var json_comments = new Array("

$\"user-pic\"$

May 22, 2009 6:00 PM

Moderate | Flag for review

Mick did not initiate the \"compromising\" of the server so he should not have to pay for the overage. People get busy, I think the ISP is preying on him for these overages in that I see it as a failure of the ISP to protect his application which resides in their server farm.

4 replies

$\"user-pic\"$

gStein_*|bringing starpipe back|*

May 23, 2009 1:34 AM

Moderate |Flag for review

@axiomatic: think about it this way, if i overdraft slightly, by <$50, Visa/Bank of America will let the charge go through, but slap me with a $35 charge. if i attempt to go over by $3000 (more than i ever use on that card in a month) they should (and probably would) stop it, since it's uncharacteristic of my normal actions.
although i have a feeling that if Servepath cut off his account after 1TB in overages, there might be screaming that they cut off his access. there's a fine line that businesses have to walk, preventing excessive loss while not alienating the consumer

$\"user-pic\"$

May 22, 2009 6:26 PM

Moderate |Flag for review

@axiomatic: You don't understand how hosting works.

First they are a data center and second he owns a dedicated server. That means that the server belongs to the customer and he pays \"rent\" to let that server sit in a rack and user electricity. Then he has to pay bandwidth costs. The fact that the server was compromised is not the data centers fault because they don't manage the server, it doesn't belong to them, it belongs to the client.

The fact that they didn't notify him of the excess bandwidth is bad on them. The customer should have received emails as he was getting close to his limit and not a week afterwards.

$\"user-pic\"$

FooSchnickens - Full of SCAR

May 22, 2009 6:57 PM

Moderate |Flag for review

@midwestkel: Yeah, with our setup we get e-mails ever week outlining our usage as well as warnings when we start getting close to our limits so that we can throttle back usage or turn it off altogether.

$\"user-pic\"$

Benjamin M Martin

May 22, 2009 6:25 PM

Moderate |Flag for review

If Servepath offers typical dedicated servers for hosting, it's the sole responsibility of the customer to keep the server patched/updated to prevent compromises. I don't agree with this policy, but that seems to be the norm for hosting companies. Just a way of passing the buck, in a number of ways, along to the customer.

However, often times, there are no patches/updates for some vulnerabilities, especially the zero-day ones.

Also, most hosting companies, well the ones that actually care and want to keep their customers and not get bad press, will give the customer a break and allow them to pay a much lower fee as long as they get the point across that they are responsible for keeping everything updated from here on.

But, if everything above is true, I'd switch hosting companies asap...without thinking twice.

","

$\"user-pic\"$

ZManGT

May 22, 2009 6:06 PM

Moderate |Flag for review

I think when there are slight overages the company deserves to charge their exorbitant rates. However when there is a large and uncharacteristic overage they should give him the plan that better covers it. Especially if he was willing to pay.

This doesn't take into account how the account was compromised. If it was compromised because the hosting service did a bad job they should cover the entire fee.

1 replies

$\"user-pic\"$

May 22, 2009 6:18 PM

Moderate |Flag for review

@ZManGT: You're kidding right? Slight overage? In this day and age bandwidth is incredibly cheap and anyone who tells you otherwise is a liar.

Put it this way. Comcast charges $60 a month for what amounts to 250 gigabytes a month in bandwidth. Thats for a home user account. That bandwidth properly ends up costing Comcast about $5, $10 when you add in maintaining the network itself. Bandwidth is dirt cheap.

Sure if this guy was 1000 gigs over his limit then they should have the right to charge a small fee but any good web host will shut your account off until you call them and approve a fee for more bandwidth

","

$\"user-pic\"$

exploded

May 22, 2009 6:06 PM

Moderate |Flag for review

There are very real costs associated with bandwidth usage. I don't know what kind of network his ISP has, but if they are going to be charged for them (at their wholesale rate), he should have to pay for that.

However, it is obviously profitable for them to sell a plan that provides that much bandwidth for $1,199. A good compromise would be to pay that amount and then be done with it.

3 replies

$\"user-pic\"$

AustinTXProgrammer

May 26, 2009 6:41 PM

Moderate |Flag for review

@exploded: Expected and planned for peaks can be a lot less costly than unexpected ones. They can build out the network to adequately handle it in advance.

If the customer used more bandwidth than expected it could have caused bottlenecks. This will either cause poor service for other customers or require them to do unplanned upgrades. There are substantial costs to have the staff stop working on their normal tasks, possibly pay more for equipment and expedite fees, etc.

