10 ms·
Netlify CEO here. Our support team has reached out to the user from the thread to let them know they're not getting charged for this. It's currently our polic
by bobfunk 3y ago
Netlify CEO here.
Our support team has reached out to the user from the thread to let them know they're not getting charged for this.
It's currently our policy to not shut down free sites during traffic spikes that doesn't match attack patterns, but instead forgiving any bills from legitimate mistakes after the fact.
Apologies that this didn't come through in the initial support reply.
- bitzleon 3y agoThis is predatory and you know it. Your support was going to charge him 5% as a "sign of good fate". How kind. If it hadn't gotten traction, you absolutely would have charged him. How many other people have you strong armed into paying ridiculous bills? The fact that you have no usage limits is clear indication that this is intentionally left open to abuse. Extremely shady and downright criminal.
- foxandmouse 3y agoSorry, but there is a lot more going on here than you addressed, these charges were incurred on your "starter tier", which has no mention of additional costs.. I've noticed a lot of "sponsored content" by netlify, and again no mention of this possibility.. Also, no comment on not having ddos protection, or at least a spend limit? Sure, this instance was resolved, but it's also the top post of the last month. Who honestly things it would be the same outcome if not for going viral...
- harrycharound 3y agoThis leaves all your other small business users potentially on the hook and at the mercy of your mercy. Not only should this stuff be capped rather than the dam allowed to flow, but your systems should have picked this up immediately and known it for its nature. Thus must have been a nice little earner for you over the years. I'm moving all my netlify sites elsewhere, bob. I'm probably not the only one.
- deleted 3y ago[deleted]
- jonathanyc 3y agoI’ve been a Netlify users on the Pro plan for a few years now. Moving from Netlify to CloudFlare after this; “this didn’t come through in the initial support reply” doesn’t cut it for a $100k bill.
- BrujahRage 3y agoBut you do see how _not_ addressing this in the initial support reply is going to cost you all in the long term, right? The real lesson here seems to be for small projects, it may well be worth the investment to handle my own hosting. All I see here is that getting you to do the right thing required publicly shaming you, which means you can be trusted about as far as I can throw a piano.
- joshjob42 3y agoI'm moving my domain name and personal site off Netlify (already deleted the sites, DNS transfer requested), probably moving to Cloudflare pages. It may only move a few MB a month, but I just can't risk if I put anything more substantial there that I might get hit with a bill for $100k and you maybe will forgive it. And that this has apparently been policy for nearly a decade makes it even worse.
- homerjam 3y agoYou should rethink this policy. Someone could panic and do something unthinkable, then you'd wish bad press was the only thing on your conscious.
- aurareturn 3y agoThere are only two questions everyone have: 1. Would Netlify forgive the bill if this didn't go viral? 2. How do you plan to address this issue so that it never happens again? Everyone here knew someone from Netlify would come and say OP wouldn't have to pay. That was a given. Now we want to know the important answers.
- keeganpoppen 3y agoif only i had $1 for every time for every time someone asked this exact question on HN. yes, we all get it: easy question is askable and not answerable. you want a gold star?
- deleted 3y ago[deleted]
- nfw2 3y agoOP said they agreed to reduce the payment, which means they acknowledged it was an attack but still wanted payment
- darksim905 3y agoYou don't see VPS providers like Vultr forgiving bills like this, nor do they make the news. Granted they are not the same scope as Netlify, but still.
- bobfunk 3y ago1. Yes. We've forgiven lots and lots of bills over the last 9 years and they haven't gone viral 2. While I've always favored erring towards keeping people's sites up we are currently working on changing the default behavior to never let free sites incur overages
- deleted 3y ago[deleted]
- paultopia 3y agoThis seems like a really good idea to me. Or at least cap overages at a specified amount, like 2x the free level (a $55 surprise bill is a totally different universe from a $100,000 surprise bill, obviously). Honestly, this terrifies me---I run a bunch of different sites off netlify, and I would have never imagined that a site could jump from 0 to six figures of bills a month without something hitting a tripwire somewhere and cutting it off or at least communicating with the account owner. At least users should have the capacity to self-impose bandwidth caps to prevent this sort of thing.
- Sephr 3y agoCan you respond to the allegations that Netlify has inadequate spending limit controls? Are there plans to improve this situation?
- croemer 3y agoHow long has this been the "current" policy? 2 hours?
