Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

241–250 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#241

Post by dmurray »

nurettin wrote: post #176
bartread wrote: post #140

Earlier quoted context omitted.

Sure, but 80 -> 28,000 -> 54,000 is a hell of a lot of slippage. Trading platforms can guarantee a maximum slippage on stops, and often even offer guaranteed stops (with an attached premium), so I don’t see why Google and Firebase can’t do similar. The way it works at present is ridiculous.

> Trading platforms can guarantee a maximum slippage on stops Yeah no, physically impossible. If nobody is selling at that price, there is no guarantee your sell stop will execute near that price. They can sweep the market, find the best seller price and execute. There might be a costly way to do it with microservices as I indicated, but your example easily falls apart.

They can take the other side of your other themselves, lose money sometimes, but make it up in the premium they charged you in the first place (or in the old days, from your other trading fees or your monthly subscription payment).

Cloud providers would be taking way less risk interacting with their own services than a broker does interacting with the market. Perhaps they would be more at risk from bad actors, but it shouldn't be significant: they could reserve this behaviour for people who have already spent, say, $100 with them so you can't abuse it at scale.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#242

Post by charcircuit »

Barbing wrote: post #232
charcircuit wrote: post #219

Earlier quoted context omitted.

In my junior dev days I always paid for the resources I used. Just because you consume a lot of resources by accident that doesn't mean you shouldn't have to pay for it. Accidents do not absolve you from liability.

Interesting! I know software is special. That's why software defects are acceptable while a crumbling bridge is not. With that said, should this apply to other industries? If I clip a warehouse shelf on my first day driving a forklift, should my wages be garnished for life to cover the inventory? Or is the inherent nature of the logistics industry such that an accident does not always imply liability? (Or other)

The employer is held liable in such a scenario.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#243

Post by Glemllksdf »

sofixa wrote: post #224
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

> So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "hard cap it's technically impossible" etc.) Yes, it's technically+business impossible. To implement a hard cap, a bill never to go over, they'd have to cut your service, but also delete all your data in databases, object storage, data la…

Srsly?

The mighty cloud provider can't solve this issue?

Google has second precision billing on compute.

Its not hard to define a base layer of allowed billing increase and adding this type of context to resource allocation.

You are not just suddenly creating a mlllion terabytes of data or a million db requests without supervision.

It could even be as simple as basic level caps like 100 euro / month, 1000, 10.000 etc.

And there is a difference between stoping everything before the spike happens vs. also deleting stuff.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#244

Post by sachinag »

Hey folks, I just wanted to drop a quick note here that there’s a way to stop billing in an emergency that’s officially documented on the Google Cloud documentation site: https://docs.cloud.google.com/billing/docs/how-to/disable-bi... . You can see the big red warning that this could destroy resources that you can’t get back even if you reconnect a billing account, but this is a way to stop things before they get out of control. This billing account disconnect goes all the way to implement a full on “emergency hand brake” that “unplugs the thing from the wall” (or whatever analogy you prefer) without you having to affirmatively do it yourself.

https://docs.cloud.google.com/billing/docs/how-to/modify-pro... and https://docs.cloud.google.com/billing/docs/how-to/budgets-pr... are other documented alternatives to receive billing alerts without the billing account disconnect.

The billing account disconnect obviously shouldn’t be used for any production apps or workloads you’re using to serve your own customers or users, since it could interrupt them without warning, but it’s a great option for internal workloads or test apps or proof of concept explorations.

Hope this helps!

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#245

Post by not_your_vase »

logankilpatrick wrote: post #170
startages wrote: post #152

Earlier quoted context omitted.

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

We have spend caps at the billing account level and the project level (developer set) in the Gemini API now. There is up to a 10 minute delay in processing everything but this should significantly mitigate the risk here: https://ai.google.dev/gemini-api/docs/billing#tier-spend-cap... By default, new Tier 1 paid accounts can only spend $250 in a given month.

I just find it extraordinary that the biggest tech company in the world can do cutting edge real time AI for millions of people, run Youtube and of course all the other google services with having literally the smartest people in the world and unlimited resources on board, but still can't keep real time track of the user's current billing and their spending limits, it's all best effort still. Somehow it doesn't add up. (Pun not intended, but I'm happy to have it)

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#247

Post by [deleted] »

827a wrote: post #236
tantalor wrote: post #67

Earlier quoted context omitted.

What does this have to do with security?

Billing control is security, to be clear, but beyond that: The key permissions that enable anyone to generate text also grant access to all GCP Generative AI endpoints in the project they were provisioned in. That includes things like Files that your system might have uploaded to Gemini for processing, and querying the Gemini context caches for recent Gemini completions your system did. Both of these are likely to co…

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#248

Post by croes »

alibarber wrote: post #88

Forgive my ignorance - but what's the payoff for fraudsters in getting access to a generative AI service for a short-ish period of time, before they get cut off? With EC2 / GCC credentials, I could understand going all out on bitcoin mining - but what are they asking the AI to do here that's worth setting up some kind of botnet or automation to sift the internet for compromised keys?

Generate phishing mails, spam mails, disinformation pictures and videos.

Youtube has plenty of scam ads where well known people try to get you to sign up for the WhatApp group for financial tips

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#249

Post by lotsofpulp »

benterix wrote: post #228
sofixa wrote: post #225

Earlier quoted context omitted.

If that happens, you create a support ticket and AWS/GCP/Azure wave it, especially the first time. They're aware that billing per usage can have surprise effects, but at the same time they don't want to kill their customers' workloads and delete their data, so it is what it is.

Here, I corrected that for you: > you create a support ticket and spend sleepless night praying that AWS/GCP/Azure wave it

I would prefer they waive it.
Post reply on HN