Hacker News new | past | comments | ask | show | jobs | submit | yunolisten's comments login

Shame on them for not giving notice and a proper explanation of the change. They were vastly under reporting the cost of providing the service. Consider that they are a business.

Shame on you for not using resumable TLS sessions/Keep alive. You're hammering their infrastructure. The change in how they meter usage is seeing you having to compensate them for the resource they provide you.


Be very careful here. The developer may not have used TLS BUT any failed authorisation attempts are also counted in the bandwidth.

So a bot net could absolutely wreck your credit card by just repeatedly trying to access your API with invalid credentials.


> So a bot net could absolutely wreck your credit card by just repeatedly trying to access your API with invalid credentials.

You could argue that for pretty much anything being hosted, anywhere.


No, because most self-hosted services are 10-20x cheaper than comparable SaaS offerings. In the realtime space Firebase is particularly known for being really expensive for the scalable plans (blaze plan).


> No, because most self-hosted services are 10-20x cheaper than comparable SaaS offerings.

This has nothing to do with the fact that it could be hit by a botnet, as per the exact point I commented on, could 'wreck your card', it's simply a question of scale.


No. Most self-hosted services have no bandwidth costs, at all.

Or they have bandwidth costs around a dollar per terabyte. Which, even when maxing your connections, would always be below your actual server costs.


If you read the fine print of the ones with "no bandwidth costs" you'll find that service becomes throttled after a certain level of usage. These are businesses, they have to make money to operate, they're not in this for charity


Dude, I’ve used 180 TB of traffic in one month on a 16$/mo server, and still, no throttling.

I’ve read the fine print, and called them.

Online, Scaleway, OVH, do not ever throttle you.

Hetzner requires you to buy traffic, but there it costs 1$ per 1TB of traffic, which is 1000x cheaper than Firebase.


> Dude, I’ve used 180 TB of traffic in one month on a 16$/mo server, and still, no throttling.

But legitimately using lots of bandwidth isn't the same as a DoS attack. Try and remember that bandwidth isn't the only resource being used.

> Scaleway

In my experience they throttle your CPU usage after a while.

> Hetzner requires you to buy traffic, but there it costs 1$ per 1TB of traffic, which is 1000x cheaper than Firebase.

At no point did I suggest using Firebase was a good idea. I said it's always cheaper to run your own services in the long run, and that they'd have found out their own problems (see my first reply) sooner.


But my point is that you won't even ever have an issue with overusing traffic or CPU during a DoS, and the issue will be purely that your bandwidth will be saturated.

Vs. AWS, Firebase, etc where your limit will be your bank account instead.


Absolutely no shame on the author for something that can be easily overlooked, wasn't documented and not reported by any tool.


Agreed in part, however TLS Tokens and Keep alive aren't specific to this vendor... it's something that the author should be doing anyway. If they were to self host rather than contract out the underlying service upon which they depend they may have figured this out sooner.


Pretty much :)


I enjoy Lynch's Dune. There are some great fan edits, the 'Third stage navigator' edits that add in a fair amount of the cut scenes. The longer cut is a great improvement.


> BearSSL is only 25KB and there are even microcontrollers

Thank you, came here to mention this. So many people seem to think that OpenSSL is the ONLY tool to be used.


BearSSL is my favourite crypto software of 2016, however it's still in alpha stages of development and is not production ready, Ikea couldn't use it for this product: https://www.bearssl.org/todo.html


Ergodox-ez.com sure make a big deal about being 'open source', yet I can't find a schematic, PCB design or anything related to this on their site. Perhaps I'm missing something?

What I do see is they use an open source firmware, used on several other keyboards.


You've been shilling in this thread, and avoided answering the question "are you affiliated with them?"


I've been actually answering that question twice, yunoreed.


It's called time, you did it after being prompted multiple times, and after I posted this


> As such we're happy to issue you a refund

They didn't offer this, the bricked the device and suggested returning it to Amazon, who have no power over any of this.


> I don't know why many comments about "the customer is clearly an asshole, therefore he deserves the lock not working/the company has the legal rights to do so blah blah"

This attitude is rife in the tech industry, sadly, people somehow thing one of their own is being abused by others having an opinion or reporting an experience. Safe spaces, trigger warnings....


> I'll just note that this entry was posted twice, by two different accounts

another behaviour that's quite common here ;)


> It's more of a tantrum.

And the knee jerk response of bricking the device is ok then?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: