[mtlynch]

You don't mean literally distributed denial of service attack, right? It's super easy to keep serving a static resource, so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.

I've had spikes of up to 300k visitors to my Firebase blog in a month, and the bill was like $150. It seems hard to get bitten by huge surprise costs from a blog on Firebase static hosting, even if someone's using a botnet to try to drive up your bill.

Edit: Thinking about it a little more, I guess you could find the largest resource on a blog and direct your botnet to download it nonstop repeatedly, and that would be orders of magnitude more expensive than even large organic traffic.

[dkarras]

That is... $150 you definitely didn't have to spend.

[BrandoElFollito]

> so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.

No, I was referring to your bill, when your resource usage spikes (really spikes, as in sustained Gbps+ traffic spikes). Many people were taken aback by the unexpected bills.