Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

211–220 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#212

Post by bdashdash »

flippyhead wrote: post #210
logankilpatrick wrote: post #170

Earlier quoted context omitted.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap... By default, new Tier 1 paid accounts can only spend $250 in a given month.

I'm sure it's me being an idiot, but once again I spent 20m trying to figure how to do a specific thing in google-land and still haven't figured it out. Even if I did set it somewhere, I see things like "Setting a budget does not cap resource or API consumption" with a link to a bunch of documentation I have to analyze.

This is what working with cloud services is like, in my experience. Azure's UI feels like it was made as a joke flash game on Newgrounds.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#216

Post by DaedalusII »

on the one hand if you play with petrol you cant complain about burning down your garage

on the other hand hetzner sell ipv4 instance with no security on by default, just raw ubuntu 24.x

within 3-4 days of deploying one, it will be hacked and have crypto miners installed unless additional special config is added. i do wonder what % of hetzner vps instances are compromised

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#217

Post by coredog64 »

imafish wrote: post #103
dabedee wrote: post #42

As others have said, this is a "feature" for Google, not a bug. There is no easy way to set a hard cap on billing on a project. I spent the better time of an hour trying to find it in the billing settings in GCP, only to land on reddit and figuring out that you could set a budget alert to trigger a Pub/Sub message, which triggers a Cloud Function to disable billing for the project. Insanity.

This is from my experience the same in AWS and Azure. I would love for a kill-switch if the usage goes above a critical threshold. 5 hours down time will not kill my app but a huge cloud bill might.

It's been a year since I last looked at this, but when I did you could get near-realtime cost metrics for AWS Bedrock via CloudWatch (you get input & output token counts and have to generate the actual price yourself)

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#219

Post by charcircuit »

Barbing wrote: post #205
arcticfox wrote: post #150

Earlier quoted context omitted.

I get furious every time this comes up and somehow there are bootlickers ready to defend big tech on it. My ~2 person small business was almost put out of business due to a runaway job. I had instrumented everything perfectly according to the GCP instructions - as soon as billing went over the cap the notification was hooked up to a kill switch, which it did instantly. GCP sent the notification they offered as best p…

Almost wish the people defending it were paid. Almost more intelligent to rush to the defense if there were a direct financial benefit. Part of it is possibly the curse of knowledge. Someone in the 99th percentile of cloud configuration experts simply can't recall their junior dev days.

In my junior dev days I always paid for the resources I used. Just because you consume a lot of resources by accident that doesn't mean you shouldn't have to pay for it. Accidents do not absolve you from liability.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#220

Post by Bridged7756 »

time0ut wrote: post #110

It is scary building on the public cloud as a solo dev or small team. No real safety net, possibly unbounded costs, etc. A large portion of each personal project I do is spent thinking about how to prevent unexpected costs, detect and limit them, and react to them. I used to just chuck everything onto a droplet or VPS, but a lot of the projects I am doing lately need services from Google or AWS. I tend to prefer GCP…

I wonder what happens if you just decide not to pay. Surely that would have some legal implications in the US, but what about elsewhere?
Post reply on HN