So I don't agree with the \"it was obviously profitable\" statement.

$\"user-pic\"$

May 23, 2009 1:12 AM

Moderate |Flag for review

@exploded: Artificial and low costs, actually... Bandwidth ultimately has zero cost. We pay for bandwidth because then there is a reason to limit per user usage so that more is shared, and so that companies can make a profit while investing in increasing the total amount available.

$\"user-pic\"$

Charlotte Rae's Web

May 22, 2009 7:49 PM

Moderate |Flag for review

@exploded: I agree - he wants to do that but they won't.

","

$\"user-pic\"$

May 22, 2009 6:08 PM

Moderate |Flag for review

This is like that story from a week or so ago where a company wanted a guy to pay thousands of dollars in data charges for a movie downloaded abroad.

In most cases the billing system only sees numbers. There may be a cutoff somewhere but a lot of the time it's a fight to get credited for usage before the cutoff, especially if there's no way to prove that you didn't use it.

Most companies that do this kind of billing put the onus on the customer to prove they DIDN'T use what the system says they did, rather than have it be their responsibility to prove that they did.

When I worked at a call center, we were actually trained to pretty much suspect everyone and trust no one when it came to customers. We were not to take their word on anything. If it could not be verified, it was to be closely scrutinized if not outright denied.

","

$\"user-pic\"$

nukee

May 22, 2009 6:10 PM

Moderate |Flag for review

If the person was able to gain control of his server because of Mick's own negligence in coding/patching of the site, then I'd say he's SOL on this one.

","

$\"user-pic\"$

Alarmpro

May 22, 2009 6:10 PM

Moderate |Flag for review

I think we would have to see Mick's contract to make a determination about who is right. Mick might have allowed his hosting ISP the right to keep the 'tab' running in the event of a sudden traffic surge. Had it gone the other way around and the traffic was legitimate, he might be pissed if the hosting was suddenly shut down due to B/W limits.

2 replies

$\"user-pic\"$

David Schwartz

May 23, 2009 10:25 AM

Moderate |Flag for review

@alarmpro: That's why smart hosting providers give you a management interface. You should be able to set notification and automatic-shutoff thresholds. The shutoff thresholds should default to some small multiple of your monthly service level or your past month's usage.

A person whose last month's bill was $125 probably doesn't want a $3,000 bill. And if he does, he can easily flip the switch to change/remove the limit.

Servers get compromised all the time and there's no excuse for a professional hosting provider not having a rational way to deal with signs of suspicious usage.

$\"user-pic\"$

May 22, 2009 6:35 PM

Moderate |Flag for review

@alarmpro: The key will be the notification. Contract or not, was it set up so notification was supposed to happen sooner? Offering notification and then claiming it's not their fault you weren't notified shouldn't hold up.

Personally, I think it's odd they won't just settle for the $1,200. It sounds like a reasonable compromise.

","

$\"user-pic\"$

NotATool

May 22, 2009 6:17 PM

Moderate |Flag for review

I think it all depends on who is responsible for security monitoring and intrusion detection. If the OP is responsible for server security, and someone breaks in and uses a ton of resources, then the OP is also responsible to pay up.

If the hosting company is responsible for security, then they have no business charging the OP for someone breaking in and stealing bandwidth.

3 replies

$\"user-pic\"$

May 22, 2009 6:37 PM

Moderate |Flag for review

@NotATool: It's a dedicated server owned by the customer completely managed by the customer.

$\"user-pic\"$

Mxx

May 22, 2009 9:29 PM

Moderate |Flag for review

@Corporate_guy: it doesn't have to be.
you can rent a dedicated server but the hosting company will be managing it.

$\"user-pic\"$

May 22, 2009 6:54 PM

Moderate |Flag for review

@Corporate_guy: But they have the service that allows 4,000GB and he's willing to pay for that, but they aren't willing to take it. Seems they just want a big pay day. And now they are getting bad press. Stupid.

","","

$\"user-pic\"$

May 22, 2009 6:18 PM

Moderate |Flag for review

Sure if this guy was 1000 gigs over his limit then they should have the right to charge a small fee but any good web host will shut your account off until you call them and approve a fee for more bandwidth, they wont just let the charges rack up.

Time to move hosts.

","

$\"user-pic\"$

Canino

May 22, 2009 6:19 PM

Moderate |Flag for review

I had a dedicated server that had the same problem except it wasn't a compromised server. It was a problem with the bandwidth monitoring software that was randomly adding gigs of bandwidth to my account at irregular intervals.

