Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

151–160 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#151

Post by jubilanti »

ch0wn wrote: post #142
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

Not if your contractor had you first sign a 15 page contract that commits you to whatever costs they dream up and requires forced arbitration by a corporate friendly firm when any dispute arises.

Because that's somehow normal in today's tech world.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#152

Post by startages »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#153

Post by pwdisswordfishs »

lxgr wrote: post #146
pwdisswordfishs wrote: post #128

Earlier quoted context omitted.

Google Maps is not Firebase. And "Firebase AI Logic" sure sounds like something easy to confuse with a Firebase service...

The same principle applies, though. I'm absolutely not defending Google here, to be clear: Retroactively expanding the scope of an API "key" explicitly designated as "public/non-sensitive" is very bad. But the concept itself does make some sense, and I'm just noting that there's precedent both across Google and other companies.

> The same principle applies, though.

How?

"Firebase AI Logic"

Is this a Firebase service or not?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#154

Post by radlad »

walthamstow wrote: post #147
nurettin wrote: post #135

Earlier quoted context omitted.

I'd buy the technically impossible angle. Even if you manage to get your microservices to synch every penny spent to your payment account at realtime (impossible) you still have to waiver the excess, losing some money every time someone goes past their quota.

I'm with you. And what do you even do when the quota is breached, nuke the resources? People will complain about that just as much as overspends. I don't buy the 'evil corp screwing people' angle either. They are making farrr too much legit money to care about occasionally screwing people out of 20k and 50k.

If I set a limit, and you cut off my service because I reached the limit, I would definitely not "complain just as much" as if I set a limit and you allowed me to spend past it.

We're not talking about an EC2 or EBS volume here, this is access to an API.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#155

Post by reaperducer »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

hard cap it's technically impossible

These companies can sell your personal information in a microsecond in an advertising auction, but somehow can't figure out how to give you timely alerts that stop their cash flow.

Big shock.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#156

Post by [deleted] »

radlad wrote: post #154
walthamstow wrote: post #147

Earlier quoted context omitted.

I'm with you. And what do you even do when the quota is breached, nuke the resources? People will complain about that just as much as overspends. I don't buy the 'evil corp screwing people' angle either. They are making farrr too much legit money to care about occasionally screwing people out of 20k and 50k.

If I set a limit, and you cut off my service because I reached the limit, I would definitely not "complain just as much" as if I set a limit and you allowed me to spend past it. We're not talking about an EC2 or EBS volume here, this is access to an API.

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#157

Post by sdevonoes »

Leomuck wrote: post #145
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

It’s not fair. Google, Amazon, Microsoft… they have never played fairly. They will never do.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#158

Post by zbentley »

bartread wrote: post #140
nurettin wrote: post #135

Earlier quoted context omitted.

I'd buy the technically impossible angle. Even if you manage to get your microservices to synch every penny spent to your payment account at realtime (impossible) you still have to waiver the excess, losing some money every time someone goes past their quota.

Sure, but 80 -> 28,000 -> 54,000 is a hell of a lot of slippage. Trading platforms can guarantee a maximum slippage on stops, and often even offer guaranteed stops (with an attached premium), so I don’t see why Google and Firebase can’t do similar. The way it works at present is ridiculous.

Yep. And cloud providers could eat any slippage cost (enforcing, say, every 5 minutes by stopping service) without even a rounding error on their balance sheets.

The fact that they don’t indicates that there’s no market reason to support small spenders who get mad about runaway overages, not that it’s technically or financially hard to do so.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#159

Post by isoldex »

rtkwe wrote: post #105
Maxious wrote: post #98

Earlier quoted context omitted.

> The Gemini API supports monthly spend caps at both the billing account tier and project levels. These controls are designed to protect your account from unexpected overages, and the ecosystem to ensure service availability https://ai.google.dev/gemini-api/docs/billing#project-spend-...

The problem is it's specific to that API and defaults to uncapped so people who aren't using it and haven't heard about the issues with the Firebase API keys probably won't have set them.

Spend caps exist for Gemini (Maxious linked them) - they just default to OFF. For an API that can bill four figures per hour, opt-in safety by default isn't a UX choice, it's a billing strategy
Post reply on HN