Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

181–190 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#181

Post by coredog64 »

sillysaurusx wrote: post #139
genxy wrote: post #133

Earlier quoted context omitted.

I am referring to cross-zone within in the same region, so like us-central1-a to us-central1-b. These are building to building and often never cross public land.

Oh, yes! I forgot entirely about that case. You're right, egress traffic is charged there too. Are the datacenters really located so close together? I assumed they weren't within walking distance of each other.

Correct, they're close in the sense of country-scale geography but physically spaced to avoid specific issues like location on a flood plain.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#182

Post by andreareina »

nurettin wrote: post #135
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

I'd buy the technically impossible angle. Even if you manage to get your microservices to synch every penny spent to your payment account at realtime (impossible) you still have to waiver the excess, losing some money every time someone goes past their quota.

"I can only do the job pretty damn well, not perfectly, so might as well not try."

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#183

Post by bombcar »

lukewarm707 wrote: post #6
patcon wrote: post #2

That's fucking bonkers that nothing in the system could see this as unusual and worthy of throttling. The embarrassment of this -- that a company LITERALLY SELLING machine learning services and expertise -- cannot spot such a thing... This should have led them to deal with this internally and refund it. Just... Wow Google.

there is no way to cap your billing on gcp. you can get notifications but that's it. i don't want to get throttled below my quota but some type of spend limit would be good.

Is there a cloud provider that does have hard unbreakable billing caps? Everything I've seen has always been notifications or soft caps.

Not talking about fixed-access things like a Hetzer box.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#184

Post by zozbot234 »

addandsubtract wrote: post #165
zozbot234 wrote: post #78

Earlier quoted context omitted.

> Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly This was reported a long time ago, and was supposed to be fixed by Google via making sure that these legacy public keys would not be usable for Gemini or AI. https://news.ycombinator.com/item?id=47156925 https://ai.google.dev/gemini-api/docs/troubl…

FWIW, I just create a new Gemini API key today, and it had a different format than my old ones (created 10 days ago). So maybe they changed something?

A reply on OP's post states: "... We now generate Auth keys by default for new users (more secure key which didn’t exist when the Gemini API was originally created a few years ago) and will have more to share there soon. ..." So there is something new in that exact area but the details are forthcoming.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#185

Post by p_stuart82 »

dabedee wrote: post #42

As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.

[flagged]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#186

Post by weird-eye-issue »

sillysaurusx wrote: post #91
dminik wrote: post #62

Earlier quoted context omitted.

Try this one. Should remove most readme keys: Edit: self censor based on a request

I know you're well within your rights to post this, but would you consider replacing your comment with something like "It's easy to find working keys on github if you search the appropriate terms"? Think of it this way: although you're not to blame, HN drives a lot of traffic to your preconfigured github search. There are also bad actors who browse HN; I had a Firebase charge of $1k from someone who set up an automat…

They have an automated process when keys get leaked on GH to get revoked automatically.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#187

Post by post-it »

_nhh wrote: post #160

With AI there is NO justification in NOT DOING IT BY YOURSELF. Why use firebase or if you can generate by yourself and deploy to hardware you own or rent.

> and deploy to hardware you own or rent.

Because this part sucks. I grew up fiddling with Linux. I don't want to play devops anymore. I want to write code and run it.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#189

Post by weird-eye-issue »

p_stuart82 wrote: post #185
dabedee wrote: post #42

As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.

[flagged]

Thanks LLM.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#190

Post by bartread »

nurettin wrote: post #176
bartread wrote: post #140

Earlier quoted context omitted.

Sure, but 80 -> 28,000 -> 54,000 is a hell of a lot of slippage. Trading platforms can guarantee a maximum slippage on stops, and often even offer guaranteed stops (with an attached premium), so I don’t see why Google and Firebase can’t do similar. The way it works at present is ridiculous.

> Trading platforms can guarantee a maximum slippage on stops Yeah no, physically impossible. If nobody is selling at that price, there is no guarantee your sell stop will execute near that price. They can sweep the market, find the best seller price and execute. There might be a costly way to do it with microservices as I indicated, but your example easily falls apart.

Not impossible to do: they can hedge and/or absorb the cost, hence the premium. They usually also specify a (fairly large) minimum distance for such stops.
Post reply on HN