Demand to see hour-by-hour bandwidth logs. I was able to disprove the charge by showing that the bandwidth I was being charged for was impossible for the server to actually serve. The program was showing huge spikes that would have been impossible for a network card to achieve (a 100mb card for an hour showing traffic that would have required 250mb of throughput).

They wanted something like $9K from me and I ended up paying nothing and getting a month free for my trouble.

","","

$\"user-pic\"$

GMFish

May 22, 2009 6:26 PM

Moderate |Flag for review

If they did not tell you, they gain $5,700. If they did tell you, Zero. Mmmm....

1 replies

$\"user-pic\"$

1234tu

May 22, 2009 7:10 PM

Moderate |Flag for review

@GMFish: Only if you are dumb enough to pay it.

","","

$\"user-pic\"$

BrewMe

May 22, 2009 6:33 PM

Moderate |Flag for review

I am now looking for a new hosting company. Do not wish to have this kind of experience with them.

1 replies

$\"user-pic\"$

dmuth

May 22, 2009 9:04 PM

Moderate |Flag for review

@BrewMe: I can recommend NearlyFreeSpeech. They have a \"pay as you go\" bandwidth usage model.

What means is that if for some reason, your site starts using Gigs and Gigs of traffic, once your account is depleted of funds, the website is turned off, thus limiting your financial exposure.

(In my case, I deposit about $10 at a time, so the most I could lose in such a scenario is less than $10.)

I've been a happy customer of theirs for about 4 years.

","","

$\"user-pic\"$

May 22, 2009 6:36 PM

Moderate |Flag for review

If it's a unmanaged server (like 95% of them are), it's up to the customer to manage... that means keeping an eye on bandwidth, security issues, and mitigation. Customer accepts 100% responsibility.

If it's a managed server, than the ISP is responsible for the whole incident.

It sounds like an unmanaged server... which means the client foots the bill.

This is why most get daily (if not every few hours) bandwidth totals, cpu consumption, apache stats, etc. so they know what's going on. Anything looks unusual you check it out.

","

$\"user-pic\"$

May 22, 2009 6:37 PM

Moderate |Flag for review

Speaking as a web developer, it IS Mick's responsibility as the server administrator to maintain security -- and to monitor it. If my server gets DoSed, I can be declared responsible for the resource usage of the attack. Not fair, since I have no control out of an outside attack, but that's unfortunately the way it works.

At the same time, as someone said, as this is a large uncharacteristic issue, the hosting provider should investigate this. If Mick is not at fault due to poor security, then it falls on the ISP. If Mick was using a poor password, it's on him.
.

","","

$\"user-pic\"$

Anonymous

May 22, 2009 6:43 PM

Moderate |Flag for review

I was in the hosting business for over 10 years. I typically dealt with shared hosting, not dedicated, and we did offer the customer to upgrade to another plan that might have supported the -- we'll call it-- \"new\" bandwidth needs in order to avoid the overage charges. I'm surprised this company did not accept that proposal from the customer. Some providers might argue that the server admin (the customer in general) ensure that \"compromises\" not be allowed to happen. At the same time, I feel that hosting companies should try to work with their clients whenever possible. It would be great if the provider in this case was able to offer their perspective here.

","

$\"user-pic\"$

May 22, 2009 6:53 PM

Moderate |Flag for review

There is a plan they have that allows 4,00GB per month that costs $1,199 per month, and they are totally unwilling to allow me to pay that amount and be done with the issue. At least that is a more manageable amount to suck up than $5,700.

The fact that they aren't allowing him to pay for the 4,000GB one makes me think this company is pretty awful and just looking for a big pay day.

5 replies

$\"user-pic\"$

Rick Hodger

May 23, 2009 5:38 PM

Moderate |Flag for review

That's because you don't understand how datacentre's and ISPs work. They buy bandwidth in bulk yes, but usage planning is done 3-6 months in advance and usually with a minimum commit. That means that the datacentre will go to a transit provider and get that they want 500Mb minimum commit at $5/Mb, and excess at $30/Mb.

This is simple business: The provider has to buy his/her bandwidth in advance and has to plan for usage. If they exceed their usage plans because someone didn't secure their server properly, the provider can't always just eat the massive amount of money that that person may have cost them. That planned 60Mbps might only cost them $300, but an unplanned 60Mbps might cost them $1800. Wholesale electricity suppliers work the same way. Wholesale telephony providers works the same way. This is a very standard practice for big business.

