's a gamble and in this case it resulted in considerable losses for an individual.
Yes, and it's valuable to share. I'll edit out the "Weird article" part if still possible.
[dead]
The vast majority of my personal stuff runs on $6-$12 VMs. No matter what happens, what dumb mistake I make or an agent makes on my behalf, I can only ever be out $6-$12. And, this is exactly why. The "free tier" all these big cloud companies offer is kind of a trap. Sure, you can do a lot for free, but mistakes happen and they've got your card on file.
Use fixed price hosting resources, those cannot bite you and if they're too small you can always expand by buying more virtual hosts, or even program your own simple scaler (which i am 99.9% sure you will not need this or next year after starting a project). AI is capable of setting up local database, and everything you need without paying 10x to a cloud provider.
$34k for this one someone posted months ago: https://news.ycombinator.com/item?id=47787042
I had the exact same thing happen a few weeks ago - a DO alarm accidentally set to a past time, retriggering immediately. Claude caught it within a couple minutes from its log tail, though.
Often the most expensive lesson of your life (as OP put it) is also the most valuable lesson. Everybody makes mistakes, learn to expect failures so you can mitigate the effects when they happen.
I guess no one is going to prison! Unlike the poor guy in the other thread! We have all finally become peasants!
This is why I use VPS from hetzner. I do host static frontends at cloudflare but those are static assets.
I’m curious what the most expensive lesson of his life was.
Learning to "trade" options probably? A lot of engineers nowadays go thru an X/Twitter inspired "I'm an amateur quant" phase that usually doesn't go well.
that's quite cheap for 6 trillion requests, that's like 555M for a dollar
[flagged]
[dead]
[dead]
I'm glad the author just paid it, and learned the lesson.
But yes, these platforms should default to hard caps that you have to explicitly disable.
I wouldn't be so sure he learned a lesson. From the other posts it seems like this is a common occurrence for them. But you might be right, they said they are moving off cloudflare to something they can better control their spend.
The author of this blog isn’t the person this happened to FWIW, this blog appears to be a collection of horror stories from around social media.