Hm, edited out snark. I think that's an easy trap to fall into, and it's good to warn against.
What I agree on (top comment): there should be laws against providing cloud services without a fee cap. Another edit: businesses and hobbyists are different beasts of course. You can't demand scaling and reliability and a hard fee cap. For traditional shared hosting, this is mostly a solved problem AFAIK.
That's what prevented me from using Firebase for a hobby project in 2023.
The only available killswitch was some weird workaround with a Google Sheets monitoring the bill and triggering an action (give or take latency) when it exceeded some amount...
"The market" is not a benevolent fairy godmother with your best interest at heart.
It is a machine that optimizes profit and absolutely nothing else. It does not and cannot consider what is "good" or "right" or even "legal" unless and until one of those things directly and indisputably hurts profits too much.
This is magical thinking. "The market" is fundamentally incapable of making things better for you, the consumer.
I agree, up until the question is how transparent the risks are.
For example, I think that OpenAI's system of incentivizing automated credit purchases borders on being predatory. Not because it would be hidden info. Just because the product is clearly aimed at consumers who do things that they might not fully understand.
For me, I don't habe any issues with their current design.
But for John Doe vibe-coding their nutrition analysis app, I feel it's wrong to advertise automatic payments and long-running tasks without providing a clear fee cap option.
I think the OP just points out that if you never read the code you are playing with your wallet. It's a gamble and in this case it resulted in considerable losses for an individual.
I'm sure I'm preaching to the choir, but there really should be some safeguards that can trip along the way for what is clearly an individual account. Also there should always be hard limits available to turn on (maybe turned on by default).
Perhaps some kind of "we only let your bill be X% higher than the rolling average for your account" coupled with "First time you hit $10, $50, $100, $500, $1K .... firebreaks, alarms coupled with auto-stop/shutdown if you don't respond with a day or two". All of this would be available to turn off so it would just serve as a safety net.
> Also there should always be hard limits available to turn on (maybe turned on by default).
Absolutely.
As I said on here a few days ago in a discussion about AWS finally launching hard caps ... I really don't buy the stories the US providers tell you that "its too difficult" or "what if you suddenly go viral".
The "viral" bit is easily solved through basic monitoring of metrics that everybody should be doing. I believe the cool-kids give it the fancy name of Site Reliability Engineering (SRE). All you need to do is top-up your balance / adjust your cap if your metrics are trending upwards for an explainable reason. Its not rocket science. Just set a reasonable yet affordable buffer above your most ambitiously expected figures.
As for the "too difficult" that's just a lie. Its 2026. You're a cloud provider. You've got the infrastructure. You've got pre-existing APIs.
Credit card providers don't give people unlimited spending, they set a hard limit based on credit risk, I don't see why cloud providers should just let the numbers roll.
There are at least six providers in Europe I can name who offer hard caps on their services. So it is possible.
It looks like this relies on a new project-based multi-account system. As someone with an existing personal AWS account I wonder if I'll be able to use it.
The vast majority of my personal stuff runs on $6-$12 VMs. No matter what happens, what dumb mistake I make or an agent makes on my behalf, I can only ever be out $6-$12. And, this is exactly why. The "free tier" all these big cloud companies offer is kind of a trap. Sure, you can do a lot for free, but mistakes happen and they've got your card on file.
Use fixed price hosting resources, those cannot bite you and if they're too small you can always expand by buying more virtual hosts, or even program your own simple scaler (which i am 99.9% sure you will not need this or next year after starting a project). AI is capable of setting up local database, and everything you need without paying 10x to a cloud provider.
I had the exact same thing happen a few weeks ago - a DO alarm accidentally set to a past time, retriggering immediately. Claude caught it within a couple minutes from its log tail, though.
Often the most expensive lesson of your life (as OP put it) is also the most valuable lesson. Everybody makes mistakes, learn to expect failures so you can mitigate the effects when they happen.
I wouldn't be so sure he learned a lesson. From the other posts it seems like this is a common occurrence for them. But you might be right, they said they are moving off cloudflare to something they can better control their spend.
I guess no one is going to prison! Unlike the poor guy in the other thread! We have all finally become peasants!
> Vibe Coding failed me
Hm, edited out snark. I think that's an easy trap to fall into, and it's good to warn against.
What I agree on (top comment): there should be laws against providing cloud services without a fee cap. Another edit: businesses and hobbyists are different beasts of course. You can't demand scaling and reliability and a hard fee cap. For traditional shared hosting, this is mostly a solved problem AFAIK.
That's what prevented me from using Firebase for a hobby project in 2023.
The only available killswitch was some weird workaround with a Google Sheets monitoring the bill and triggering an action (give or take latency) when it exceeded some amount...
ehm, no thanks.