I work for an ISP, and our contracts work the same way. If you have a dedicated server, it is not the datacentre's job to monitor it unless you are paying for a management contract. A simple late-night TV advert for a website can make a server's traffic jump from 3Mbps to 30Mbps, and there is no way for the NOC to know if that is legit traffic or not.

Personally, I'd also say that if your server gets hacked and spends 7 days spitting out 60Mbps of traffic and you only notice because the datacentre sends you a bill? You have no business operating a server exposed to the internet.

To anyone else, if you're worried about this sort of thing happening you should talk to your hosting provider about implementing a bandwidth cap to prevent excess usage and if possible ask to be changed to 95th percentile billing. 95th percentile means being billed at a Mb/s rate, but provides much better protection against overage charges.

$\"user-pic\"$

May 22, 2009 11:07 PM

Moderate |Flag for review

@nakedscience: $5700 is hardly a \"big pay day.\"

$\"user-pic\"$

May 23, 2009 2:44 AM

Moderate |Flag for review

@balls187: that's pretty huge to me. my dedicated server is about $20/month extra per terabyte of data prepaid, and I believe 25 cents/gigabyte overage which ends up either way still being vastly cheaper than $5700 for 4500gb+.

$\"user-pic\"$

May 22, 2009 11:06 PM

Moderate |Flag for review

@nakedscience: Why? They offer a tiered service, with set limits and specific rates for overages.

$\"user-pic\"$

Anonymous

May 22, 2009 7:12 PM

Moderate |Flag for review

He agreed to pay for overages when he signed up. Here is the relevant Terms of Service agreement

\"The TOS states (e) If Customer exceeds its transfer allotment, bandwidth commitment, or other pre-paid Service allotment listed in Customer’s Signup, as solely measured by ServePath, ServePath may: (i) charge Customer for such overage immediately via credit card and will notify Customer in writing of such charge; or (ii) issue a one-time invoice for such overage, with payment due by wire transfer or direct deposit in 7 days. If ServePath concludes, in its sole discretion, that Customer’s account reflects a pattern of repeated overage, ServePath may require prepayment for such overage, and Customer will make such payment on its regular payment date or on a monthly basis. The provisions of this Subsection 2(e) apply regardless of the cause of overage, even if caused by hacker activity or other third party actions.\"

the customer is entirely responsible in this case unless a corresponding managed services security package was included in their purchase.

","","","

$\"user-pic\"$

fluke11

May 22, 2009 7:09 PM

Moderate |Flag for review

The web host is passing on their own cost to the customer based on what the customer signed up for. They get a cheaper rate from their providers for bandwidth *IF* they sign a high commitment level of bandwidth to be used on their carriers. What Mick seems to be doing is asking them to pass on the cost of a higher commit after the fact. At the same time, his host would be eating the costs of a lower commitment level based on Mick's original commitment. It also sound like Mick is trying to get that commitment price as a one-time deal so this doesn't help their profits in the future either. If he can't afford to deal with overage charges then maybe he should consider going with an unmetered bandwidth plan.

Full discloser: I work for competing web host company.

","","","

$\"user-pic\"$

May 22, 2009 7:12 PM

Moderate |Flag for review

The ISP probably needs to take a hike. My hosting is through Dreamhost. I've heard they're aggressive with taking down compromised accounts, but I've never had mine taken down. Even if I was compromised and didn't find out, I have a quota of 8.4TB. I wouldn't realistically expect to be able to suck that out of a shared server without doing something stupid, but maybe that's just me.

Not everybody who has a dedicated server needs one -- and sometimes virtual private servers are enough.

1 replies

$\"user-pic\"$

Mariushm

May 22, 2009 7:51 PM

Moderate |Flag for review

While Dreamhost says you have a quota of 8.4 in reality you would probably not be even to do even 1TB of transfer. This is because your hosting account is on a server with about 2000 other hosting accounts, which all use the same 100mbps network connection to the internet.

Furthermore, the web server is speed-shaping each connection - you can see that as each download that's initiated tops to about 300-500KB/s even though you have a much higher Internet connection.

It's a classic case of overselling and they even admit it here.

","

$\"user-pic\"$

jamesn1

May 22, 2009 7:13 PM

Moderate |Flag for review

(Disclosure: I work for a competitor of Servepath and I have more than a decade of experience in web hosting.)

Servepath should have systems in place that automatically inform their customers when their' bandwidth utilization jumps like that (my employer's system does this, and also alerts our support, networking and policy enforcement groups so they can proactively respond when necessary).