- swyx 3y agoex employee here, left 4 years ago. was policy back then too.
- aurareturn 3y agobut instead forgiving any bills from legitimate mistakes after the fact What are these legitimate mistakes?
- hnfong 3y agoPresumably the "mistakes" mean failures to detect/recognize "attack patterns".
- optionalsquid 3y agoWouldn't that imply that a person whose site legitimately went viral would be stuck with the $100k bill?
- deleted 3y ago[deleted]
- kjs3 3y agoAnything Netlify deems them to be, of course. That's why these sorts of T&Cs use weasel words like "legitimate", "reasonable", "expected", etc., instead of giving specifics you can action against. That way they can claim every thing they've done is legitimate and reasonable no matter how fallacious that claim is, and double-dog dare you to spend the time/money to take them to court (or worse, imposed arbitration with an arbiter of their choice) and prove them wrong.
- CogitoCogito 3y ago
- tledakis 3y ago> It's currently our policy to not shut down free sites during traffic spikes that doesn't match attack patterns, but instead forgiving any bills from legitimate mistakes after the fact. Well, giving the option to users to plan ahead would be best, no? Like a setting to choose whether they want a potentially unlimited bill versus downtime. Instead of that, you are choosing to stress and make people scared/anxious/homeless even (if they don't think of raising the issue on HN). Seriously, this is not rocket science. This must have been discussed before in your company, and someone actually made this decision to stress people about such bills.
- deleted 3y ago[deleted]
- CogitoCogito 3y agoFrankly the only reason I can even come up with that Netlify wouldn't have such controls in place is exactly if they do _not_ simply forgive these sorts of jumps in costs (as the CEO here seems to be claiming). I'm pretty sure if they'd be left holding the bag, they'd manage to find some way to cut off these kinds of jumps in usage.
- Nition 3y agoWell, note that they're only talking about giving refunds if there's an attack and they miss it. Doesn't mean they'll give a refund if you get $100K worth of real user traffic.
- op00to 3y agoMaybe it’s a tax dodge! “Forgive” 100k of “overages” which cost Netlify next to nothing, then report it as a write off on taxes.
- croemer 3y agoNot a dodge, (tax) accounting doesn't work like that. You can create accounts receivable of 100k and then write them off, that leaves you in exactly the same state as if you had just not entered the whole thing into the books at all. No benefit to "writing off".
- jari_mustonen 3y ago"Current policy?" So, you will retain a right to change such fees when you feel like it. This is a serious matter. We are building a new site for our company with Netlify, but we can't open ourselves to this predatory practice. And even if you do not mean to be predatory, even the option of such is enough. If not resolved with a clean, legally binding promise, our company (and probably quite a few others) must move our business to Cloudflare, Amazon, or some other competitor of yours.
- listenallyall 3y agoWhy are you asking this question here? Any actual company would have reviewed all the legal documents prior to choosing a provider. The promises you seek are the exact reason "enterprise-grade" providers can (and do) charge so much. edit: hey guess what, Netlify offers an enterprise plan, I'd bet they will be happy to offer you a "clean, legally binding promise": https://www.netlify.com/pricing/?category=enterprise https://www.netlify.com/pricing/?category=enterprise
- jari_mustonen 3y agoThat does not help when we are evaluating and build the solution. We will proceed with this one.
- rafram 3y agoPresumably your company’s site won’t be on their limited free tier.
- lobsterthief 3y agoThe paid tier (like $19/mo/user) has the same vulnerability. Overages are charged at the same price per GB as the free tier and they could still be charged $100k for the exact same thing.
- karaterobot 3y ago> "Current policy?" So, you will retain a right to change such fees when you feel like it. Is that unreasonable?
- valine 3y agoI’ve been a netlify user since 2017 and I just deleted all my sites. I can’t risk receiving a $100k bill for toy projects. Your “current policy” is not good enough.
- epiccoleman 3y agoSame here. Will I ever get a level of traffic that would cause this problem? Extremely doubtful. Is it worth the risk when Cloudflare Pages is a similarly easy offering, and took 5 minutes to switch to? Hell no.
- JasonSage 3y agoCouldn't have worded it any better. I did the same last night from my phone. My personal site and a project docs site are just going to not be online for a couple days. Easy choice.
