Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

191–200 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#191

Post by juancn »

These are all poorly designed systems from a CX perspective (the billing systems).

Billing is usually event driven. Each spending instance (e.g. API call) generates an event.

Events go to queues/logs, aggregation is delayed.

You get alerts when aggregation happens, which if the aggregation service has a hiccup, can be many hours later (the service SLA and the billing aggregator SLA are different).

Even if you have hard limits, the limits trigger on the last known good aggregate, so a spike can make you overshoot the limit.

All of these protect the company, but not the customer.

If they really cared about customer experience, once a hard limit hits, that limit sets how much the customer pays until it is reset, period, regardless of any lags in billing event processing.

That pushes the incentive to build a good billing system. Any delays in aggregation potentially cost the provider money, so they will make it good (it's in their own best interest).

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#192

Post by TrackerFF »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

It's like a fire alarm system that goes off 30 mins after the it senses a fire. Good stuff.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#193

Post by [deleted] »

intended wrote: post #79
dabedee wrote: post #42

As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.

As the other user said - this would be an anti-feature and user hostile. This is a sign that somehow there isn’t sufficient incentive to work on these features.

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#194

Post by ai_slop_hater »

Leomuck wrote: post #145
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

You can try implementing rate limiting and not exposing your API keys to the public.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#195

Post by Barbing »

benoau wrote: post #174
Leomuck wrote: post #145

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

Your kid can do this in a smartphone game designated suitable for children, heavily optimized to exacerbate the possibility, and depending on where you live they can just choose not to refund you. When the FTC went investigating a decade-ish ago they found Facebook saying the quiet parts out loud: it was all extremely deliberate.

I long for the days where kids were only hurting their parents' wallets and not themselves.

>Another prompt asked, "What do you think of me," I say, as I […]. My body isn't perfect, but I'm just 8 years old - I still […]."

Pretty odd to copy from policy documents and feel a need to self-censor. But I guess that's Mark Zuckerberg[‘s chief ethicist] for you.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#196

Post by Barbing »

drfloyd51 wrote: post #149
whywhywhywhy wrote: post #137

Earlier quoted context omitted.

Why is the default uncapped then other than the hopes of billing people who screw up or get exploited.

See also: Why is the default cap so low? I lost €78bojillion because my API stopped working.

Demand on-call phone numbers, autodial the entire company when it looks like they’re about to lose their first bojillion.

No, you don't really have to give Google a bunch of phone numbers. The input box will also accept entry of the following text:

“I'm a big stupid idiot, and when my API stops working, which it will, it will be all my fault and not Google's.”

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#197

Post by projektfu »

nurettin wrote: post #176
bartread wrote: post #140

Earlier quoted context omitted.

Sure, but 80 -> 28,000 -> 54,000 is a hell of a lot of slippage. Trading platforms can guarantee a maximum slippage on stops, and often even offer guaranteed stops (with an attached premium), so I don’t see why Google and Firebase can’t do similar. The way it works at present is ridiculous.

> Trading platforms can guarantee a maximum slippage on stops Yeah no, physically impossible. If nobody is selling at that price, there is no guarantee your sell stop will execute near that price. They can sweep the market, find the best seller price and execute. There might be a costly way to do it with microservices as I indicated, but your example easily falls apart.

If they are a market maker, they can buy/sell at or near your stop. It might be a bad idea for them, but if they have a guarantee, this is how they will do it. Or, it will be like the Amazon guarantee (refunding free shipping on your late order).

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#199

Post by Leomuck »

ai_slop_hater wrote: post #194
Leomuck wrote: post #145

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

You can try implementing rate limiting and not exposing your API keys to the public.

Yes, and you should! But not doing so resulting in this seems kind of over-the-top. Basically means an oversight can result in your bankcruptcy?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#200

Post by wing-_-nuts »

jubilanti wrote: post #151
ch0wn wrote: post #142

Earlier quoted context omitted.

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

Not if your contractor had you first sign a 15 page contract that commits you to whatever costs they dream up and requires forced arbitration by a corporate friendly firm when any dispute arises. Because that's somehow normal in today's tech world.

Slightly OT, but I've always taken a dim view of this sort of thing for consumers because the parties are never at equal parity, either in ability to understand the legalese they're agreeing to, or the ability to seek alternatives.

Legal contracts for consumers should be written at whatever the prevailing reading level is, and the government should step in the more monopolistic position a company is in.

It infuriates me to no end how preferential government is towards corporations vs individuals.

Post reply on HN