However, a dedicated server is a very powerful tool that can be used for a lot of evil if it's not maintained and managed properly and, unfortunately, the only person who can do this is the customer. Whenever I see the, \"I didn't have time because I was busy with (blank),\" excuse I tend to wonder what the purpose of the server was and what would have happened if the hard drive or ram in that box had failed. Generally, dedicated servers are owned by small business owners. If your server gets broken into, and you don't notice for a couple of weeks, are you paying any attention to your customer? I don't know if that's the case here, but the question stands.

As for not letting him pay the lower amount, this is pretty standard in the industry. Hosting providers have to pay for bandwidth too. They buy bandwidth at certain \"commit levels\" at certain pricing, but when a provider goes over their commit, they pay bandwidth overages to their providers. My point is that if you are a provider, and you have a customer who goes over their bandwidth allocation by 400%, you may be left holding the bag on bandwidth overages yourself, so giving your customer a discount may save that customer and may make everyone feel good, but overall it was a bad business decision; you just sold bandwidth at a loss and that's a poor idea that ultimately not only harms the business, but every other customer as a result.

1 replies

$\"user-pic\"$

Anonymous

May 22, 2009 8:32 PM

Moderate |Flag for review

@jamesn1: Most data centers don't buy bandwidth as a function of the amount of data transferred but rather according to the \"95th percentile rule.\" Any data center with an Ops Mgr with a pulse would have a system in place to make sure they don't cross that 95th percentile threshold otherwise they are just as negligent IMHO. I'm not saying the guy should get off scot-free, but what they are doing is not only outrageous but stupid. The data center I use offers a chance to upgrade to whatever package covers the overage and retroact the billing, but then again, they're smaller and not thieves....

","

$\"user-pic\"$

rambow681

May 22, 2009 7:17 PM

Moderate |Flag for review

Let's say instead of stealing bandwidth the intruder stole or deleted valuable data. Who would be responsible for that? OP of course.

Just because the intruder stole his hosting company's bandwidth doesn't make it their responsibility to eat the cost. 4,500GB in 7 days is about 50mbit/sec sustained. That's a HUGE amount of data, and should have an equally HUGE cost.

When you don't know what you're doing, running a server can be expensive. Let this be a lesson -- pay someone to secure your server if you're unable to do it yourself. It's much cheaper than other outcomes such as this.

4 replies

$\"user-pic\"$

rambow681

May 22, 2009 7:46 PM

Moderate |Flag for review

@rambow681: also I'd like to point out that it seems like the hosting company wants to get rid of him as a customer. I certainly would want to be rid of him. He doesn't watch his server and it's not secured, and he doesn't want to pay. He's a liability.

$\"user-pic\"$

May 22, 2009 8:59 PM

Moderate |Flag for review

@rambow681: zomg he made one mistake!

$\"user-pic\"$

rambow681

May 22, 2009 9:26 PM

Moderate |Flag for review

@nakedscience: We don't know that he made one mistake. He never said \"this is the first time this has happened.\" For all we know it's a chronic problem with him. His hosting company is being hard-line about it for a reason.

$\"user-pic\"$

May 22, 2009 9:55 PM

Moderate |Flag for review

@rambow681: Perhaps that reason is because they are douchebags? You've been here a while, yes? Companies like to be douchebags for no reason.

$\"user-pic\"$

rambow681

May 22, 2009 10:17 PM

Moderate |Flag for review

@nakedscience: There's no denying that the fee is exorbitant. But Mick agreed to those terms when he signed up for their services. I have a problem is with the \"I was busy\", \"it's not my fault\", \"you should have warned me\" attitude the guy seems to have. If he's too busy to watch his servers he should pay someone else to do it (aka managed hosting.) It's absolutely his fault for the machine not being secured. And the only monitoring that ServePath advertises is \"Ping Monitoring w/ Proactive Response.\"

ServePath could work with the guy, lower his bill, etc. But they don't have to. They're following the contract they have with the guy. As unfair as it may seem, it is what it is. Dinging a company for not going \"above and beyond\" doesn't sit well with me. To call following a contract being \"douchebags\" isn't right either.

$\"user-pic\"$

May 22, 2009 7:22 PM

Moderate |Flag for review

@rambow681: Dude:

There is a plan they have that allows 4,00GB per month that costs $1,199 per month

They \"sell\" 4,000GB per month for $1200. There is NO FUCKING WAY it costs them almost $6k. None, zero, zilch. At this point, they just want to be greedy, when the customer is MORE than willing to pay for the ACTUAL COST of the bandwidth.

$\"user-pic\"$

rambow681

May 22, 2009 7:38 PM

Moderate |Flag for review

@nakedscience: They can offer plans of that size because most people won't use all 4,000GB of transfer. The 4,000GB plan also likely has a 12 month contract. The hosting company's costs are irrelevant, Mick has a certain plan with certain costs. Does it cost T-mobile 35 cents a minute to connect my calls when I run out of plan minutes? Nope, but that's what overage is all about. Though, to be fair to T-mobile, anytime I've gone over one call to them has gotten the overage removed.

$\"user-pic\"$

May 22, 2009 8:59 PM

Moderate |Flag for review

@rambow681: \" They can offer plans of that size because most people won't use all 4,000GB of transfer.\"

Bullshit excuse.

\"The 4,000GB plan also likely has a 12 month contract. \"

So? Still costs the same.

","","

$\"user-pic\"$

Mariushm

May 22, 2009 7:37 PM

Moderate |Flag for review

Even if he wanted the traffic or not, the ISP will pay for that bandwidth upstream, so he should pay for that traffic.

However, Servepath should be more lenient and allow him to at least pay the $1000 because that would cover their costs.

A datacenter usually buys 1 mbps of bandwidth in 1000 mbps commitments for around 7-10$ so the datacenter's costs would be around $7*50 per month or around $350-500.

Servepath should have given him an automated email after a day or two letting him know that based on his past traffic, he will get over the limits fast. If Mick is a good customer with a good history at them, after two days they should have given him at least a call or limit his port speed to 10mbps or some reasonable value so that he won't get over the limits so easily.

Also, Mick should carefully read the terms of service because some say that if there's some kind of DOS (denial of service) they must intervene and block that or limit it.

","","","","

$\"user-pic\"$

Charlotte Rae's Web

May 22, 2009 7:51 PM

Moderate |Flag for review

It's funny, I see people get furious when their server shuts them down for blowing their bandwidth but that's a lot better than getting a nearly $6k bill in my opinion.

","","

$\"user-pic\"$

kc-guy

May 22, 2009 7:53 PM

Moderate |Flag for review

Wow, maybe the salary I earn managing and securing my company's web servers is justifiable after all!

","

$\"user-pic\"$

pmcpa4

May 22, 2009 8:07 PM

Moderate |Flag for review

your equipment used it, you gotta pay for it. Those are the rules he most likely agreed to when he signed up. This is what you have to deal with when you want your own server. No one watches it but you.

","

$\"user-pic\"$

Jay Gordon

May 22, 2009 8:28 PM

Moderate |Flag for review

This should be something that any good hosting company could avoid easily. By monitoring the traffic per port, you can view spikes and have software in place to notify your network techs when such spikes occur. You could have turned the port down, located the source of the compromise, correct or replace the solution and then bring it back online. Servepath is in the wrong here, they should have network abuse prevention already in place.

","","

$\"user-pic\"$

May 22, 2009 8:47 PM

Moderate |Flag for review

Bandwidth is dirt cheap. Anyone who tries to tell you otherwise is just propagating a myth created by the jackasses behind metered billing and caps.

Web Host should have notified Mick. If they sell bandwidth and colo space, then they have the tools necessary to track usage. Its how they earn a paycheck, after all.

It sounds like both sides are at fault for different reasons:
Mick is responsible for his own server.

The colo is responsible for cutting him off before letting his overages skyrocket to unreasonable amounts. Also, denying the request to work with Mick on the bill is suspicious. Unless this isn't the first time its happened.

","","","

$\"user-pic\"$

May 22, 2009 9:01 PM

Moderate |Flag for review

That is a bit much... I have a 1/2 cab and 20Mbps of quality tier bandwidth where I colo in Denver. I pay $1000 a month. If something is slightly off about my bandwidth usage, an email is sent to me to let me know things are off. Servepath needs to man up and give the guy a break.

","","","","

$\"user-pic\"$

crlarkin

May 22, 2009 9:40 PM

Moderate |Flag for review

Wow, I work for a competitor as well, first off, Mick needs to look for a new provider, my company provides servers with 4TB of bandwidth starting at $189.00 per month, second and most unfortunate, he is most likely going to have to pay it.

","","

$\"user-pic\"$

Mxx

May 22, 2009 10:04 PM

Moderate |Flag for review

I work for a hosting company(not Servepath) and here's how we handle such situations:

By default our dedicated servers are \"managed\"(hosting company manages the server and has root access). All OS security, patches and configurations are our responsibility. Client has just regular user account where they can upload files, add/remove websites, whatever else they need to do. Client is responsible for their installed applications (wordpress, forums, gallery, whatever else might have installed).