- fetzu 3y agoDid exactly the same, moving everything over to Cloudflare took me less than 15 minutes. “We’ll forgive those cases, pinky swear” is not a valid excuse when putting (even opt-in) hard limits in place is technically viable.
- erremerre 3y agoSame boat here. the fact that once it arrives to the limits does not display an error page. At this point I honestly do not care about they changing their policy, they should have thought that a normal person receiving a 100000$ bill on a free tier shall not been at all on the table in any circumstance, even if they forgive the bill, nobody needs to stress out like that.
- jug 3y agoI agree and also delete my account. The only "fix" here is to act like Hetzner and null route upon DDoS, price cap the thing, or offer unlimited bandwidth on the free tier like e.g. Cloudflare Pages. Uncapped but paid is a recipe for disaster and you'll always be subject to the will of the support staff when something happens. If they can grasp to a straw leading to suspicions that it's not in fact a DDoS attack, you can for example be sure they'll do just that. Just no.
- kiprou 3y agoThat customers must seek forgiveness at Netlify's discretion is not comforting. What's comforting is dependable spending controls.
- fabian2k 3y agoYou can't rely on such a policy if it is not part of the actual contract. This doesn't address the enormous uncertainty and risk that is present here when using Netlify.
- shit_game 3y agoThis is what sticks out to me about the situation. I would much rather a site go offline due to service overage triggering at some limit that I set - simply relying on the good faith of a host to subjectively waive fees is not reliable nor does it instill confidence that I won't be financially ruined by malicious third parties (like nearly happened here). I would imagine that the good faith of Netlify in this case would mean very little to a court when there is a contract that stipulates costs for services, and the worst case scenario for a user is that Netlify could take the issue to court with the contract the user agreed to and demand full payment. Even the possibility for this situation to occur without any tools existing to prevent it is terrifying and is a terrible value proposition for a service.
- CogitoCogito 3y ago> It's currently our policy to not shut down free sites during traffic spikes that doesn't match attack patterns, but instead forgiving any bills from legitimate mistakes after the fact. The legitimate mistake sounds to be on _your_ side if anything. You failed to match the attack pattern after all. > Apologies that this didn't come through in the initial support reply. The support email said you normally discount the attacks to 20%, but in this case it would be discounted to 5%. Are you here publicly claiming that your policy is to in fact to forgive (i.e. discount 100%) these bills? Was the support reply totally incorrect in claiming that you normally discount the attacks to 20% or are you lying when saying that your policy is to forgive the bills? You might want to clarify your position here.
- 7moritz7 3y agoHow does a 60 TB in a day peak for a site that previously never crossed the free tier threshhold not qualify as "attack pattern"? This is a static site. To reach that sort of bandwidth out of nowhere you'd need to publish the blueprint for a teleportation machine
- hnfong 3y agoTo be fair, these days, things can become viral literally overnight. That said, instead of depending on unreliable heuristics, they should just allow an option to change the behavior. The "current policy" to charge small sites on the free tier thousands of dollars instead of just throttling/shutting down the traffic is really predatory.
- quickthrower2 3y ago60TB with each request for 1Mb say would be 60000000 visitors. So guess this is possible but hell of unlikely.
- Izkata 3y ago"static site" doesn't necessarily mean "small". It would be easy to go way over 1Mb with a couple of pictures.
- frontalier 3y agoat 60MB it is still one million downloads
- krick 3y agoI'm not trying to justify netlify, because it's pretty obvious all cloud providers have vile intentions here (even though they pretend otherwise): it's obvious that total majority of use cases for such platforms are toy or small-scale projects, and literally everyone in this market would prefer their website being shut down, rather than getting $100K (or even $5K) bill, BUT… 1 million downloads (= visits) is nothing for "going viral overnight"
- brnt 3y agoI understand that you need to pay bills, but auto-billing over the bandwidth budget just isn't OK, or at least not unless the user specifically configures that that's OK. I for sure didn't understand your bandwidth tiers that way. You can avoid this sort of bad press and disgruntled users and your support cost by just giving users the option to shut down the site once the bandwidth budget is up.
- heavyset_go 3y ago> It's currently our policy to not shut down free sites during traffic spikes that doesn't match attack patterns, but instead forgiving any bills from legitimate mistakes after the fact. That doesn't square with the 5% fee on the original $104k that your company told the OP to then pay.
- anonanoa 3y agoSo what's the policy? Do you forgive 100%, 95%, or 80% of the bill? Is the 100% only available when a story about a bill goes viral?
