Earlier quoted context omitted.
Tax ids were never meant to be used as a form of global identification. If you go look in a real bank core, you'll find this field does not have any uniqueness constraints.
Why not? Two people with the same tax ID seems like a problem waiting to happen.
Google API keys weren't secrets, but then Gemini changed the rules
251–260 of 326 posts
Re: Google API keys weren't secrets, but then Gemini changed the rules
#252Earlier quoted context omitted.
I don’t see it. Imagine for a moment the there is no oversight. Every intern can ship prod code with their own homemade crypto. How do you, in a retail business, agree to accept credentials that anyone can mint for free? I mean obviously it happened. But… this doesn’t even seem like a compliance mistake. It’s a business-level mistake.
If you've never worked in a large corporate environment you don't know how stupid things become. In a perfect bureaucracy nobody thinks.
This resonates so well and I love it. I'm stealing this
Re: Google API keys weren't secrets, but then Gemini changed the rules
#253Many people wanted to be able to set a spending limit on google cloud account for many years but they were unable to implement anything, always suggesting a workaround by hosting a Cloud Run function which would remove billing from a project via API https://docs.cloud.google.com/billing/docs/how-to/disable-bi...
Re: Google API keys weren't secrets, but then Gemini changed the rules
#254Earlier quoted context omitted.
You're configuring something that costs money (electricity, hardware, real estate) to provide. Either it's "pay as you go" or you have a flat rate and a cap. If you have a cap and then your thing hits the front page and suddenly has 10000% more legitimate traffic than usual, and you want the legitimate traffic, they're going to get an error page instead of what you want. If there is no cap, you're going to get a larg…
it's not an either or, they can easily let me configure any kind of behavior that I want. No cap, a hard cap, a soft cap, a cap that I program with a python script, a cap where I throttle, a cap where I opt in to deleting certain machines to save money. It can all be done. People are complaining because obvious features are not provided. People would not be complaining if they had all the options that we needed to co…
Re: Google API keys weren't secrets, but then Gemini changed the rules
#255Earlier quoted context omitted.
Isn't there a limit to the number of projects you can make and then you have to ask support to increase it?
There is, yes. The rumor mill suggests that the default limit is 30. At $DAYJOB, we had a (not very special) special arrangement with GCP, and I never heard of anyone who was unable to create a project in our company's orgs [0]. Given how Google never, ever wants to have a human do customer support, I expect a robot will quickly auto-approve requests for "number of projects" quota increases. I know that's how it work…
Re: Google API keys weren't secrets, but then Gemini changed the rules
#256Earlier quoted context omitted.
> When I use OpenAI, Openrouter etc., I can put 10 $ on my API key, and when the key leaks, someone can use these 10 $ and that's it. On that note, I'll just mention that I had discovered over the last while that when you prepay $10 into your Anthropic account, either directly, or via the newer "Extra usage" in subscription plans, and then use Claude Code, they will repeatedly overbill you, putting you into a negativ…
I'm spitballing here, but I suspect that (same with AWS) google uses post processing for billing, they run a job that scrapes the states THEN bills you for that. instead of the major AI companies are checking billing every API request coming in.
This means that billing happens asynchronously. You may use queues, you may do batching, etc. But you won't have a realtime view of the costs
Re: Google API keys weren't secrets, but then Gemini changed the rules
#257Earlier quoted context omitted.
The new code changes from not existing, to existing. Indeed, the key doesn't change. The new capability comes from the new code . It would not be a re-evaluation of risk, because this is a new project. The evaluation of risk is supposed to come at the moment when the new capability is implemented, and consciously tied to an existing key type, which was previously advertised as non-secret.
You're replying to an LLM.
Re: Google API keys weren't secrets, but then Gemini changed the rules
#258Re: Google API keys weren't secrets, but then Gemini changed the rules
#259Earlier quoted context omitted.
You're configuring something that costs money (electricity, hardware, real estate) to provide. Either it's "pay as you go" or you have a flat rate and a cap. If you have a cap and then your thing hits the front page and suddenly has 10000% more legitimate traffic than usual, and you want the legitimate traffic, they're going to get an error page instead of what you want. If there is no cap, you're going to get a larg…
it's not an either or, they can easily let me configure any kind of behavior that I want. No cap, a hard cap, a soft cap, a cap that I program with a python script, a cap where I throttle, a cap where I opt in to deleting certain machines to save money. It can all be done. People are complaining because obvious features are not provided. People would not be complaining if they had all the options that we needed to co…