We also offer \"self-managed\" dedicated servers. In this situation we provide clients with root access and surrender all server management responsibilities to them. Before the client gets root access they have to agree to a pretty detailed disclaimer which also covers the exact situation like Mick experienced.

If we detect an unusual activity on a server(abnormally high bandwidth or cpu usage) we investigate what's going on. In the case of \"managed\" servers if an exploit was caused by our fault(misconfigured server or some critical software is not up-to-date/patched) we notify the client and work with them on resolving this issue. We absorb any costs that would arise from this.

However, if a server was compromised because of client's installed software(didn't change default passwords, didn't properly configure file/directory permissions, did not remove exploitable \"sample\" scripts) then we contact the client and definitely present them with a bill, but we will also work with them on resolving this problem. Quiet often servers are getting exploited not because of the client's direct fault but because they use badly written software that has more security holes than a swiss cheese.

In the case of \"self-managed\" servers getting exploited, it's totally the client's responsibility no matter what caused the exploit. We'll push much stronger for them to pay whatever overages they incurred. However, even still we will work with them on an acceptable solution. If it's obvious that they are way over their head in the 1st place, we will absorb the overages on the condition that they will have to pay the full setup fee to reformat/reinstall their server and from that point on switch it to \"managed\" mode. If that client will want \"self-managed\" hosting, they'll have to go some place else.

","

$\"user-pic\"$

calchip

May 22, 2009 10:10 PM

Moderate |Flag for review

Paying over $1 per gigabyte of transfer, even on overages, is nothing short of robbery -- and particularly in this case, when it was caused by a security issue. Yes, because of the way bandwidth utilization goes, the ISP is entitled to charge more for unexpected overages, but those sorts of rates haven't been competitive for at least 4 or 5 years.

If Servepath is charging $1200/month for 4,000 gigs at regular price, the OP is getting hosed unconscionably.

We have a number of fully-managed servers (and I mean FULLY managed - ISP does everything from security updates to installing scripts, to troubleshooting broken applications, all included in their monthly charge) We pay about $400/month for a server with 30Mbits of bandwidth, which is about 3 times the bandwidth of the $1200 plan Servepath won't give the customer. Additionally, there's automated monitoring and if server utilization goes above our contracted bandwidth for more than a minute or two, we get a phonecall and an email.

There are a ton of decent ISPs out there who can sell you 5000 gigs of transfer for $250/month or less, and for a little more, you can get a quality managed server where the ISP is responsible for those sort of security breaches.

Servepath is *supposed* to be a good ISP. Obviously not, if they're seriously trying to charge these sorts of rates. They are probably paying $250 for the bandwidth they are trying to sell him for $5000. I would suggest taking them to small claims court and continuing to make a big stink. If they lose a single customer as a result of this Consumerist posting, then they've already lost more than they were trying to rip him off for in the first place.

","","

$\"user-pic\"$

May 22, 2009 10:59 PM

Moderate |Flag for review

Well the notion that he should be able to pay $1,900 is a bit retarded.

If I 500 minute cell phone plan and end up using 4,000 minutes that month, there is no way I would expect AT&T to just let me pay the difference between my 600 minute plan and the 4000/Unlimited minute plan, instead of the per minute cost I owe them.

I dont think a datacenter has a responsibility to report when you're hitting your limit. Then again, obama's new CARD law says credit card companies must notify you if you will go over ur limit, so is that much different than this?

2 replies

$\"user-pic\"$

May 23, 2009 3:02 AM

Moderate |Flag for review

@balls187: Backdating actually happens all the time, especially with cell phone carriers. Why? Its a simple upsell opportunity. Back when I was with Verizon, I remember awhile I sent about 200 text messages in one month with no plan. Verizon's system picked up the overage and a rep called, informed me of the overage and offered to backdate the entire month if I added a texting plan to my account. They would rather sign up the customer for a recurring plan that meets their needs rather than gouging them for one month and not collecting any extra the next.

$\"user-pic\"$

May 23, 2009 4:28 AM

Moderate |Flag for review

@datruesurfer: ATT's GoPhone/Pre-paid service did that to me last week. I sent several text messages in one night, they sent me an email about how easy it would be to sign up for one of their extra pre-paid text plans.

","","","

$\"user-pic\"$

May 23, 2009 1:02 AM

Moderate |Flag for review

I presume when he said \"4,00GB per month that costs $1,199 per month\", he meant 4,000GB and not 400GB.