- deleted 3y ago[deleted]
- bluerooibos 3y agoI assume you'll be offering this user a good amount of credit on their account for having to deal with this BS and the stress of being told they owe you $100k?
- deleted 3y ago[deleted]
- phone8675309 3y ago[flagged]
- op00to 3y agoI’d rather be shut down than have a heart attack from a $100k bill. That could literally kill me from stress, even if you pinky swear to refund any oopsies.
- pants2 3y agoSee the Robinhood user who committed suicide after misunderstanding his liabilities from selling options.
- phone8675309 3y agoHonestly I'd probably commit suicide if a hosting provider gave me a $100K bill. Collect this from my corpse you scummy fucks.
- op00to 3y agoPlease don’t! We like you here.
- underdeserver 3y agoYou guys see a lot of traffic. Why not offer DDoS protection for the free tier by default?
- huxflux 3y agoSo this one got attention due to some good Samaritan on Reddit who told OP to post here. Now, to the real question here: have others not received as good advice and just paid up?
- jpambrun 3y agoBy the time you forgive the bill you may have caused significant psychological distress, maybe even irreparable. This doesn't feel like a responsible approach.
- is_true 3y agoThis is the way most companies work unfortunately. Paypal limits your account and makes you wait 6 month to (maybe) give you a way to get the money back.
- _gabe_ 3y agoThis is why I stopped using PayPal. My credit card company allows me to issue chargebacks with typically very little friction because of my credit history. PayPal once put me through the wringer for an order I cancelled and never received a refund for. After that I deleted my PayPal account and decided to never use it again. In this case, I would take my site off Netlify and never use it again.
- altin0 3y agoLol this deescalated pretty quickly, went from $104K to $20K to $5K to $0 Which basically means you almost scammed the customer for $5K or $20K. Super negative practices. I for one could never trust a company operating in that manner. It would be much more honest to say "unlimited bandwidth" and set a hard-limit for maximum budget, then people know they won't be charged, than to go through all this crap and then pretend you're doing a favor to the customer (you're not). If I'm normally spending $10/month any idiot out there would know for sure that I'm not going to spend $104K instantly. That's a very basic filter to have. But you don't place such filters because obviously you're working on the principle to scam people many thousands of $ if they fall for that. Heck, for all we know you might send that amount of traffic to your customer and the try to scam them and if it doesn't work then pretend you're doing them a favor.
- hasty_pudding 3y agoThe fact that the CEO had to step in after this blew up online otherwise they were going to try to extort that poor dude for thousands of dollars! Moving my sites off of netlify ASAP.
- BigJono 3y agoTell you what is a good question, why is this thread on page FIVE of HN (ranked #125) with 1000+ upvotes, 400+ comments and only 7 hours old?
- croemer 3y agoI asked this question as "Ask HN" here: https://news.ycombinator.com/item?id=39524660 https://news.ycombinator.com/item?id=39524660
- sergiotapia 3y agoI found out about this from twitter - weird how it's so buried on HN.
- dang 3y agoThis is in the FAQ: https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html. See "How are stories ranked?" and "Why is A ranked below B even though A has more points and is newer?" About this specific case: it set off the flamewar detector (a.k.a. the overheated discussion detector) and also got moderation downweights. We sometimes turn off that penalty, but I don't think we'd do so in a case like this, because HN gets so many posts of this nature. They flare up with Big Drama that is sensational for a while but not particularly interesting, and therefore not really what the site is for. In fact HN gets so many posts of this type that it has become a joke, and not only that but a cliché, so much so that the top comment of the Reddit thread repeats it [1]. That's about as repetitive as anything gets. The basic idea of HN is to gratify intellectual curiosity [2] and avoid repetition [3]. [1] https://old.reddit.com/r/webdev/comments/1b14bty/netlify_just_sent_me_a_104k_bill_for_a_simple/ksc6txu/ https://old.reddit.com/r/webdev/comments/1b14bty/netlify_jus... [2] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=curiosity%20optimiz%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor... [3] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=curiosity%20repetition%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
- ZeroMetaCool 3y agoMade an account here to also let you know, I too am removing my websites from netlify ASAP. Thank you for bringing this to light.