“laws against providing cloud services without a fee cap” really sounds to me like something that could and should be fixed by the market.
"The market" is not a benevolent fairy godmother with your best interest at heart.
It is a machine that optimizes profit and absolutely nothing else. It does not and cannot consider what is "good" or "right" or even "legal" unless and until one of those things directly and indisputably hurts profits too much.
This is magical thinking. "The market" is fundamentally incapable of making things better for you, the consumer.
I agree, up until the question is how transparent the risks are.
For example, I think that OpenAI's system of incentivizing automated credit purchases borders on being predatory. Not because it would be hidden info. Just because the product is clearly aimed at consumers who do things that they might not fully understand.
For me, I don't habe any issues with their current design.
But for John Doe vibe-coding their nutrition analysis app, I feel it's wrong to advertise automatic payments and long-running tasks without providing a clear fee cap option.
It's similar to gambling.
I think the OP just points out that if you never read the code you are playing with your wallet. It's a gamble and in this case it resulted in considerable losses for an individual.
Yes, and it's valuable to share. I'll edit out the "Weird article" part if still possible.
[dead]
I'm sure I'm preaching to the choir, but there really should be some safeguards that can trip along the way for what is clearly an individual account. Also there should always be hard limits available to turn on (maybe turned on by default).
Perhaps some kind of "we only let your bill be X% higher than the rolling average for your account" coupled with "First time you hit $10, $50, $100, $500, $1K .... firebreaks, alarms coupled with auto-stop/shutdown if you don't respond with a day or two". All of this would be available to turn off so it would just serve as a safety net.
> Also there should always be hard limits available to turn on (maybe turned on by default).
Absolutely.
As I said on here a few days ago in a discussion about AWS finally launching hard caps ... I really don't buy the stories the US providers tell you that "its too difficult" or "what if you suddenly go viral".
The "viral" bit is easily solved through basic monitoring of metrics that everybody should be doing. I believe the cool-kids give it the fancy name of Site Reliability Engineering (SRE). All you need to do is top-up your balance / adjust your cap if your metrics are trending upwards for an explainable reason. Its not rocket science. Just set a reasonable yet affordable buffer above your most ambitiously expected figures.
As for the "too difficult" that's just a lie. Its 2026. You're a cloud provider. You've got the infrastructure. You've got pre-existing APIs.
Credit card providers don't give people unlimited spending, they set a hard limit based on credit risk, I don't see why cloud providers should just let the numbers roll.
There are at least six providers in Europe I can name who offer hard caps on their services. So it is possible.
AWS is finally rolling out a feature that lets you put a hard cap on spending. https://docs.aws.amazon.com/accounts/latest/reference/create...
It looks like this relies on a new project-based multi-account system. As someone with an existing personal AWS account I wonder if I'll be able to use it.
https://docs.aws.amazon.com/accounts/latest/reference/sign-i...
As has GCP.
very related thread from 4 days ago: "We're going to need default hard budget caps on pretty much everything" https://news.ycombinator.com/item?id=49949235
I’m curious what the most expensive lesson of his life was.
The vast majority of my personal stuff runs on $6-$12 VMs. No matter what happens, what dumb mistake I make or an agent makes on my behalf, I can only ever be out $6-$12. And, this is exactly why. The "free tier" all these big cloud companies offer is kind of a trap. Sure, you can do a lot for free, but mistakes happen and they've got your card on file.
Use fixed price hosting resources, those cannot bite you and if they're too small you can always expand by buying more virtual hosts, or even program your own simple scaler (which i am 99.9% sure you will not need this or next year after starting a project). AI is capable of setting up local database, and everything you need without paying 10x to a cloud provider.
I had the exact same thing happen a few weeks ago - a DO alarm accidentally set to a past time, retriggering immediately. Claude caught it within a couple minutes from its log tail, though.
Often the most expensive lesson of your life (as OP put it) is also the most valuable lesson. Everybody makes mistakes, learn to expect failures so you can mitigate the effects when they happen.
This is why I use VPS from hetzner. I do host static frontends at cloudflare but those are static assets.
that's quite cheap for 6 trillion requests, that's like 555M for a dollar
[flagged]
[dead]
[dead]
I'm glad the author just paid it, and learned the lesson.
But yes, these platforms should default to hard caps that you have to explicitly disable.
I wouldn't be so sure he learned a lesson. From the other posts it seems like this is a common occurrence for them. But you might be right, they said they are moving off cloudflare to something they can better control their spend.
The author of this blog isn’t the person this happened to FWIW, this blog appears to be a collection of horror stories from around social media.