I think a better comparison would be for cell phone minutes usage. Most cell phone services allow you to set alerts/reminders when you're close to going over your limit. In this analogy, what happened would be you went over and they didn't let you know about the over usage for a week.

","","","","

$\"user-pic\"$

ajarvela

May 23, 2009 2:49 AM

Moderate |Flag for review

I work for a major ISP that hosts dedicated servers, and other types of hosting. This situation comes up from time to time.

Usually, on a first offense, we'll wave the bandwidth overage charges but it's made clear to the client that server security is their responsibility. A second compromise, though unfortunate, is at the client's expense.

My situation is unique because I work for a Tier1 ISP so we own the bandwidth and can easily write off something like this. Servepath is a much smaller ISP and is on the hook to somebody else for their bandwidth charges. Most likely Servepath would have to \"eat\" the bandwidth charges if somebody doesn't pay them. With that being said - they are definitely marking up the bandwidth to their end users. If nothing else they should come down to \"at cost\" pricing on the stolen bandwidth if they're unable/unwilling to waive the charges entirely.

","

$\"user-pic\"$

May 23, 2009 2:53 AM

Moderate |Flag for review

This story is a good example of why some web hosts are providing Intrusion Detection Services, backed with a guarantee. Its usually anywhere from $5-$15/mth if your host offers it and they will cover any bandwidth overages and an OS reload if a network attack is detected.

","","","

$\"user-pic\"$

Jon Wilson

May 23, 2009 4:50 AM

Moderate |Flag for review

Ok, this is going to sound weird but look at the picture of the servers and scroll the page up and down kind of quickly. It's giving me an optical illusion vibe where the servers look like they are tilting up and down. Does anybody else see it? No, I'm not on anything...

","","

$\"user-pic\"$

William Platnick

May 23, 2009 10:56 AM

Moderate |Flag for review

I'm the CTO of a hosting company and I can sympathize with the gentleman. Actually we were just in a similar situation this week dealing with bandwidth overages.

First, if the company gave him the ability to check his bandwidth, then it's the customers responsibility to make sure he isn't going over. The company went through some effort to make that info available. If it's something that he had to rely on the company to tell him about with no way to check himself, then a week is a lot of wasted time and the ISP should certainly try to compromise.

Second, there are very real bandwidth charges. It's not like it is in the FiOS and Cable modem world for hosting companies. Bandwidth is very, very expensive. We just had a customer whose web site was having all their images (3 TB) harvested. The bandwidth taken up pushed us over our commit rates for a certain amount of time and can easily cost us several thousand dollars on a server paying us much, much less. Any company that eats that cost isn't going to be around very long to help their customers business's succeed.

","

$\"user-pic\"$

viqas

May 23, 2009 12:40 PM

Moderate |Flag for review

To be honest, i think the company is an asshole for not offering him to move up to the 4,000 gb level and back date it.

But they dont have to do that. I think it is Mick's responsibility to keep an eye on his server.
What mick should have done is install a program on the server to notify him if something was going wrong like bandwidth or high cpu usage.

I have unlimited bandwith and space on my dreamhost account, when I did have metered service I had a setting that set traffic shaping in case something did go wrong.

","","

$\"user-pic\"$

May 23, 2009 7:18 PM

Moderate |Flag for review

$5700?!?! fark, my DS3 costs less than that per month.

","

$\"user-pic\"$

italianscallion33

May 24, 2009 4:41 AM

Moderate |Flag for review

I have no clue what bandwidth really costs and whether this guy is really being ripped off, but I think of it like a cell phone plan. It's how they make their money (besides overcharging for plans in the first place I guess). OP shouldn't expect to backdate everything on the better plan. But if it's in his contract that they would monitor for him, then he shouldn't owe the $.

","

$\"user-pic\"$

guspaz

May 25, 2009 6:40 PM

Moderate |Flag for review

When my server at ThePlanet went over its bandwidth cap by about 1000GB and their notification system failed to send me the warnings (either before I went over or after), they (eventually, after posting in their forums after weeks of getting the run-around by phone) dropped the charges from my account since their notification system was supposed to warn me and it was reasonable for me to rely on this system.

Of course, ThePlanet's overage fees were $0.50. This is already insanely high (my DSL ISP charges $0.25 or $0.10 in advance, my current server provider charges $0.10 period), and racking up $5,700 in overage for $500GB in usage sounds suspiciously like $2/GB, which is highway robbery. Actual costs are nearly two orders of magnitude lower than that.

","");