Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

271–280 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#271

Post by spiznnx »

addandsubtract wrote: post #165
zozbot234 wrote: post #78

Earlier quoted context omitted.

> Google also has historically treated API keys as non-secrets, except with the introduction of the keys for LLM inference, then users are supposed to treat those secretly This was reported a long time ago, and was supposed to be fixed by Google via making sure that these legacy public keys would not be usable for Gemini or AI. https://news.ycombinator.com/item?id=47156925 https://ai.google.dev/gemini-api/docs/troubl…

FWIW, I just create a new Gemini API key today, and it had a different format than my old ones (created 10 days ago). So maybe they changed something?

I think brand new stuff is probably safe, but old keys that currently being used for AI and non-AI stuff - if Google disables them for AI and it turns out it was actually not being exposed publicly, could disrupt a user's production service relying on AI.

They messed up by allowing old keys to be used for both private and public APIs in the first place, but now it's difficult for them to undo that for existing keys.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#272

Post by Epskampie »

michaelt wrote: post #269
giancarlostoro wrote: post #267

Earlier quoted context omitted.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

If I budget enough to store 1TB of data for 1 month, then on the first day of the month I store 2TB of data - what should the behaviour be after 15 days?

Read/write access should be frozen, data should be saved for 1 month so you have time to react to warning emails. If you didn't upgrade in that time, it should be deleted.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#273

Post by danelliot »

mcccsm wrote: post #40

Two things that should be default on any GCP project touching generative-AI APIs: 1 API-key restrictions by HTTP referrer AND by API (`generativelanguage.googleapis.com` only), 2 a billing budget with a Pub/Sub "cap" action, not just an email alert. Neither is on by default, and almost nobody sets them before shipping. 13 hours is actually fast for detection. most teams find out at end-of-month reconciliation.

[dead]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#274

Post by pfortuny »

TrackerFF wrote: post #192
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

It's like a fire alarm system that goes off 30 mins after the it senses a fire. Good stuff.

But sending an email, not blaring...

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#275

Post by Barbing »

charcircuit wrote: post #242
Barbing wrote: post #232

Earlier quoted context omitted.

Interesting! I know software is special. That's why software defects are acceptable while a crumbling bridge is not. With that said, should this apply to other industries? If I clip a warehouse shelf on my first day driving a forklift, should my wages be garnished for life to cover the inventory? Or is the inherent nature of the logistics industry such that an accident does not always imply liability? (Or other)

The employer is held liable in such a scenario.

Sounds right. Not sure if this is the position:

If you’re coding, you should pay for your mistakes, if you’re driving a forklift (sober/responsibly), your employer should pay?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#276

Post by nhuser2221 »

Moosdijk wrote: post #264
nhuser2221 wrote: post #235

Earlier quoted context omitted.

Happened to me to, luckily only was 40$, restricted the api the next day. They were using gemini 3 flash which I am not using.

That’s users, for ya! They will always find ways to use your product that you didn’t intend to or even knew about!

The funny thing is that the website only has firebase auth, without any ai features. The default api key that was created (before the ai was even released a few years back), someone got it from the website and started using the gemini api with the key.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#277

Post by Rekindle8090 »

giancarlostoro wrote: post #267
startages wrote: post #152

Earlier quoted context omitted.

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

You know that's not how the cloud works. If you're build by the hour for compute and that compute is powering a server, the only way to stop that is by shutting off the compute, breaking the server.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#278

Post by Rekindle8090 »

ch0wn wrote: post #142
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

"We can either charge per tile, per job or on demand. Or you can have us on call for a year and get any of the former at a discounted rate." "Per tile. Lay tiles until I say stop" >you fall asleep "Wtf why are you still laying tile" "You said per tile and lay until you say stop. That'll be 50k please"

How is this the contractors fault?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#279

Post by glenpierce »

Rekindle8090 wrote: post #277
giancarlostoro wrote: post #267

Earlier quoted context omitted.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

You know that's not how the cloud works. If you're build by the hour for compute and that compute is powering a server, the only way to stop that is by shutting off the compute, breaking the server.

I would love to have a “if the bill for this hobby project becomes a threat to my ability to pay my mortgage, nuke it.” If I cared about the data enough. I’d have backed it up.
Post reply on HN