Is Serverless a Scam? Uncovering Hidden Costs, Complexity, and Reliability Risks

Background

Serverless solutions are increasingly being pushed back onto traditional servers, prompting the author to reflect on a previous essay titled “A Eulogy For Serverless.” The piece originated as an update to a micro‑service article but evolved into a largely opinion‑driven critique.

DDoS Protection

The author notes that many serverless offerings advertise free DDoS protection, yet comparable protection can be achieved without serverless by enabling Cloudflare’s proxy feature. A simple configuration change—switching SSL/TLS encryption from “Flexible” to “Full”—avoids infinite redirect loops and provides full protection without extra setup.

Complexity

Serverless products are described as “damn complex.” Misconfigurations, such as forgetting to adjust default S3 bucket settings, can lead to unexpected billing spikes. The complexity extends to security: unlike a VPS where one can install fail2ban and disable root password login, securing a serverless micro‑service architecture requires locking down each service individually, a daunting task.

Uptime

The author contrasts personal experience with a VPS‑based RSS reader that rarely crashes (downtime measured in seconds) against frequent large‑scale outages on managed services like Firebase Auth (2023), AWS EC2 (West Coast, 2023), and Azure (2023). The argument is that overly complex systems tend to be less reliable than simpler ones.

Pricing

Serverless is portrayed as expensive due to vendor lock‑in and data egress fees. The monopoly of cloud providers forces users to stay on platforms like AWS, GCP, or Azure, inflating costs. The author cites examples of companies (e.g., DHH) claiming multi‑million‑dollar savings by moving off the cloud, and a study indicating that 25% of surveyed UK enterprises have migrated half or more of their cloud workloads back on‑premises.

Conclusion

While serverless can offer conveniences, the article concludes that it often becomes a financial black hole and a maintenance nightmare. For workloads focused on online content (e.g., RSS readers), a self‑hosted VPS is recommended. The ecosystem is shifting toward open‑source alternatives such as PocketBase, Supabase, and Appwrite, reducing reliance on proprietary serverless stacks.