- jotaen 3y agoOne additional feedback, for consideration: to me, your Pricing page[1] doesn’t make it sufficiently clear that the “Starter” plan may incur costs at all (let alone in this ballpark). It’s now more apparent when looking at it in hindsight, but you have to either read very carefully, or go to the separate “View Features” page to understand this. “0$ to get started, then pay as you go” reads to me: “0$ to get started, and then you can order add-ons and extra features as you need them”, not “$0 to get started, but we may start charging you virtually unlimited amounts at any point without prior notice”. When signing up for the “Starter” tier initially, I completely misunderstood this. I didn’t have to enter any credit card or invoice details, so I thought as long as you don’t have that info from me, you can’t and won’t bill anything. [1]: https://www.netlify.com/pricing/ https://www.netlify.com/pricing/
- NoPedantsThanks 3y ago[dead]
- xatax 3y ago> 0$ to get started, then pay as you go” reads to me: “0$ to get started, and then you can order add-ons and extra features as you need them I think I disagree with this, but maybe I'm misunderstanding you. Pay as you go sounds strongly to me that you pay based on your actual usage, not that it's free except for add-ons. A pay as you go phone, for example, does not imply you need to buy a telephony add-on, an SMS add-on, etc. PAYG phones, however, were always prepaid, so I think I would expect PAYG hosting to be similar. That said, if my site was publicly accessible without my prepayment, I think it would be clear that it works the way it apparently does. It's potentially misleading, but I don't think it's intentionally dishonest.
- jotaen 3y ago> It's potentially misleading, but I don't think it's intentionally dishonest. That’s my interpretation as well. The usage of the term “add-on” is not clear here in my opinion. On their main pricing page[1], Netlify currently lists “Additional bandwidth” as “Add-on”. To me, that sounds like “I can actively order additional bandwidth in case the included bandwidth isn’t enough.” Not: “Additional bandwidth is automatically allocated and charged for as it happens to occur.” In addition to that, there is a big bold “$0” at the top of the “Starter” plan. [1]: https://www.netlify.com/pricing/ https://www.netlify.com/pricing/
- silent_cal 3y agoGood on you for reaching out, but getting a bill like this in the first place is enough to send someone to the psych ward, lol.
- baggachipz 3y agoEmail: > "You've got room to grow!" ohfuckohfuckohfuck
- bb81 3y agoSo netlify is a major scammer organization now!? Uh oh time to look elsewhere
- wendyshu 3y agoIs the support employee going to be fired for making such a traumatizing mistake? Or was 5% ok until this went viral?
- pier25 3y ago> instead forgiving any bills from legitimate mistakes after the fact That's terrible for marketing.
- spacecadet 3y agoNever used "netlify", but to me a product is broken if you are using the words free and bill together. I wont touch a fake free service if it requires a payment method. Want my money, give me a reason to pay you, dont trick me into paying you. Temped to go fuzz your product and document other dark patterns...
- gizmo 3y agoThat is an outrageous and inhumane policy. People get panic attacks when they get told they owe 100k they don’t have. People will be terrified your internal process wrongly determines the bill is legitimate. Imagine you have to study for an important exam or that you have a paper due. How can you possibly focus with this nightmare at your doorstep? Truly shameful.
- dboreham 3y ago> traffic spikes that doesn't match attack patterns I interpret this as "we always charge for traffic served, but we attempt to block illegitimate traffic" which means of course that the worse their traffic discriminator performs, the more money they make!
- tacone 3y agoHello bobfunk, thank you for acting on this. One question though, what is Netlify gonna do to ensure this doesn't happen again? I understand it's a hairy question, but the general consensus seems to be some policy must be changed or at least some line should be drawn.
- phyzome 3y ago« Apologies that this didn't come through in the initial support reply. » "Didn't come through" doesn't actually match the user's report of having support explicitly offering 20% and then 5% payment. It sounds like maybe you have a training problem? That seems like one of the important points to speak to.
- JasonSage 3y agoI’ve already migrated my two sites off Netlify after reading about this incident, and seeing other replies where folks said they were stuck with large bills. This large bill doesn’t look like a legitimate mistake, it looks like everything worked as intended until things got escalated via Hacker News.
- godzillabrennus 3y agoI'm so grateful that Cloudflare has Pages, and I was able to move my hosting needs there. Netlify has been expensive for a while now.
- AbraKdabra 3y agoHow about a button that says "put down my website if it suddenly starts getting charged"?.